Temple of Herbs ("Company," "we," "us," or "our") is committed to maintaining robust privacy protections for its users. Our Privacy Policy is designed to help you understand how we collect, use and safeguard the information you provide to us and to assist you in making informed decisions when using our Service.
DEFINITIONS
"Site" refers to Temple of Herbs website at www.templeofherbs.com and our mobile application
"Service" refers to our AI-powered herbal analysis and supplement recommendation services
"You" refers to you as a user of our Site or Service
"PHI" or "Protected Health Information" means health information that can identify you
By accessing our Site or using our Service, you accept this Privacy Policy and our Terms of Use, and you consent to our collection, storage, use and disclosure of your information as described in this Privacy Policy.
I. INFORMATION WE COLLECT
A. Health Information (Protected Health Information - PHI)
We collect health-related information that you voluntarily provide, including:
Personal Health Data:
- Age, gender, height, weight, body type
- Medical history and chronic conditions
- Current symptoms and health concerns
- Current medications and supplements
- Allergies and adverse reactions
- Family medical history
- Sleep patterns and stress levels
- Lifestyle factors (diet, exercise, substance use)
AI Analysis Data:
- Health questionnaire responses
- AI-generated herbal recommendations
- Progress tracking information
- Communication preferences
B. Personal Information
Registration Information:
- Name, email address, phone number
- Mailing address for product delivery
- Payment information (processed securely by third-party processors)
- Account username and encrypted password
Communication Data:
- Customer service interactions
- Email correspondence
- Chat logs and support tickets
C. Technical Information
Automatically Collected Data:
- IP address, browser type, device information
- Website usage data and navigation patterns
- Cookies and similar tracking technologies
- Log files and analytics data
II. HOW WE USE YOUR INFORMATION
A. Health Information Uses
For AI Analysis and Recommendations:
- Analyze your health data using artificial intelligence
- Generate personalized herbal supplement recommendations
- Track your progress and adjust recommendations
- Improve our AI algorithm accuracy
For Service Delivery:
- Process and fulfill product orders
- Provide customer support
- Send order confirmations and shipping notifications
- Communicate important health-related updates
For Quality Assurance:
- Review recommendations for appropriateness
- Train and improve our AI systems
- Conduct research to enhance service quality
- Ensure compliance with health regulations
B. Personal Information Uses
Account Management:
- Create and maintain your user account
- Authenticate your identity
- Manage your subscription and preferences
- Process payments and handle refunds
Communication:
- Respond to your inquiries
- Send service-related notifications
- Provide customer support
- Send educational content (with consent)
C. Technical Information Uses
Site Optimization:
- Improve website performance and functionality
- Analyze usage patterns and trends
- Troubleshoot technical issues
- Enhance user experience
III. HEALTH INFORMATION SHARING AND DISCLOSURE
A. HIPAA-Compliant Disclosures
We may disclose your PHI in the following circumstances:
For Treatment Purposes:
- To licensed healthcare professionals who review our AI recommendations
- To medical consultants who provide oversight of our service
- For emergency medical situations (with your consent when possible)
For Payment Operations:
- To process insurance claims (if applicable)
- To payment processors for order fulfillment
- For billing and account management
For Healthcare Operations:
- Quality assurance and improvement activities
- Training healthcare professionals
- Compliance audits and regulatory reporting
B. Required by Law
We may disclose PHI when required by:
- Federal, state, or local law
- Court orders or legal proceedings
- Public health authorities for disease prevention
- FDA for adverse event reporting
- Law enforcement for specific legal purposes
C. With Your Authorization
We will obtain written authorization before using or disclosing PHI for:
- Marketing purposes
- Research studies
- Sharing with family members or friends
- Any purpose not described in this policy
IV. NON-HEALTH INFORMATION SHARING
A. Service Providers
We share non-health personal information with trusted third parties who provide services for us:
Technology Partners:
- Cloud hosting and data storage providers
- Payment processing companies
- Email and communication service providers
- Analytics and website optimization tools
Business Partners:
- Shipping and logistics companies
- Customer service platforms
- Marketing and advertising partners (for non-health information only)
B. Business Transactions
In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity, subject to the same privacy protections.
C. Legal Requirements
We may share non-health information to:
- Comply with legal obligations
- Protect our rights and property
- Ensure user safety and security
- Prevent fraud and abuse
V. AI SYSTEM AND DATA PROCESSING
A. AI Analysis Transparency
How Our AI Works:
- Analyzes patterns in your health information
- Compares with traditional herbal medicine databases
- Generates recommendations based on established principles
- Continuously learns from aggregate (non-identifiable) data
AI Limitations:
- Cannot replace professional medical diagnosis
- Recommendations are educational, not prescriptive
- Accuracy depends on information quality you provide
- System may evolve and produce different results over time
B. Data Training and Improvement
Aggregate Data Use:
- We use de-identified, aggregated health data to improve our AI
- Individual health information is never used for training without explicit consent
- Research partnerships require additional authorization
VI. GENETIC AND GENOMIC DATA
Your genetic/genomic data is the most sensitive information we handle, and we treat it
with additional, specific protections beyond general health information. This section
describes exactly what we do with it.
A. What We Collect
- Raw genetic data file: if you upload a genome file (e.g., a raw
data export from 23andMe, AncestryDNA, or MyHeritage; a VCF file; or an
already-interpreted report such as a Macrogen/Theragen PDF or a 23andMe Health
Report), we store that file as you uploaded it.
- Extracted/interpreted results: the variant-level findings, cluster
and organ-system scores, and safety-relevant markers our system derives from that
file in order to generate your personalized formula.
- Uploading a genetic data file is optional. You can use the Service by answering
our symptom questionnaire alone, without ever uploading genetic data.
B. Why We Collect It
We use your genetic data solely to generate and refine your personalized botanical
formula recommendations — identifying genetic tendencies relevant to the body systems our
formulas are designed to support, alongside your age, gender, and the symptom information
you provide. We do not use your genetic data to diagnose any disease or medical condition.
C. How It Is Protected
- Both the raw uploaded file and the extracted variant data are encrypted at rest
(industry-standard authenticated encryption), separately from our general database
protections described in Section VII.
- Encryption keys are managed so they can be rotated without losing access to
previously stored data.
D. Who We Share It With
- Our AI processor: to generate your formula, the relevant genetic
variant information (together with your age, gender, and BMI — not your name, email,
or other directly identifying information) is sent to our third-party AI provider
(Anthropic, maker of the Claude models) acting as our data processor under its own
data use terms. It does not use this data to train its general-purpose models.
- We do not send your data to, or receive your data from, genetic testing
companies on your behalf. If you used a service like 23andMe, AncestryDNA, or
Macrogen to get tested, that relationship is between you and that company — you upload
a copy of your own results to us; we never request or receive anything directly from
the testing company.
- We do not sell your genetic data, and we do not share it with
employers, health insurers, life insurers, or data brokers, or use it to make
employment or insurance-related decisions about you. This is consistent with the
protections of the U.S. Genetic Information Nondiscrimination Act (GINA), even though
GINA's specific legal obligations apply primarily to employers and health insurers
rather than to a company like ours.
- We do not use your genetic data for ancestry, relative-matching, or
law-enforcement purposes, and will not do so without your separate, explicit consent
or a legally binding request we are required to comply with.
E. Retention
We retain your genetic data for as long as your account remains open. As of the
date of this update, we do not currently have a fixed automatic deletion schedule
for genetic data independent of your own deletion request — retention until you ask us to
delete it. We are working to define a specific retention period and will update this
policy when we do.
F. Your Deletion Rights
You may request deletion of your genetic data at any time, either as part of deleting
your account entirely or on its own by contacting us at the address in Section XIII. When
you request deletion:
- Both your raw uploaded genome file and the extracted variant/analysis data are
permanently removed from our systems — not merely hidden or marked inactive.
- This action is immediate and cannot be undone.
- Order and payment records tied to your account are retained in anonymized form
(not linked to your identity) for tax, accounting, and legal compliance purposes.
G. South Korea and California Residents
Genetic information is treated as a sensitive/special category of personal information
under South Korea's Personal Information Protection Act (PIPA) and under the California
Consumer Privacy Act (CCPA)'s definition of "genetic information." If you are a resident
of either jurisdiction, the access, deletion, and opt-out rights described in Section VIII
apply specifically to your genetic data as well.
VII. DATA SECURITY AND PROTECTION
A. Security Measures
Technical Safeguards:
- Encryption in transit (HTTPS/TLS) for all traffic to our Service
- Encrypted storage for genetic/genomic data specifically (see Section VI.C)
- Access to your account requires your password; we do not currently offer
multi-factor authentication
- Access controls limiting which systems/personnel can reach stored health
information
Administrative Safeguards:
- Access to health and genetic information is limited to what is needed to operate
the Service
- We will notify affected users and, where legally required, regulators, in the
event of a data breach involving your personal information
Infrastructure:
- Our systems run on Amazon Web Services (AWS) infrastructure, which maintains its
own physical security over the data centers involved
- We do not currently maintain a separate, offsite backup of uploaded genetic
data files — if you are concerned about data durability, you may wish to keep
your own copy of any genetic data file before uploading it to us
B. Data Retention
Health and Symptom Information:
- Retained while your account remains open
- We do not currently have a fixed, automatic retention/deletion schedule
independent of your own request — see Section VI.E for the genetic-data-specific
version of this, which is the same situation
- Securely deleted when you request account deletion (see below)
Account Information:
- Retained while your account is active
- You may request deletion at any time through your account settings or by contacting
us — see Section VI.F above for what deletion specifically does to your genetic data.
Deletion of account/profile information is processed immediately upon your request,
not on a fixed schedule after closure.
VIII. YOUR PRIVACY RIGHTS
A. HIPAA Rights
Access Rights:
- Inspect and obtain copies of your health information
- Request amendments to incorrect health information
- Receive accounting of disclosures for certain purposes
Control Rights:
- Request restrictions on use or disclosure of PHI
- Request confidential communications by alternative means
- Receive copy of our HIPAA Privacy Notice
Complaint Rights:
- File complaints with us or the Department of Health and Human Services
- No retaliation for filing complaints
B. General Privacy Rights
Account Control:
- Update or correct your personal information
- Delete your account and associated data
- Download your data in portable format
- Opt out of marketing communications
Consent Management:
- Withdraw consent for certain uses of your information
- Update communication preferences
- Modify data sharing permissions
C. State-Specific Rights
California Residents (CCPA):
- Right to know what personal information we collect
- Right to delete personal information
- Right to opt-out of sale of personal information
- Right to non-discrimination for exercising privacy rights
Other State Rights:
- Additional rights may apply based on your state of residence
- Contact us for information about your specific rights
IX. COOKIES AND TRACKING TECHNOLOGIES
A. Types of Cookies
Essential Cookies:
- Required for basic website functionality
- Authentication and security features
- Cannot be disabled
Analytics Cookies:
- Track website usage and performance
- Help us improve user experience
- Can be disabled in browser settings
Marketing Cookies:
- Used for advertising and promotional purposes
- Track effectiveness of marketing campaigns
- Can be disabled through cookie preferences
B. Managing Cookies
You can control cookie settings through:
- Browser preferences and settings
- Our cookie consent banner
- Third-party opt-out tools
X. INTERNATIONAL USERS AND DATA TRANSFERS
A. Data Processing Location
- Primary data processing occurs in the United States
- Some service providers may process data internationally
- All transfers comply with applicable privacy laws
B. International Privacy Laws
GDPR Compliance (EU Users):
- Lawful basis for processing: consent and legitimate interests
- Right to portability, erasure, and restriction of processing
- Data Protection Officer contact information available upon request
XI. CHILDREN'S PRIVACY
A. Age Restrictions
- Our Service is not intended for children under 18
- We do not knowingly collect information from minors
- Parental consent required for users under 18
B. Parental Rights
If we discover we have collected information from a minor:
- We will delete the information promptly
- Parents may request access to and deletion of their child's information
- Contact us immediately if you believe we have collected information from your child
XII. CHANGES TO THIS PRIVACY POLICY
A. Notification of Changes
Material Changes:
- Email notification to your registered address
- Prominent notice on our website
- 30-day notice period before changes take effect
Non-Material Changes:
- Updated effective date on policy
- Notice on website homepage
B. Continued Use
Continued use of our Service after changes become effective constitutes acceptance of the updated Privacy Policy.
XIII. CONTACT INFORMATION
A. Privacy Questions
B. Specific Requests
C. Regulatory Contacts