Privacy Policy
Last updated September 3, 2026. KneadOps LLC.
Who We Are
KneadOps is an operations platform for massage, spa, and wellness practices, operated by KneadOps LLC ("KneadOps," "we," "us," or "our"). This Privacy Policy explains how we handle information in connection with the KneadOps platform, websites, and related services (the "Service"). It applies both to the practices that use KneadOps and to the clients those practices serve.
Two Types of Users
The Service involves two distinct groups:
- Practices (owners and staff) — the businesses that use KneadOps to run their operations. For the client information they manage, practices act as the controller of that information.
- Clients — the individuals served by a practice, whose information the practice manages within the Service.
For information that practices manage about their clients, KneadOps acts as a service provider and processor, handling that information on the practice's behalf and at its direction.
Information We Collect from Practices & Staff
When a practice uses the Service, we collect:
- account and contact details (such as business name, staff names, email, and phone);
- billing and subscription information needed to provide and bill for the Service;
- staff profile and role information used to manage access;
- login, usage, and device information generated as the Service is used.
Information We Process About Clients
On behalf of practices and at their direction, the Service may process information about a practice's clients, which can include:
- identity and contact details, including date of birth;
- appointment, scheduling, and visit information;
- messages and communications exchanged with the practice;
- payment, receipt, and billing records;
- health-related information, where a practice chooses to use the Service for it — such as intake and consent forms, notes, and insurance or authorization information.
KneadOps processes this information only to provide the Service to the practice and at the practice's direction.
Text messages
Text messages are sent by or on behalf of the practice you booked with (or KneadOps) as the message sender, with KneadOps as the platform provider. KneadOps may send appointment reminders, booking updates, account notifications, verification codes, and two-way service messages. Message frequency varies. Message and data rates may apply. Consent is not a condition of purchase.
Reply STOP to opt out or HELP for help. Opting out stops further texts; it does not delete your client record.
KneadOps does not sell or share SMS consent data with third parties for their own marketing. Phone numbers collected for texting are used only to send the messages you opted into and to operate this practice's texting program. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use-case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
How We Use Information
We use information to:
- provide, operate, maintain, and improve the Service for practices;
- process subscriptions and payments;
- secure the Service and prevent fraud and abuse;
- provide support and communicate about the Service.
We do not sell personal information, and we do not share it with advertising networks or data brokers. We do not use health-related information for advertising or marketing.
How Health-Related Information Is Handled
Some practices use the Service to manage health-related information about their clients. Where a practice places that information into the Service, we process it only to deliver the Service and at the practice's direction, using and disclosing only what is needed to do so. A client's request to access, correct, or delete their health-related information should be directed to the practice that holds it, since that practice controls the information; KneadOps assists the practice as its processor. Each practice remains responsible for its own legal and professional obligations regarding the information it manages.
Who We Share Information With
We share information only as needed to provide the Service. We rely on a limited set of trusted third-party providers, described here by category rather than by name:
- Payment processing — to handle subscriptions and the payments practices collect from clients.
- Cloud hosting and infrastructure — to host and store data securely and keep the Service running.
- Communications and telephony — to support messaging and call features.
- Analytics — to understand and improve how the Service performs.
A more detailed list of these providers is available on request through our Contact page. We may also disclose information where required by law or to protect rights, safety, and the integrity of the Service.
How We Protect Your Information
We maintain administrative and technical safeguards designed to protect information, including:
- Encryption of data in transit and at rest;
- Role-based access controls, so people see only the data appropriate to their role;
- Practice data isolation, keeping each practice's data separated from others';
- Time-boxed and audited support access, so any support access is limited in duration, requires a stated reason, and is logged;
- access and activity logging to support accountability.
KneadOps is built on infrastructure that supports HIPAA compliance and is SOC 2-audited, with your data encrypted in transit and at rest. Each practice remains responsible for its own regulatory obligations.
No system can be guaranteed to be perfectly secure, but we work to protect information using safeguards appropriate to its sensitivity.
Data Retention & Practice Control
Practices control the client data they place into the Service and can access, update, export, and request deletion of it. We retain information for as long as needed to provide the Service and to meet legal, accounting, and security obligations. When a practice closes its account, it is given a reasonable opportunity to export its data before it is deleted in accordance with our retention practices and applicable law.
Your Rights
Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. Because much of the information in the Service is managed by a practice as the controller, client requests should be directed to the relevant practice, and KneadOps will assist the practice in responding as its processor. You can reach us about your rights, or about how to contact a practice, through our Contact page.
U.S. State Privacy Rights
Residents of California and other U.S. states with comprehensive privacy laws may have additional rights, including the right to know what personal information is collected, to request access or deletion, to correct inaccurate information, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are commonly defined, and we do not discriminate against anyone for exercising their privacy rights. To make a request, use our Contact page.
Children's Privacy
The Service is intended for use by practices and their authorized staff and is not directed to children. Where a practice manages information about a minor client, the practice is responsible for obtaining any consents required by law and for handling that information appropriately as the controller.
International Data
The Service is operated from, and information is processed in, the United States. If you access the Service from outside the United States, you understand that your information will be processed in the United States, where data-protection laws may differ from those in your location.
Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and provide notice as appropriate. Your continued use of the Service after the changes take effect constitutes acceptance of the updated policy.
Contact Us
Questions about this Privacy Policy, and any privacy or data requests, should be sent through our Contact page. There is no separate public privacy email address; the Contact page is the correct channel for privacy and general inquiries.