Privacy Policy

Last updated: August 17, 2026

This policy applies to healingwaves.co and explains how SCALITY LIMITED handles personal data for Healing Waves. It applies to visitors worldwide. Local privacy rights may provide additional protections.

Who is responsible

SCALITY LIMITED is the controller. The company is registered in Cyprus under number HE 459172 at 3 Attikis, City Residences 1, 6045 Larnaca, Cyprus. Privacy questions and requests can be sent to sefy@healingwaves.co.

Website delivery and security

When you visit the website, Vercel processes technical request information needed to deliver and protect it. This can include your IP address, browser and device details, requested page, time, response status, and security signals. We use this information under our legitimate interests in providing a reliable, secure website and preventing misuse. The current Vercel Pro plan makes runtime logs available for one day.

Google Analytics

Google Analytics loads only after you select Allow analytics. With that consent, Google receives a first-party cookie identifier, approximate location, browser and device information, page paths, shortened referrers, engagement and timing information, selected campaign fields, outbound clicks, form interaction metadata, video engagement, file downloads, scroll depth, and selected Healing Waves call-to-action events. This helps us understand which content and journeys are useful and improve the website.

Analytics excludes email addresses, names, phone numbers, form contents, URL query values outside the approved campaign fields, and Mental Longevity Profile answers and results. The Profile and its privacy notice stay outside Google Analytics. Advertising data transmission, advertising personalization, Google Signals association, user-provided data collection, and transmission while analytics consent is declined are disabled in our Google settings.

Your analytics choice is stored in your browser for up to 180 days. Google Analytics cookies are configured for up to 395 days without extending their expiry on later visits. Detailed event and user data is retained in Google Analytics for 14 months. Google may retain standard aggregated reports for longer. You can withdraw consent at any time through Cookie settings in the website footer. Withdrawal removes accessible Google Analytics cookies and stops further analytics collection on later pages and visits.

Mental Longevity Profile

The current Mental Longevity Profile keeps assessment answers and results in the active browser tab. Its dedicated notice explains the local processing, ordinary hosting metadata, automated result, consumer health data details, and privacy choices. Read the Mental Longevity Profile Privacy Notice.

Contact and privacy requests

If you email us, Google Workspace processes your email address, message, attachments, and related delivery information. We use this information to respond, manage your request, protect the service, and meet legal duties. The legal basis is the action you ask us to take, our legitimate interests in communicating and keeping appropriate records, and legal obligations where they apply. Request records are kept for the time needed to complete the request and demonstrate that it was handled properly, then deleted under our retention schedule.

HumanOS community

HumanOS is provided through Skool. When you choose a Skool link, Skool receives the information involved in your visit and applies its own privacy information. If you ask to join, the required onboarding questions collect the mental-longevity area you want to strengthen, what meaningful progress could look like over the next 90 days, and how you discovered Healing Waves. Every question provides a low-disclosure choice, and the open answer asks you to avoid diagnoses or medical details.

Community administrators can access these answers together with the account, membership, messages, posts, progress, and participation details that Skool makes available. We use this information to provide your membership, guide your starting experience, respond to members, moderate and protect the community, understand member needs, improve the community and course direction, and measure which discovery channels reach relevant members. The legal bases are providing the community you request and our legitimate interests in operating it safely and improving it responsibly. You may object to uses based on legitimate interests. The onboarding answers support human guidance and aggregate insight. They have no medical-diagnosis or automated eligibility role. Read the Skool Privacy Policy.

If you purchase paid community access, Skool and its payment providers process your selected tier, transaction, invoice, and limited billing information to provide paid access, administer the payment, keep required financial records, and resolve payment issues. The legal bases are the membership purchase you request and applicable legal obligations.

Blog delivery

Published Blog content is delivered through a server-side connection with Vibey. That connection uses content identifiers and publication material. Visitor form contents and Mental Longevity Profile answers stay outside this content connection.

Service providers and international transfers

We use Vercel for website hosting and security, Google for consented analytics and email, Vibey for published Blog content, and Skool for the HumanOS community. These providers may process information in the European Economic Area, the United States, and other countries. An applicable adequacy decision can provide the basis for a transfer. Other transfers may use contractual safeguards such as approved Standard Contractual Clauses when they form part of the relevant provider terms. You can request information about the location and safeguard relevant to your information by emailing us.

How long information is kept

The specific analytics and hosting periods appear above. HumanOS member profiles, onboarding answers, membership history, and course progress are kept while membership is active and for up to 12 months after it ends. Answers connected with rejected or withdrawn applications are kept for up to 90 days. Direct chats and support correspondence are kept for up to 24 months after the last interaction. Moderation and security case records are kept for up to 24 months after the case closes. Community posts, comments, and reactions may remain while the group is active and the content remains useful to members, with a necessity review at least once a year.

Paid-tier transaction, invoice, and tax evidence is kept for at least six years where Cyprus VAT record rules apply. Individual-rights request and incident completion logs are kept for three years after closure. A valid request may lead to earlier deletion. A specific legal duty, active audit, dispute, safety investigation, or legal claim may require limited information to be kept longer for that purpose. Once information is properly anonymized and no person is reasonably identifiable, aggregate focus, discovery-channel, participation, and outcome trends may be kept for longer. We delete or de-identify records when the applicable period ends. A provider may retain limited backup, security, or legal records under its documented schedule.

Your rights and choices

Depending on the law that applies to you, you may request access, correction, deletion, restriction, or portability of your personal data. You may object to processing based on legitimate interests and withdraw consent for analytics at any time. You may also lodge a complaint with your local data protection authority or with the Cyprus Commissioner for Personal Data Protection. We may ask for limited information to verify your identity before completing a request.

Your choice to provide information

Browsing requires only the technical information generated by the connection. Analytics is optional. Contacting us and joining the community are optional, although the relevant contact or account information is needed to provide the service you request.

Changes to this policy

We update this policy before a material change to the data, purpose, provider, retention period, or choice described here takes effect. The date at the top shows the latest revision.