Privacy Policy.

1Introduction and Scope

This Privacy Policy describes how Wellness Robotics LLC, doing business as ARC ("ARC," "Wellness Robotics," "we," "us," or "our"), collects, uses, discloses, and protects personal information about individuals who book, pay for, or use our robotic massage and recovery services (the "Services"), visit our websites (including arcrecovery.ai) or mobile applications, or otherwise interact with us (each, "you").

This Privacy Policy is incorporated by reference into our Terms of Use. Capitalized terms not defined herein have the meanings given in the Terms of Use.

Please read this Privacy Policy carefully. By using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Services.

This Privacy Policy does not govern personal information collected directly by Aescape Recovery, Inc. ("Aescape") in Aescape's own capacity through Aescape-controlled interfaces, accounts, websites, applications, or systems, which is governed by Aescape's separate privacy documentation. However, to the extent ARC receives personal information from Aescape or through ARC's use of the Devices and related systems, ARC's handling of that information is governed by this Privacy Policy. This Privacy Policy also does not govern personal information collected independently by third-party Location Partners outside ARC's provision of the Services.

2Information We Collect

We collect the categories of personal information described below from and about you in connection with the Services.

2.1Information You Provide Directly

• Account and contact information, including your name, email address, telephone number, mailing address, and account credentials (such as passwords).
• Booking and Session information, including the Locations you visit, the dates and times of your Sessions, the type of Session booked, and any preferences you specify.
• Payment information, including credit or debit card number, billing address, and other financial account details. Payment information is collected and processed by our third-party payment and booking platform, Zenoti, and is not retained by ARC in unencrypted form. ARC is the merchant of record for all payments.
• Subscription information, including the type of Subscription, billing cycle, and Subscription history.
• Health screening and contraindication responses, including information about pre-existing conditions, injuries, medications, pregnancy status, and other health-related information you provide before a Session in order to assess eligibility, facilitate safe use of the Services, respond to incidents, and maintain related records.
• Communications and User Content, including messages you send to our customer support team, reviews, ratings, photographs, survey responses, and any other content you submit.
• Marketing preferences, including your consents and opt-outs for email and SMS marketing communications.

2.2Information Collected Automatically

• Device and technical information, including IP address, browser type, operating system, device identifiers, mobile network information, and language preferences.
• Usage information, including the pages or screens you view, the features you use, the links you click, the time and duration of your activity, and referring URLs.
• Location information, including general location derived from your IP address. We do not collect precise geolocation information unless you affirmatively enable location services in our application.
• Cookies and similar technologies, including cookies, web beacons, pixel tags, and similar tracking technologies used to operate the Services, remember your preferences, analyze usage, and deliver advertising. See Section 7 (Cookies and Tracking Technologies) for more information.

2.3Information from Third Parties

• Information from Location Partners, including limited information about your visits to a Location, your status as a guest or member of the Location, and contact information you have authorized the Location Partner to share.
• Information from Aescape or Device-related systems, including Session date, duration, completion status, operational logs, support-related information, and other limited information that ARC receives in connection with operation, maintenance, safety, troubleshooting, or analytics for the Services.
• Information from payment processors, including transaction confirmations, fraud signals, and limited card information (such as the last four digits and expiration date).
• Information from marketing and analytics providers, including audience segments, advertising identifiers, and aggregated insights about our users.
• Information from social media platforms, where you choose to log in or connect your account using a social media credential.

3Sensitive Data and Consumer Health Data

3.1Sensitive Personal Information

Some of the information we collect may qualify as "sensitive personal information" under California law and similar laws in other states, including account credentials, health-related screening responses, and precise geolocation if you affirmatively enable location services. We use such information only for purposes permitted by Applicable Law, including providing the Services, verifying eligibility, ensuring safety, preventing fraud, complying with law, and maintaining appropriate business records.

3.2Consumer Health Data

Certain information processed in connection with the Services may also qualify as "consumer health data" under certain state laws, depending on the context and the resident's state of residence. This may include health screening responses, information that indicates a physical condition or contraindication, and certain information about use of wellness or recovery services that is linked or reasonably linkable to you. Where required by Applicable Law, ARC will provide additional notices and obtain any consent required for the collection or sharing of consumer health data.

3.3HIPAA Status

ARC is not acting as a HIPAA covered entity or business associate solely by offering the Services in a direct-to-consumer capacity, unless expressly stated otherwise in a separate written agreement. Accordingly, information collected in connection with the Services is generally not regulated as protected health information under HIPAA solely because it relates to health or wellness.

3.4Biometric and Measurement Information

ARC does not intentionally collect or store biometric identifiers such as fingerprints, retinal scans, voiceprints, or scans of face geometry for its own identification purposes. To the extent Device-related systems generate body measurement, fit, posture, range-of-motion, or similar data in connection with the operation of the Services, ARC will treat any such data that ARC receives as personal information, and where required by Applicable Law, as sensitive or consumer health data, and will handle it in accordance with this Privacy Policy and Applicable Law.

4How We Use Your Information

We use the information we collect for the following purposes:

• To provide, operate, and maintain the Services, including processing bookings, scheduling Sessions, managing your account, and providing customer support.
• To process payments, manage Subscriptions, and prevent fraud.
• To verify your eligibility to use the Devices, including by reviewing your health screening and contraindication responses.
• To ensure your safety and the safety of others, including by responding to incidents, complaints, and emergencies.
• To communicate with you about your account, bookings, Subscriptions, and Sessions, including transactional emails and SMS messages.
• To send you marketing and promotional communications about our Services, including new locations, special offers, and events, where permitted by Applicable Law and consistent with your preferences.
• To coordinate with Location Partners regarding onsite operations, access, check-in, support, incident response, and, where permitted by Applicable Law and based on your choices, marketing or promotional communications relating to ARC services at a Location.
• To personalize your experience, including by recommending Sessions or content based on your activity.
• To analyze and improve the Services, including by measuring usage, conducting research, and developing new features.
• To comply with Applicable Law, respond to legal process, enforce our rights, and protect the rights, property, or safety of ARC, our users, or others.
• For any other purpose disclosed to you at the time of collection or to which you consent.

5How We Share Your Information

We share your personal information with the following categories of recipients, for the purposes described below.

5.1Location Partners

We operate Devices at properties owned, leased, or operated by third parties, including hotels, residential buildings, fitness facilities, wellness centers, and similar venues (each, a "Location Partner"). We may share limited personal information with the Location Partner at which you book or complete a Session where reasonably necessary to operate and support the Services at that Location, including for check-in, access control, customer support coordination, troubleshooting, fraud prevention, safety, and incident response. We do not authorize Location Partners to use your health screening responses or other consumer health data for their own independent purposes.

5.2Aescape

We share certain information with Aescape, the manufacturer of the Devices, in connection with the operation, maintenance, support, and safety of the Devices. This may include Session information, support-related information, incident reports, and limited account or operational information reasonably necessary for operation, maintenance, safety, troubleshooting, analytics, and support. Aescape's use of information it receives from us is governed by our agreement with Aescape and Aescape's own privacy policy.

5.3Service Providers

We share information with third-party service providers that perform services on our behalf, including payment processing and booking platform services (primarily Zenoti), hosting and cloud infrastructure, customer support, email and SMS delivery, analytics, marketing automation, fraud prevention, and professional services. These service providers are contractually obligated to use the information only as necessary to perform services for us and in accordance with this Privacy Policy.

5.4Marketing and Advertising Partners

We may share certain information, including device identifiers, IP address, and information about your activity on our websites and applications, with marketing and advertising partners and platforms (such as Google, Meta/Facebook, and TikTok) for purposes of measuring the effectiveness of our marketing and delivering targeted advertising to you on third-party sites and applications. Some of this sharing may constitute a "sale" or "share" of personal information under California law and similar laws in other states. You have the right to opt out of such sales and shares as described in Section 12 (Your Privacy Rights).

5.5Legal, Safety, and Compliance

We may disclose your information when we believe in good faith that disclosure is necessary to (a) comply with Applicable Law, legal process, or government request; (b) enforce our Terms of Use or other agreements; (c) protect the rights, property, or safety of ARC, our users, or others; (d) detect, prevent, or address fraud, security, or technical issues; or (e) respond to an emergency.

5.6Business Transfers

We may share or transfer your information in connection with any merger, acquisition, financing, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another provider. You will be notified of any such change as required by Applicable Law.

5.7With Your Consent

We may share your information with other parties at your direction or with your consent.

6Sales, Shares and Targeted Advertising

ARC does not sell personal information for money in the traditional sense. However, some of our use of advertising cookies, pixels, analytics tools, and related disclosures to advertising and marketing partners may constitute a "sale," "share," or targeted advertising under certain state laws. We will provide any required notice and opt-out rights with respect to such practices. We do not knowingly sell or share the personal information of individuals under 16 years of age.

7Cookies and Tracking Technologies

We and our service providers use cookies, web beacons, pixel tags, and similar tracking technologies to operate the Services, recognize you when you return, remember your preferences, analyze how the Services are used, and deliver advertising. The categories of cookies and tracking technologies we use include:

• Strictly necessary cookies, which are required for the operation of the Services.
• Functional cookies, which remember your preferences and personalize your experience.
• Analytics cookies, which help us understand how users interact with the Services.
• Advertising cookies, which are used to deliver targeted advertising on third-party sites and applications.

You can manage your cookie preferences through your browser settings or, where available, through the cookie preferences interface on our websites or applications. Where required by Applicable Law, we recognize browser-based opt-out preference signals, such as Global Privacy Control, for eligible requests relating to sale, sharing, or targeted advertising.

7AWhat our website collects and where it goes

This section describes, in plain terms, what happens on arcrecovery.ai specifically. It adds to, and does not replace, the rest of this Privacy Policy.

7A.1 Email address. When you sign up for our newsletter, spin the welcome wheel, complete the recovery quiz, request the HSA/FSA guide, or ask to be told when a new location opens, your email address is added to ARC’s mailing list, which is operated for us by Resend. Each signup is tagged with the form it came from so that we send you only what you asked for. Every email we send includes an unsubscribe link.

7A.2 Quiz answers and phone number. The recovery quiz asks about your goals, how often you train and where you feel tension, and offers a larger welcome discount in exchange for a phone number. Your answers and, if you give it, your phone number are stored with your email address in our private records (hosted for us by Sanity) so that the discount can be honoured at booking and so that our team can follow up. Quiz answers are not health screening information and are not used to assess eligibility for a Session. Giving a phone number in the quiz does not sign you up for marketing text messages.

7A.3 Calculator details. When you send your plan from the cost calculator, your name, email address, phone number, any notes you add, and the plan and tax rate you chose are emailed to the ARC team so that someone can follow up, and a copy is emailed to you.

7A.4 Chat. Messages you type into the chat widget are sent to our AI provider (Anthropic) to generate a reply. They are not stored by this website. Please do not put health details or payment information into the chat; the widget cannot act on them.

7A.5 Location. When you press “Book a session”, your browser may ask your permission to share your location so that we can send you to the nearest venue. Your position is used once, in your browser, and is not sent to us.

7A.6 Discount codes. A welcome code you receive from the quiz or the wheel is recorded against your email address so that it can be issued once, and is marked as used when it is redeemed at booking. Our booking provider, Zenoti, tells us when a code has been used.

7A.7 Analytics and advertising tools. On the live site we use Google Analytics, Google Tag Manager, the Meta Pixel and the TikTok Pixel. These tools set cookies and record standard usage information, including page views and the moment a form is sent or a booking link is pressed. No email address, phone number or discount code is included in what they receive from this site. They are not loaded on preview or test versions of the site. See Section 7 for the cookie categories and your choices.

7A.8 Booking. Booking and payment take place on our booking provider’s site (automatedrobot.zenoti.com), not on arcrecovery.ai. Zenoti’s own privacy terms apply from the moment you leave our site.

7A.9 Body-scan data. Body-measurement data generated at a venue is handled by the Session system, not by this website. See Section 3.4.

8Marketing Communications and Your Choices

If you have provided your email address or telephone number, we may send you transactional communications relating to your account and the Services, and we may send marketing communications consistent with your choices and as permitted by Applicable Law. You may opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email.
• Replying "STOP" to any marketing SMS message.
• Adjusting your communication preferences in your account settings.
• Contacting us as described in Section 16 (Contact Us).

Even after you opt out of marketing communications, we may still send you transactional or service-related communications, such as booking confirmations, Subscription billing notices, and account updates.

9Data Retention

We retain your personal information for as long as necessary to provide the Services, fulfill the purposes described in this Privacy Policy, comply with our legal obligations, resolve disputes, and enforce our agreements. The specific retention period for any given category of information depends on factors such as the nature of the information, the purpose for which it was collected, applicable legal and tax requirements, and our legitimate business interests. When we no longer need to retain your personal information, we will delete or anonymize it in accordance with our data retention policies.

10Data Security; Incident Notification

We implement reasonable administrative, technical, and physical safeguards designed to protect your personal information from unauthorized access, use, disclosure, alteration, or destruction. However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for any activity that occurs under your account.

If we become aware of a security incident affecting your personal information, we will investigate the incident and notify you and applicable regulators in accordance with Applicable Law and our internal incident response procedures.

11Children's Privacy

The Services are intended for users who are at least eighteen (18) years of age. We do not knowingly collect personal information from children under 18. If you believe we have collected personal information from a child under 18, please contact us immediately and we will take steps to delete such information.

12Your Privacy Rights

12.1Rights Available to All Users

Regardless of your location, you may exercise the following choices with respect to your personal information:

• Access and update your account information through your account settings.
• Opt out of marketing communications as described in Section 8.
• Manage cookie preferences as described in Section 7.
• Close your account by contacting us.

12.2California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"):

• Right to Know. You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collecting or sharing it, and the categories of third parties with whom we have shared it.
• Right to Delete. You have the right to request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Correct. You have the right to request that we correct inaccurate personal information we maintain about you.
• Right to Opt Out of Sale or Sharing. You may exercise this right by emailing privacy@arcrecovery.ai with “Do Not Sell or Share” in the subject line, by configuring a recognized opt-out preference signal (such as the Global Privacy Control) in your browser, or by contacting us.
• Right to Limit Use of Sensitive Personal Information. You have the right to direct us to limit the use and disclosure of your sensitive personal information to those uses necessary to provide the Services.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of your CCPA rights.

12.3Consumer Health Data Rights in Certain States

Residents of certain states may have additional rights with respect to consumer health data, including rights to confirm whether we are collecting, sharing, or selling such data, to access or delete such data, to withdraw consent, and to appeal certain decisions relating to privacy requests. To exercise any such rights, please contact us as described in Section 16.

12.4Other U.S. State Privacy Rights

Residents of certain other U.S. states, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others, may have similar rights under their state privacy laws, including the right to access, correct, delete, and obtain a copy of personal information, the right to opt out of targeted advertising and the sale of personal information, and the right to opt out of profiling. To exercise these rights, please contact us as described in Section 16.

12.5California Shine the Light

California Civil Code § 1798.83 entitles California residents who have an established business relationship with us to request, once per calendar year, information about the categories of personal information we have shared with third parties for those third parties' direct marketing purposes during the preceding calendar year. To make such a request, please contact us with the subject line "Shine the Light Request."

12.6Nevada Privacy Rights

Nevada residents may submit a verified opt-out request by contacting us as described in Section 16 with the subject line "Nevada Opt-Out Request."

12.7Verifying Requests; Authorized Agents

To protect your privacy, we will need to verify your identity before processing any access, deletion, correction, or other rights request. If you use an authorized agent to submit a request on your behalf, the agent must provide proof of your authorization, and we may require you to verify your identity directly with us.

12ANotice at Collection and Just-in-time Disclosures

Depending on how you interact with the Services, we may provide additional disclosures at or before the point of collection, including in account creation, booking, health screening, and Device-intake flows, to explain the categories of information collected, the purposes of collection, and any choices or consents available to you.

13Third-party Services and Links

The Services may contain links to third-party websites, applications, or services, including those operated by Aescape, Location Partners, payment processors, and social media platforms. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you use.

14International Users

The Services are intended for users located in the United States. If you access the Services from outside the United States, you acknowledge that your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your country of residence. By using the Services, you consent to such transfer, storage, and processing.

15Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other reasons. When we make material changes, we will notify you by posting the updated Privacy Policy on our website or application and updating the "Last Updated" date at the top of this Privacy Policy. Your continued use of the Services after the effective date of any updated Privacy Policy constitutes your acceptance of the updated terms.

16Contact Us

If you have any questions about this Privacy Policy, our privacy practices, or to exercise any of your privacy rights, please contact us at:

To exercise your privacy rights, email privacy@arcrecovery.ai with “Privacy Request” in the subject line.