Effective date: September 1, 2026
Last updated: October 6, 2026
This Privacy Policy explains how Embodied Academy ("we," "us," or "our") collects, uses, and shares personal information when you visit embodiedacademy.com, sign up for a free program such as the HOME Body Challenge, buy a Membership, or use our member portal, community, and live classes (the "Services").
Embodied Academy is based in Ontario, Canada. We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply to you, other privacy laws such as the GDPR, UK GDPR, and U.S. state privacy laws. For people in the UK, EU, and EEA, we are the "controller" of your personal information. Our contact details are at the end of this policy.
Information you give us
Information collected automatically
Information from others
Sensitive information. We do not ask you for health information. However, embodiment and somatic practice can be personal, and you may choose to share health, emotional, or other sensitive details in the community or with us. Please share only what you are comfortable with. Anything you post in the community can be seen by other members. We use sensitive information only to provide the Services and support you, and we do not use it for advertising.
We use personal information to:
If UK or EU data protection law applies to you, we rely on these legal bases:
Under PIPEDA, we collect, use, and share personal information only with your knowledge and consent, and only for the purposes described in this policy that a reasonable person would consider appropriate. By signing up or buying a Membership, you consent to these uses. We rely on express consent for marketing emails (as required by Canada's Anti-Spam Legislation, CASL), for any sensitive information you choose to share, and where otherwise required. You can withdraw consent at any time, subject to legal or contractual limits; if you do, we may not be able to provide some Services.
We do not sell your personal information for money. We share personal information with service providers who help us run the Services, only as needed for them to do their work:
| Purpose | Provider |
|---|---|
| Website, landing pages, sign-up forms, and customer database | HighLevel (GoHighLevel / LeadConnector) |
| Checkout pages (payment links) | FastPayDirect payment links |
| Card payment processing | Stripe |
| PayPal payments (if you choose PayPal at checkout) | PayPal |
| Member portal and community | Mighty Networks |
| Live classes | Zoom |
| Email marketing and service emails | HighLevel (GoHighLevel / LeadConnector) |
| Text messages (if used) | HighLevel (GoHighLevel / LeadConnector) |
| Advertising measurement | Meta Platforms (Meta Pixel on our website) |
| Analytics | Google Analytics, Google Tag Manager |
| Accounting and tax | Intuit Quickbooks |
We may also share information:
We and our providers use cookies, pixels, and similar tools to make the site work, remember your choices, understand site traffic, and measure our ads.
Your choices: You can change your cookie preferences or withdraw your consent at any time by blocking or deleting cookies in your browser settings, and adjust your ad settings in your Facebook or Instagram account. We do not currently respond to "Do Not Track" signals. We honor Global Privacy Control (GPC) signals as an opt-out of sharing, where required by law.
If you sign up for a free program, join our list, or buy a Membership, we may send you emails, and if you opted in, SMS messages about our programs, classes, retreats, and offers. You can unsubscribe at any time by clicking the "unsubscribe" link at the bottom of any marketing email, or by emailing [email protected]. You can stop text messages by replying STOP.
Even if you unsubscribe from marketing, we will still send you important messages about your account, such as receipts and renewal notices.
We keep personal information only as long as we need it for the purposes in this policy:
We use reasonable technical and organizational measures to protect personal information, and we choose providers that use industry-standard security, such as encrypted payment processing. No system is perfectly secure, so we cannot guarantee security. If a breach of security creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as PIPEDA requires, and notify others where other laws require. Please use a strong, unique password for your account.
Depending on where you live, you may have the right to:
To make a request, email [email protected]. We may need to confirm your identity before acting. We will not treat you differently for using your rights. We aim to respond within the time the law requires (for example, 30 days under PIPEDA, one month under UK/EU law, and 45 days under California law).
You have the right to ask for access to the personal information we hold about you, to learn how it has been used and shared, and to ask us to correct it if it is inaccurate or incomplete. You can also withdraw your consent as described in Section 3. If you are not satisfied with how we handled your request or concern, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). Our privacy contact, who is accountable for our compliance with this policy, is Dani, reachable at [email protected].
In addition to the rights above, you have the right to restrict processing and to complain to your local data protection authority (in the UK, the Information Commissioner's Office, ico.org.uk). We would appreciate the chance to address your concern first.
If the California Consumer Privacy Act, as amended by the CPRA, applies to us, California residents have these rights:
Categories we collect (past 12 months): identifiers (name, email, phone, IP address); customer records (billing address, limited payment information); commercial information (plans bought, payment history); internet activity (pages viewed, interactions with our site and emails); approximate geolocation; audio and visual information (live class recordings, profile photos); and, only if you choose to share it, sensitive information such as health details. Sources, purposes, and recipients are described in Sections 1, 2, and 4. We keep each category as described in Section 7.
You can use an authorized agent to make a request; we may ask for proof of authorization. We do not knowingly sell or share the personal information of anyone under 16.
The Services are for adults aged 18 and older. We do not knowingly collect personal information from children under 13 (or under 16 in the UK/EU). If you think a child has given us personal information, please email [email protected] and we will delete it.
Embodied Academy serves members around the world. We are based in Canada, and our service providers may store and process information in the United States and other countries whose data protection laws may differ from yours. Information stored outside Canada may be accessible to courts, law enforcement, and national security authorities in those countries. We use contracts and other measures to make sure our providers protect your information to a comparable standard, as PIPEDA requires. When we transfer personal information from the UK, EU, or EEA, we rely on appropriate safeguards, such as the European Commission's adequacy decision for Canada (for information we process under PIPEDA), the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-U.S. Data Privacy Framework where our providers take part in it.
Our site links to other services, such as Mighty Networks, Facebook, and Instagram. Those services have their own privacy policies, and we are not responsible for how they handle your information. Please review their policies.
We may update this Privacy Policy from time to time. We will post the new version on this page and change the "Last updated" date. If we make important changes, we will tell you by email or in the member portal.
Questions or requests about your privacy? Contact us: