Privacy Policy

Effective September 2, 2026. This Privacy Policy applies to chericohenpilates.com and the native account, consultation, client, support, and administrative services that link to it. It does not govern a third-party site or service after you leave our website.

Cheri Cohen Pilates ("Cheri Cohen Pilates," "we," "us," or "our") operates the website and determines how information submitted to the native platform is used. Questions and privacy requests may be sent to hello@chericohenpilates.com.

Information we collect

The information we collect depends on the features you use. We may collect the following categories:

Contact and identity information, such as name, email address, mobile number, mailing address when needed, account identifiers, and identity or representative-authority records.
Inquiry, waitlist, consultation, and service information, such as general Pilates goals, experience, availability, contact preference, appointment requests, confirmations, attendance, location, and service history. Public forms are not intended for diagnoses or detailed health information.
Account and relationship information, such as authentication state, profile preferences, client or student status, payer and participant relationships, and parent, guardian, or authorized-representative authority.
Forms, documents, and electronic-signature information when a secure form or agreement is assigned, including form answers, uploaded files, consent, signature evidence, version history, and access records.
Transaction information, such as products or offers viewed, orders, credits, packages, memberships, gift certificates, payment status, refunds, and provider transaction identifiers. Payment card numbers and payment credentials are intended to be collected and stored by Stripe, not by Cheri Cohen Pilates.
Education and content information, such as applications, enrollment, attendance, progress, assignments, quizzes, feedback, completion, certificates, and access to protected resources or video.
Communications information, such as email, support requests, account messages, attachments, push preferences, mobile-message consent and suppression records, message content, and delivery events.
Limited health and safety information only if a separately disclosed secure intake or clearance workflow is activated. Do not submit health details through public forms, ordinary email, support, or SMS.
Device, usage, and security information, such as IP address, browser and device details, timestamps, page and feature events, cookies or local-storage preferences, anti-abuse signals, error and security logs, and audit records.
Administrative and operational information, such as staff actions, authorization and access evidence, historical source provenance, and records needed to detect errors, prevent fraud, or preserve legal and operational evidence.

How information is collected

Directly from you when you browse, contact us, create an account, join a waitlist, request or receive services, make a purchase, complete a form, communicate, or change preferences.
From a parent, guardian, payer, participant, instructor, staff member, or other authorized representative involved in the same service relationship.
Automatically from the website, authentication, anti-abuse, security, communications, payment, video, and infrastructure services used to operate the platform.
From legacy business systems during controlled import, reconciliation, and retirement, where the information was previously collected for the business relationship.

Why we use information

Provide, personalize, schedule, secure, support, and document requested services and account features.
Respond to inquiries, administer waitlists and consultations, manage client or education relationships, and maintain accurate records.
Process orders and payments, issue receipts, administer credits or entitlements, prevent fraud, and reconcile provider records.
Send service communications; send marketing email only with the applicable separate email choice; and store a separate optional preference for possible future marketing SMS. Marketing SMS is not being sent yet.
Operate support, accessibility, safety, authentication, audit, incident-response, and legal-compliance processes.
Measure first-party website and service performance, improve the platform, diagnose errors, and protect people, accounts, content, and systems.
Comply with law, enforce applicable agreements, preserve consent and suppression evidence, resolve disputes, and establish or defend legal claims.

How information is disclosed

We disclose information only as reasonably needed for the purposes described above, subject to contractual, technical, and legal controls. Current or potential recipient categories include:

OVHcloud for website hosting, Cloudflare for DNS and edge delivery, Convex for the application backend, database, files, real-time updates, scheduled work, and audit records, and Clerk for account authentication and session management.
Cloudflare for DNS and traffic services, Turnstile anti-abuse checks, protected video, private media recovery, and authorized live rooms.
Stripe for payment processing, saved-payment authorization, subscriptions when offered, receipts, refunds, fraud controls, and related payment services.
Resend for transactional or separately authorized marketing email and related delivery, bounce, complaint, and inbound-email events.
Telnyx as the primary operational provider for voice, voicemail, and—after carrier approval—SMS/MMS delivery. Twilio is the manually controlled secondary messaging provider and does not receive current application voice or messaging traffic.
Browser and operating-system push services when you enable push notifications, and Google Calendar only if the optional owner calendar connection is activated.
Tides Pilates and other third-party destinations when you choose to follow an external link. Information you then provide is governed by that third party's notices; the native platform does not automatically create a Tides booking.
Professional advisers, insurers, auditors, regulators, courts, law enforcement, or other parties when reasonably necessary to obtain advice, comply with law, protect rights or safety, investigate misuse, or handle a transaction or organizational change.

No sale or behavioral advertising

We do not sell personal information for money. The current application does not use Google Analytics, Meta Pixel, or another third-party cross-site behavioral advertising tracker, and we do not currently share personal information for cross-context behavioral advertising. If those practices change, we will update this Policy and provide any notice or choice required by law before the change applies.

Mobile and text-message information

Mobile information, text-messaging originator opt-in data, and consent will not be sold, rented, or shared with third parties or affiliates for their marketing or promotional purposes. All other disclosure categories in this Policy exclude text-messaging originator opt-in data and consent for marketing or promotional use. We may disclose mobile information and consent status to service providers, telecommunications providers, and carriers only as needed to deliver, secure, support, or document the Cheri Cohen Pilates messaging program, honor choices, or comply with law.

Service-text consent and future marketing-text consent are separate and optional. Marketing SMS is not being sent yet. Cheri Cohen Pilates may introduce occasional studio-news and offer texts in the future only for customers who make the separate optional marketing-SMS choice. That choice starts unchecked and can be changed independently. Saving this preference does not start marketing texts. We retain the mobile number, purpose, source, disclosure version, timestamp, message and delivery history, and opt-out or help events as needed to operate the program and prove that preferences were honored. Reply STOP to opt out, START to opt back in after opting out, or HELP for help. You may also change either text preference in your account or clearly communicate a revocation request to us. Do not send health, payment-card, password, or other sensitive information by SMS.

See the Text Messaging Program and Terms for program details.

Health and safety information

The public website, contact form, waitlist, ordinary email, support tools, and SMS program are not appropriate for detailed health information. If Cheri Cohen Pilates activates a secure health, wellness, risk-screening, restriction, or provider-clearance workflow, the collection must be limited to the disclosed purpose and accompanied by any additional notice, consent, authorization, access, deletion, and breach process required for the person and jurisdiction involved. Pilates services are not emergency or medical services. Call 911 or the appropriate emergency service for an emergency.

Cookies, local storage, and tracking signals

The site uses cookies and similar browser storage for authentication, security, consent and preference memory, feature operation, and first-party performance measurement. Authentication and payment providers may set their own necessary technologies. Optional cookies or features are controlled through the site's consent and preference tools where offered.

Because the current application does not perform third-party cross-site behavioral advertising, a browser Do Not Track signal does not change advertising behavior. Where applicable law requires recognition of a universal opt-out signal, such as Global Privacy Control, we will treat it as a request for the covered browser and processing. The site does not authorize third parties to collect personal information across unrelated sites over time for our advertising.

Retention

We retain information only for as long as reasonably necessary for the purposes described in this Policy, including providing services, maintaining accurate transaction and signature records, honoring consent and opt-out choices, securing the platform, resolving disputes, and satisfying tax, accounting, carrier, insurance, or legal obligations. Retention periods vary by record type and may be extended by a legal or operational hold. Deletion may preserve minimized evidence, suppression records, or records that law or a dispute requires. Provider backups and archives may expire on their own controlled schedules.

Security

We use administrative, technical, and organizational safeguards intended to protect information, including access controls, environment separation, encrypted transport, private file access, application encryption for designated sensitive records, provider-signature verification, audit evidence, and restricted staff capabilities. No system is perfectly secure. Please report a suspected account or security problem promptly and do not send passwords, verification codes, payment-card data, or detailed health information through ordinary messages.

Your choices and requests

You may update available profile and communication preferences in your account. You may ask us to provide access to, correct, or delete information associated with you, or to explain or limit certain processing. We may need to verify identity and authority, and we may deny or limit a request where another person's rights, security, fraud prevention, a legal obligation, a transaction, a signature, an active dispute, or another lawful exception requires retention or restricts disclosure. Where applicable law provides additional rights—including appeal, portability, withdrawal of consent, or use of an authorized agent—we will process a verified request under that law and will not discriminate for exercising it.

Send privacy requests to hello@chericohenpilates.com. Include only the information needed to identify the request; do not email sensitive documents unless we provide a secure method.

Children and representatives

The website and account services are not directed to children under 13 for independent use. A parent or legal guardian should contact us before submitting information for a minor. Where a service permits a guardian or authorized representative to act for another person, we may require evidence of identity, authority, scope, and expiration and may preserve that relationship and signature evidence.

Changes to this Policy

We may update this Policy prospectively as practices, providers, services, or law change. The page will show the effective date. We will provide additional notice or obtain renewed consent when required for a material change. Historical consent, transaction, and accepted-document evidence remains attached to the version in effect for that event.

Contact

Privacy questions and requests: hello@chericohenpilates.com. This email is not an emergency or secure medical channel.