Effective Date: July 1st, 2026

Movement Co. ("Movement Co.," "we," "us," or "our") respects your privacy and is committed to protecting it through this Privacy Policy. This Policy describes how we collect, use, disclose, and safeguard your information when you visit our website, use our on-demand application, book or attend an in-person class, workshop, or retreat, or otherwise interact with our services (collectively, the "Services").

This Policy should be read together with our Terms and Conditions. If you do not agree with this Policy, please do not access or use our Services.

1. Scope of This Policy

This Policy applies to information collected through:

- Our website movementco.live;
- Our Movement Co. on-demand mobile application, available on the Apple App Store and Google Play;
- Our class booking and scheduling tools, including our third-party booking platform (Bloomy);
- Our on-demand video hosting platform (Arketa);
- In-person classes, workshops, and retreats hosted or co-hosted by Movement Co.;
- Email, SMS, and social media communications you have with us; and
- Any other interaction you have with Movement Co. that references this Policy.

This Policy does not apply to third-party websites, applications, or services that we do not own or control, even if you access them through a link on our Services. Please review the privacy policies of those third parties directly.

2. Information We Collect

A. Information You Provide to Us

- Account and profile information: name, email address, phone number, username and password, date of birth, and profile photo.
- Health and fitness information you choose to share: self-reported fitness level, injuries, physical limitations, pregnancy or postpartum status, and other information you voluntarily provide to help us tailor programming (for example, in Pre/Post-natal classes) or that you disclose to an instructor before or during a class.
- Booking and attendance information: class registrations, attendance history, retreat and workshop registrations, waivers, and emergency contact information.
- Payment information: billing name, billing address, and the last four digits of your payment card. We do not directly collect or store full payment card numbers, bank account numbers, or similar financial account credentials — these are collected and processed by our third-party payment processors and, for in-app purchases, by Apple and Google (see Section 8).
- Communications: messages you send us through our website, app, email, social media, or in person, including customer support requests and testimonials.
- User-generated content: photos, videos, comments, or other content you submit, including retreat or event photos you consent to being featured in.

B. Information We Collect Automatically

- Device and usage data: IP address, browser type, device identifiers, operating system, referring URLs, pages viewed, links clicked, and timestamps.
- App and class activity: classes viewed or completed, workout duration, pillar and category preferences, favorites, playback behavior, and in-app navigation.
- Approximate location: derived from your IP address, used to show applicable in-person class schedules and for fraud prevention. We do not collect precise GPS location unless you separately grant that permission on your device, and we do not currently use precise geolocation for any feature.
- Cookies and similar technologies: see Section 6 ("Cookies and Tracking Technologies") below.

C. Information from Third Parties

- Booking platform (Bloomy): booking confirmations and attendance records for in-person classes.
- On-demand hosting platform (Arketa): video viewing and engagement data associated with your on-demand account.
- Payment and app store platforms: confirmation of subscription status, purchase, renewal, or cancellation from Apple, Google, or our payment processor. We do not receive your full payment credentials from these platforms.
- Social media platforms: if you interact with our social media pages or choose to log in or link a social account, we may receive basic profile information consistent with your privacy settings on that platform.

3. How We Use Your Information

We use the information we collect to:

- Create and manage your account and process class or retreat registrations;
- Provide, operate, and maintain the on-demand app and website, including displaying your booking history and favorites;
- Process payments and manage subscriptions, including through Apple and Google in-app purchase systems;
- Personalize programming recommendations and communications based on your stated preferences, fitness level, or self-reported health information;
- Communicate with you about classes, retreats, schedule changes, cancellations, and customer support requests;
- Send marketing communications about new classes, programming, retreats, or promotions, where you have not opted out (see Section 10);
- Maintain the safety of in-person classes and retreats, including using emergency contact and health-limitation information you provide;
- Analyze usage of the app and website to improve programming, content, and user experience;
- Detect, investigate, and prevent fraudulent transactions and other illegal or unauthorized activity; and
- Comply with legal obligations and enforce our Terms and Conditions.

We do not use your health or fitness information to make automated decisions that produce legal or similarly significant effects concerning you, and we do not use sensitive health information for advertising purposes.

4. Legal Bases for Processing (EU/UK Visitors)

If you are located in the European Economic Area, United Kingdom, or Switzerland, we process your personal data on one or more of the following legal bases under the General Data Protection Regulation (GDPR):

- Performance of a contract: to create your account, process bookings, and provide the Services you request.
- Consent: for marketing communications, optional health-related disclosures, and non-essential cookies. You may withdraw consent at any time.
- Legitimate interests: to improve our Services, maintain security, and communicate with existing clients about similar programming, balanced against your rights and interests.
- Legal obligation: where processing is necessary to comply with applicable law.

Special category data (such as health information relating to pregnancy, postpartum status, or injuries) is processed only with your explicit consent or where necessary to protect your vital interests (for example, instructor awareness of an injury during a live class).

5. How We Share Your Information

We do not sell your personal information for money. We may share information as follows:

- Service providers: third parties who perform services on our behalf, including Arketa (video hosting), Bloomy (booking), Squarespace (website hosting), payment processors, email and SMS providers, and cloud storage providers (e.g., Google Drive). These providers are authorized to use your information only as necessary to provide their services to us.
- Retreat and event vendors: property owners, caterers, and other vendors involved in delivering a retreat or workshop you have registered for, limited to what is necessary (e.g., name, dietary restrictions, arrival details).
- Instructors and staff: relevant booking and health-limitation information is shared with instructors teaching your class or retreat so they can teach safely.
- App marketplaces: Apple and Google receive purchase and subscription information necessary to process in-app purchases, governed by their own privacy policies.
- Legal and safety purposes: where required by law, subpoena, or legal process, or where we believe disclosure is necessary to protect the rights, property, or safety of Movement Co., our clients, or others.
- Business transfers: in connection with a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to standard confidentiality protections.

We do not knowingly share precise health diagnoses or medical records with any third party for advertising or marketing purposes.

6. Cookies and Tracking Technologies

Our website uses cookies and similar technologies (such as pixels and local storage) to operate core features, remember your preferences, and understand how visitors use our site.

Strictly necessary: Required for the website and booking flow to function (e.g., session management, security).

Functional: Remembers preferences such as previously viewed classes.

Analytics: Helps us understand aggregate traffic and usage patterns (e.g., Squarespace analytics, Google Analytics).

Marketing / advertising: We do not currently use advertising or retargeting pixels (such as the Meta Pixel, Google Ads tag, or TikTok Pixel) on our website. If we begin using these tools in the future, we will update this Policy to name the specific tools, and will provide a cookie consent mechanism before placing any non-essential advertising cookies.

Where required by law, we will request your consent before placing non-essential cookies and will provide a mechanism to manage your preferences. You can also control cookies through your browser settings, though disabling certain cookies may affect site functionality.

7. Third-Party Platforms and In-App Purchases

Certain features of our Services rely on third-party platforms that maintain their own privacy practices:

- Apple App Store / Google Play: if you subscribe or make a purchase through the App Store or Google Play, that transaction is processed by Apple or Google, not Movement Co. We do not receive or store your full payment card information. Please review Apple's and Google's privacy policies for details on how they handle your payment and account data.
- Bloomy: our in-person class booking system. Booking, attendance, and related scheduling data is stored and processed by Bloomy on our behalf.
- Arketa: our on-demand video hosting platform, which processes your viewing activity and account data to deliver on-demand content.
- Squarespace: our website is hosted on Squarespace, which processes certain technical and analytics data as our hosting provider.

These third parties act as our service providers/processors for the data disclosed to them, but each also operates under its own privacy policy for data it independently collects (such as your Apple ID or Google account information). We encourage you to review those policies.

8. Health, Biometric, and Other Sensitive Information

Some of the information you may choose to share with us — such as pregnancy or postpartum status, injuries, physical limitations, or other health-related details — may be considered "sensitive personal information" or "special category data" under applicable law, including California's CCPA/CPRA and the GDPR.

- We collect this information only where you voluntarily provide it (for example, to help us recommend appropriate programming or to inform an instructor of an injury), and we use it solely for that purpose.
- We do not use sensitive health information for advertising, and we do not sell it.
- Movement Co. is not a healthcare provider, and our Services — including Pre/Post-natal programming — do not constitute medical advice. Always consult a qualified healthcare provider before beginning any exercise program, particularly during or after pregnancy or if you have an injury or medical condition.
- Movement Co. does not knowingly collect biometric identifiers such as fingerprints, voiceprints, or facial geometry through our Services. If this changes (for example, through a future app feature), we will update this Policy and obtain any consent required by law, including under the Illinois Biometric Information Privacy Act (BIPA).

California residents have the right to limit the use of sensitive personal information to purposes necessary to provide the Services. You may exercise this right using the contact details in Section 14.

9. Data Retention

We retain personal information only for as long as necessary to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. Retention periods vary by data type:

Payment, billing, and tax-related records: 7 years from the date of the transaction, consistent with standard accounting and tax recordkeeping practice.

Booking and attendance records: 7 years from the date of the class, workshop, or retreat.

Account and profile information: For as long as your account remains active, and up to 2 years after your last activity, after which it is deleted or anonymized unless you reactivate your account or request earlier deletion.

Health, injury, or physical-limitation information disclosed for class safety: For the duration of the class, program, or retreat season to which it relates, and no longer than 1 year, unless you ask us to retain it longer for ongoing programming.

Marketing preferences and communication history: Until you unsubscribe or request deletion, plus a limited period afterward to record and honor your opt-out.

Customer support and general communications: Up to 3 years from the date of the communication.

When a retention period expires, we take reasonable steps to delete, de-identify, or anonymize the information, except where longer retention is required to comply with law, resolve a dispute, or enforce our agreements.

10. Marketing Communications

If you have opted in to receive marketing emails or text messages from Movement Co., you may opt out at any time by:

- Clicking "unsubscribe" at the bottom of any marketing email;
- Replying "STOP" to any marketing text message; or
- Contacting us directly at the email address in Section 14.

Even if you opt out of marketing communications, we may still send you transactional or administrative messages related to your account, bookings, or purchases (for example, a class cancellation notice).

11. Data Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect your personal information from unauthorized access, use, alteration, or disclosure. These may include encryption in transit, access controls, and working with service providers who maintain their own security safeguards.

However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your information, we cannot guarantee its absolute security, and you provide information to us at your own risk.

If we become aware of a data breach involving your personal information, we will notify you and any applicable regulators as required by law, including under the FTC Health Breach Notification Rule where applicable to health-related information we hold.

12. Your Privacy Rights

A. California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

- Know what personal information (including sensitive personal information) we have collected, used, disclosed, and, if applicable, sold or shared about you;
- Request deletion of your personal information, subject to certain exceptions;
- Correct inaccurate personal information;
- Opt out of the "sale" or "sharing" of your personal information (Movement Co. does not sell personal information for money and does not knowingly share personal information for cross-context behavioral advertising as those terms are defined by the CCPA);
- Limit the use and disclosure of sensitive personal information to purposes necessary to provide the Services; and
- Not receive discriminatory treatment for exercising any of these rights.

To exercise these rights, contact us using the details in Section 14. We will verify your identity before fulfilling your request, consistent with CCPA requirements. You may also designate an authorized agent to submit a request on your behalf.

B. EU/UK/EEA Residents (GDPR)

If you are located in the EEA, UK, or Switzerland, you have the right to access, correct, delete, restrict, or port your personal data, to object to certain processing, and to withdraw consent at any time where processing is based on consent. You also have the right to lodge a complaint with your local data protection authority.

C. Other U.S. State Residents

Depending on your state of residence, you may have similar rights under state privacy laws such as Virginia's VCDPA, Colorado's CPA, Connecticut's CTDPA, or other applicable state privacy statutes, including the right to access, correct, delete, and opt out of certain processing of your personal information.

13. Children's Privacy

Our Services are not directed to, and are not intended for use by, children under the age of 13, and our website and app require users to be at least the age of legal majority in their jurisdiction, or to have consent from a parent or legal guardian, consistent with our Terms and Conditions.

We do not knowingly collect personal information from children under 13 in a manner inconsistent with the Children's Online Privacy Protection Act (COPPA). If we learn that we have inadvertently collected personal information from a child under 13 without verifiable parental consent, we will take steps to delete that information. If you believe we may have collected information from a child under 13, please contact us using the details in Section 14.

14. International Users and Data Transfers

Movement Co. is based in the United States, and the information we collect is generally processed and stored in the United States. If you access our Services from outside the United States, your information will be transferred to, stored, and processed in the United States, where privacy laws may differ from those of your country. By using our Services, you consent to this transfer, subject to appropriate safeguards where required by applicable law (such as GDPR standard contractual clauses, if applicable).

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our Services, or applicable law. When we make material changes, we will update the "Last Updated" date above and, where required by law, provide additional notice (such as an in-app notification or email). Your continued use of the Services after an update constitutes acceptance of the revised Policy.

16. Contact Us

If you have questions about this Privacy Policy, or wish to exercise any of your privacy rights, you can reach us at:

Movement Co.
Email: michelle@movementco.live