Privacy policy

MEDIC PARADISE PRIVACY NOTICE

LAST UPDATED: October 1, 2026

OVERVIEW AND SCOPE

This Privacy Notice explains how Carpe Diem CA, LLC dba Medic Paradise (“Medic Paradise,” “MP,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal data when you visit www.medicparadise.com or related sites or apps where this policy is posted (the “Site”), communicate with us, or use our marketplace services to discover and book services offered by independent wellness and medical facilities (“Providers”). This Notice applies to consumers, visitors, account holders, and Providers using the Site and complements our Terms of Service and Cookie Policy.

The Site is operated in the United States and intended for use by individuals who are located in the United States. In addition, the Site is intended to facilitate bookings with Providers, but is not intended to collect or receive health information. Please do not submit any health or medical information (e.g., treatment summaries, appointment outcomes, before-and-after photographs, diagnoses, medical records, or clinical notes) to use or through the Site.

Role clarification: MP operates a marketplace as an independent intermediary and merchant of record for bookings. We do not practice medicine or provide clinical oversight. Care is delivered solely by independent Providers.

Controller status: For data we collect to run the Site (for example, accounts, bookings, payments, support), MP acts as an independent “controller” under EU/UK GDPR and some U.S. state privacy laws, and a “business” under the California Consumer Privacy Act (“CCPA”). When we transmit necessary booking details to Providers to fulfill services, MP and the receiving Provider generally act as independent controllers/business for their respective processing. This policy does not apply to Provider’s handling of your personal information. If you have any questions regarding a Provider’s processing of your personal information, please contact the relevant Provider directly.

NOTICE AT COLLECTION

We collect, and in the past 12 months have collected, the following categories of information from and about you: identifiers; protected classifications under California or federal law; commercial information; internet or similar network activity; geolocation data; professional information; education information; inferences drawn from other personal information; and sensitive personal information (e.g., government IDs and precise geolocation information). We collect these categories of information from you in order to provide our services to you, to run our business, to communicate with you, and as required by law. We may have disclosed each of these categories of personal information for a business purpose as described below. We have not “sold” or “shared” personal information in the past 12 months, as these terms are defined by the CCPA. For a description of your privacy rights, and instructions on how to exercise those rights, including how to opt-out of our “sharing” of personal information for cross-contextual marketing purposes, please see Section 13, below.

We will retain each of these categories of personal information as described below in Section 9.

PERSONAL DATA WE COLLECT

Depending on your use of the Site, we may collect:

  • Identifiers and contact data: name, email, phone, postal address, country/region, account ID, cookie/advertising IDs, IP address.
  • Account and communications: login credentials, profile preferences, support inquiries, call/chat or email records.
  • Booking and logistics: requested services, dates/times, location, language, nondiagnostic suitability notes you choose to share (for example, allergies), and other scheduling details. We instruct users not to upload health information (e.g., clinical records) through the Site.
  • Government ID/verification (where required): for fraud prevention or preappointment identity checks (for example, driver’s license, passport).
  • Payment and transaction data: payment method tokens, last four digits, billing details, transaction dates/amounts (processed primarily by our payment processors).
  • Device/usage data: log files, IP/MAC, device identifiers, browser type, operating system, app version, pages viewed, links clicked, time on page, referral/exit pages, crash/error data.
  • Marketing and preferences: newsletter/SMS optins, interests, cookie/consent choices (see Cookie Policy).
  • Inferences/segments: highlevel audience categories to improve services or personalize marketing (for example, “interested in wellness retreats”).
  • Sensitive personal data (limited): only as strictly necessary and permitted by law (for example, identity documents for verification). MP does not request or store health information (e.g., clinical charts).

SOURCES OF PERSONAL DATA

  • Directly from you (account, forms, bookings, chat/support).
  • Automatically from your devices and browsers (cookies, pixels, SDKs, server logs).
  • From Providers (for example, appointment status, completion confirmations).
  • From partners and vendors (payments, fraud/security, analytics, advertising).
  • From lawful thirdparty data providers and public sources (for example, contact validation, fraud prevention).

HOW WE USE PERSONAL DATA (PURPOSES)

We use personal data to:

  • Operate, secure, and improve the Site and marketplace.
  • Create and manage accounts; authenticate and maintain sessions.
  • Facilitate discovery and complete bookings as merchant of record; transmit necessary booking details to Providers you select.
  • Provide support (typical response 24–48 hours) and service communications.
  • Process payments, refunds, credits; prevent fraud, chargebacks, abuse.
  • Personalize content and communications; perform analytics and A/B testing.
  • Send transactional messages and, with consent or as permitted by law, marketing communications (email/SMS) with optout options.
  • Enforce terms; comply with laws; respond to lawful requests; protect safety, rights, and property.
  • Produce deidentified or aggregated insights for product and business development.

LEGAL BASES (EU/UK GDPR)

As stated above, this Site is operated in the United States and is intended for use by individuals who are located in the United States. Regardless, where GDPR/UK GDPR applies, our legal bases include:

  • Performance of a contract: accounts, bookings, support.
  • Legitimate interests: Site security, fraud prevention, product improvement, limited direct marketing to existing users (with balancing tests).
  • Consent: nonessential cookies/analytics/advertising; certain marketing; precise geolocation; some international transfers where required.
  • Legal obligations: tax, accounting, KYC/AML where applicable.
  • Vital interests: disclosures necessary to help avert serious harm (rare).

HOW WE DISCLOSE PERSONAL DATA

We disclose personal data as follows:

  • Our Vendors (service providers or data processors): payment processing, cloud hosting, storage, security/fraud detection, analytics, communications (email/SMS), consent management, ad tech (for permitted purposes).
  • Providers (independent controllers): independent wellness/medical facilities receive booking details to deliver services under their own privacy and healthcare obligations.
  • Advertising/analytics partners: to measure performance and, with consent where required, for interestbased advertising (see Cookie Policy for choices).
  • Corporate transactions: in connection with mergers, acquisitions, financing, or sale of assets (subject to confidentiality and lawful safeguards).
  • Legal/safety: to comply with law or protect rights, safety, and security (for example, investigating fraud or abuse).

CHILDREN

The Site is not directed to children under 18 (or the higher age where local law requires consent for online services). We do not knowingly collect or profile children for targeted advertising. If you believe a child provided personal data, contact us to request deletion.

RETENTION

We retain personal data no longer than necessary for the purposes described or as required by law. Illustrative periods:

  • Accounts/bookings: retained while your account is active and a reasonable period thereafter (for example, 3–7 years) to address disputes, tax, and compliance.
  • Payments/financial records: retained as required by financial and tax laws.
  • Marketing preferences and analytics events: retained according to consent status, technical limits, and Cookie Policy lifetimes. We deidentify or aggregate data where feasible.

SECURITY

We use administrative, technical, and physical safeguards designed to protect personal data, including access controls, encryption in transit (TLS 1.2+) and at rest (for applicable systems), leastprivilege access, network segmentation, logging/monitoring, and vendor due diligence. No system is perfectly secure; keep your credentials confidential and notify us of any suspected unauthorized activity.

YOUR RIGHTS AND CHOICES

  • Communications: Unsubscribe links in emails; reply STOP to SMS where available. Transactional messages may still be sent.
  • SMS Policy: If you sign up to receive text message updates, or contact us by text message, we may send you SMS messages. Note that message and data rates may apply. The frequency of messages may vary and depend on your engagement or inquiry. You may reply “HELP” if you need assistance of “STOP” to stop receiving SMS messages. If you opt out, we may send you a confirmation SMS message to acknowledge your request. We do not sell or share phone numbers to third parties for their own marketing purposes.
  • Cookies/ad tech: Manage via our banner/preferences center and browser settings; see our Cookie Policy (including Global Privacy Control (GPC) handling).
  • Data subject/consumer rights: Depending on your jurisdiction, you may have rights to access, delete, correct, restrict, object, or port data; withdraw consent; and appeal a denial. See Sections 12 and 13 for regional details and how to exercise rights.

EU/UK DISCLOSURES (GDPR/UK GDPR)

As stated above, this Site is operated in the United States and is intended for use by individuals who are located in the United States. Regardless, where GDPR/UK GDPR applies:

  • Controller: Carpe Diem CA, LLC dba Medic Paradise is the controller for the Site. Where legally required, our EU/UK representative details will be provided in this Notice or upon request.
  • International transfers: When transferring personal data outside the EEA/UK to countries without an adequacy decision, we implement appropriate safeguards (for example, EU Standard Contractual Clauses (2021/914) and/or the UK IDTA/Addendum) and supplementary measures where necessary.
  • Rights: You have rights to access, rectify, erase, restrict, object (including to direct marketing), and data portability; and to withdraw consent without affecting prior processing. You may lodge a complaint with your supervisory authority (for example, your EU DPA or the UK ICO).
  • Special categories: MP does not seek specialcategory medical records via the Site. If you voluntarily share limited suitability notes (for example, allergies) to assist logistics, we process them only as necessary to fulfill your request and as permitted by law (for example, with explicit consent where required).

U.S. STATE PRIVACY NOTICES

Based on your state of residence, you may have the rights listed below with respect to the personal information that we maintain about you. This may include the California Consumer Privacy Act (“CCPA”) and, in relation to consumer health data, Washington’s My Health My Data Act. We will process this consumer health data with your consent where required, or as reasonably necessary to provide a service you request.

  • Categories collected: identifiers (name, email, IP, IDs), customer records (contact/billing), commercial information (bookings), internet/network activity (usage logs, analytics), geolocation (coarse; precise only if enabled), inferences (preferences), sensitive PI (limited, government ID for verification; precise geolocation only with permission). We do not collect clinical charts/diagnoses via the Site.
  • Purposes and sources: as described in Sections 3–6.
  • Disclosure for “business purposes”: to processors/service providers (for example, payments, hosting, analytics) and to independent Providers to fulfill bookings.
  • “Sale”/“sharing” and targeted advertising: We do not “sell” or “share” personal information.
  • Retention: see Section 9.
  • Your rights:
    • Notice. This means that you can request that we disclose what personal information we have collected about you, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we have disclosed personal information, and the specific pieces of personal information we have collected about the consumer.
    • Deletion. This means that you can request that we delete personal information about you which we have collected from you.
    • Correction. This means that you can request that we correct inaccurate personal information that we maintain about you.
    • Opt-Out of Sale of Personal Information. If you would like to opt out of allowing us to “sell” your personal information, please follow the instructions below. As of the date of this policy, we do not, and for the past 12-months have not, “sold” personal information.
    • Opt-Out of Sharing of Personal Information. You may have the right to opt out of sharing of personal information with third parties for cross-contextual marketing purposes. As of the date of this policy, we do not, and for the past 12-months have not, “shared” personal information.
    • Limit the Use or Disclosure of Sensitive Personal Information. The CCPA provides a right for consumers to request that business limit the use or disclosure of their “sensitive” personal information. We do not process “sensitive” personal information except as necessary to provide our services or as required by applicable law.
    • Right to Non-Discrimination. This means that we are prohibited from discriminating against you if you exercise your rights under applicable law.
    • Exercising Your Rights. You may submit a request using the instructions below in Section 18. We will verify requests and may deny where an exemption applies or verification fails. Authorized agents must provide proof of authorization; we may require direct verification.

PAYMENTS, FRAUD PREVENTION, AND KYC

As merchant of record, MP works with payment processors who collect and process payment data subject to their privacy terms. To protect our community, we may use vendors and internal tools to detect fraud/abuse and, where lawful and proportionate, to perform identity validation (for example, government ID checks for certain bookings).

PROTECTED HEALTH INFORMATION AND HIPAA

MP is not a HIPAA “covered entity” or “business associate”. MP does not request clinical records through the Site. If HIPAA regulated protected health information is processed in connection with a provider arrangement, it is handled independently by the Provider. Direct questions about medical records to your Service Provider.

INTERNATIONAL USERS

As indicated above, this Site is intended solely for U.S. residents. If you access the Site from outside the U.S., your data may be processed in the U.S. and other countries with different dataprotection laws. We apply appropriate safeguards for crossborder transfers as described above and in our Cookie Policy.

CHANGES TO THIS NOTICE

We may update this Notice to reflect changes in our practices, technologies, or laws. When we do, we will update the “Last Updated” date and, where required, provide additional notice or obtain consent.

CONTACTING US AND EXERCISING RIGHTS

  • Requests: Email admin@medicparadise.com. Specify the right you wish to exercise and your jurisdiction. We will respond as required by law and provide appeal instructions where applicable.
  • Contact: Carpe Diem CA, LLC dba Medic Paradise, 31583 Castaic Rd, Suite C #112, Castaic, California 91384, USA; admin@medicparadise.com.
  • EU/UK representative and Data Protection Officer (if appointed): Details will be provided in this Notice or upon request.