Privacy Policy — Department of Aliveness

Alexander Geoffrey LLC, trading as The Department of Aliveness (“we,” “us,” or “our”), is responsible for the personal information we collect and use in operating our website, publications, community, one-to-one sessions, the Living Room, cohorts, retreats, downloadable resources, and memberships.

For purposes of European and UK data protection law, we act as the controller of the processing described in this Policy, except where a provider independently determines its own purposes. For Canadian privacy matters, our privacy contact is responsible for receiving questions and complaints about our practices.

Privacy contact: departmentcontact@dralexlovell.com
Business mailing address: 185 W 12TH ST STE D, PMB 141, OGDEN, UT 84404, United States
We have not appointed an EEA or UK representative. Please direct privacy questions to the contact above. This does not limit any rights you have under applicable law.

This Policy explains our practices and your choices. Reading it or using the website does not, by itself, constitute consent to optional tracking, marketing, recording, or processing sensitive information. Where consent is needed, we ask separately.

Our separate Consumer Health Data Privacy Policy provides additional information about health-related information. You may also request a copy by emailing departmentcontact@dralexlovell.com.

INFORMATION WE COLLECT AND WHERE IT COMES FROM

We collect information directly from you, automatically through the website and communications where permitted, and from the providers that support your relationship with us. The categories depend on which Services you use.

Contact and account information: your name, email address, account identifiers, display name, profile details you choose to provide, time zone, country, and contact details needed for a booking or transaction. Sources include you and account, booking, and community providers. Recipients may include providers supporting those functions and personnel who administer your participation.

Purchase and participation information: the offer you select, bookings, attendance, membership status, billing information, payment status, transaction references, cancellation requests, and correspondence about your purchase. Sources include you and booking, payment, and membership providers. Recipients may include those providers, administrative support, and professional advisers where necessary. Stripe collects payment-card details; the payment information available to us depends on the payment integration and its configuration. Do not send full payment-card details by email or community message.

Messages and community contributions: inquiries, emails, comments, posts, feedback, and other content you choose to share. Sources include you and the platform through which you communicate. Recipients include personnel or providers handling the communication and the participants or public audience you choose when posting.

Sensitive and wellbeing information: information you choose to provide about mental or physical health, disability, access needs, personal circumstances, or other sensitive experiences. A personal story may also reveal information such as religious beliefs, sexual orientation, or other characteristics protected by privacy law. We request only information reasonably needed for the stated purpose. Sources include you, your communications, and permitted session notes or summaries. Recipients are limited as described in sections 4 and 5 and the Consumer Health Data Privacy Policy.

One-to-one session information: facilitator notes and, when you separately agree, the audio, video, transcript, or AI-assisted summary specifically identified in the session notice. We explain which of these formats will actually be captured. Sources include you, the facilitator, and the approved meeting or transcription provider. Recipients include the facilitator and the restricted service providers needed to create and maintain the agreed record.

Device and activity information: IP address, browser and device details, approximate location derived from an IP address, cookie or similar identifiers, referring pages, pages viewed, interaction events, and other technical information. Sources include your device, our first-party tracking, and enabled Google or Meta tools. Recipients may include website, security, analytics, and advertising providers, subject to your choices and the restrictions below.

Communication preferences and engagement: newsletter subscriptions, consent records, unsubscribe requests, and, where enabled and permitted, email opens or link clicks. Sources include you and email-delivery providers. Recipients include those providers and personnel managing communications.

Privacy and safety records: requests, verification information, consent changes, complaints, moderation reports, and information needed to investigate misuse. Sources include you, people reporting an issue, and our systems. Recipients are limited to people and providers handling the issue, advisers, or authorities where disclosure is lawful.

If information is required to complete a booking, administer a purchase, or provide an accommodation, we identify that requirement when collecting it. Without the necessary information, we may be unable to provide the particular function. Optional information is identified as optional. Declining marketing, advertising tracking, or optional session recording does not prevent purchase of the underlying Service.

WHY WE USE INFORMATION

We use relevant information to deliver what you request; administer bookings, payments, and memberships; communicate about participation; respond to inquiries; make agreed accommodations; maintain continuity in one-to-one work; operate and moderate community spaces; protect accounts and systems; keep required business records; and resolve complaints or disputes.

We also use permitted website and communication data to understand use of our public content, improve the website, and measure marketing. Where allowed and subject to your choices, Google and Meta tools may support advertising and its measurement. We do not use sensitive disclosures, session information, or health-related inferences for advertising.

Where the GDPR or UK GDPR applies, our legal bases are:

Contract: processing ordinary contact, purchase, and participation information necessary to take steps you request before purchase and perform our agreement.

Consent: optional marketing where required, nonessential tracking where consent is required, agreed recording or transcription, and optional processing of sensitive information. For special-category information, including health information, we obtain explicit consent unless a different specific legal condition lawfully applies.

Legitimate interests: proportionate security, fraud prevention, ordinary service improvement, responding to general inquiries, and handling business administration or legal claims, where those interests are not overridden by your rights. We assess the impact on you. This basis does not replace consent required for tracking or the additional legal conditions for sensitive data.

Legal obligations: records, requests, and disclosures we must handle under applicable law.

In exceptional circumstances, another lawful basis may apply, such as protecting vital interests in a genuine emergency. We do not rely on that exception for routine collection or monitoring. Where sensitive information is involved, a separate lawful condition for that information must also exist.

In Canada, we obtain meaningful consent as required and explain the nature, purposes, and relevant consequences of the processing. We use express consent for sensitive information except where a specific legal exception permits otherwise.

SENSITIVE INFORMATION AND SESSION PRIVACY

The Department is a wellbeing community and does not provide medical or mental health treatment. Information can nevertheless qualify as protected health or sensitive information. Our service description does not remove those protections.

Please share only what is necessary for the experience or support you want. Avoid sending medical records or sensitive information about another person unless we have specifically arranged an appropriate process and you have authority to share it. We do not require you to disclose a diagnosis simply to read our public writing or subscribe to general updates.

Before requesting sensitive information, we explain its purpose and seek the separate consent required by law. Consent to collection is not automatically consent to disclosure to another independent organization. Where a separate sharing consent is required, we obtain it separately. You may withdraw consent through departmentcontact@dralexlovell.com. Withdrawal does not invalidate earlier lawful processing; we explain any necessary effect on a particular accommodation or Service.

Cohort sessions are not recorded or transcribed with AI. One-to-one sessions may involve written notes and optional recording, transcription, or AI summaries. Before enabling those tools, we identify the provider, formats captured, purposes, recipients, retention period, and how to decline or stop the feature. You can request a session without optional recording or AI transcription.

AI-generated text may be inaccurate. We use it to assist session documentation, with human review, and you may request correction of inaccurate personal information. We do not use session summaries to make solely automated decisions with legal or similarly significant effects on you. Our policy is to use private session content only for the agreed documentation purpose and to select provider plans and settings that do not permit general-purpose AI model training on that content. The provider and processing arrangement used for your session are explained before you decide whether to consent.

We restrict access to sensitive information to people and providers who need it for the disclosed purpose. We do not sell consumer health data or use health information, intimate disclosures, recordings, transcripts, or sensitive inferences for targeted advertising, audience building, or advertising measurement. Tracking on forms, booking flows, member areas, and pages that could reveal sensitive information is restricted accordingly.

PROVIDERS AND OTHER RECIPIENTS

We use providers to support the Services. They receive information relevant to their function rather than unrestricted access to everything you share.

Framer: website hosting and website functions.

Substack: publication, newsletter, subscription, and related community functions where you use them.

Calendly: scheduling, registration, booking questions, and appointment communications.

Zoom: online meetings and any separately authorized recording or transcription features.

Circle: community access, membership participation, profiles, and posts.

Supabase, where deployed: database and customer-relationship management functions, including contact and participation records.

Make, where deployed: workflow automation between selected systems.

Kit, where deployed: email delivery, subscriber preferences, and permitted email engagement information.

Google and Meta: enabled analytics, advertising, and measurement features on permitted pages, subject to consent and opt-out controls.

Stripe: payment processing, transaction administration, and fraud prevention.

OpenAI and Anthropic: AI-assisted processing of authorized session material, such as notes, transcripts, and summaries, where the particular use is disclosed and separately agreed.

Locally operated large language models: AI software we run for authorized documentation and summarization. Any connected cloud processing depends on the particular setup and is disclosed before use. A local model is not itself a separate recipient company.

Some providers act on our instructions under service arrangements; others also process information independently for their own platform functions. Their independent processing is described in their privacy notices. We remain responsible for our obligations when selecting and using providers. A listing here does not authorize new or incompatible uses of your information.

Information may also be disclosed to accountants, legal advisers, insurers, and other professional advisers where necessary and lawful; to authorities where required by law; or where lawfully necessary to protect rights, investigate wrongdoing, or address a serious safety concern. We limit disclosures to the information needed and apply additional restrictions to sensitive information.

If the business is reorganized, sold, or transferred, relevant information may be involved only as permitted by law and subject to appropriate protections. We provide notice and obtain any required consent. Such a transaction does not create permission to disregard existing sensitive-information restrictions.

Your community profile or contributions may be visible to other participants, or publicly if you choose a public setting. We cannot control other people’s independent actions, so consider the audience before posting. We seek separate permission before using your private story, image, voice, or testimonial in promotion.

COOKIES AND YOUR ADVERTISING CHOICES

We use cookies, pixels, similar technologies, and first-party event tracking for website functions, security, preferences, analytics, and permitted advertising. First-party tracking can still involve personal information and is subject to applicable privacy requirements.

Visitors in the European Union are shown a cookie banner when they arrive at our website. The banner provides immediate information about our use of cookies and lets visitors set their cookie preferences. Nonessential cookies remain disabled unless and until the visitor gives consent for the relevant category or purpose. Visiting the website, continuing to browse, or leaving the banner unanswered does not constitute consent.

Strictly necessary cookies may operate without prior consent only to the extent needed to transmit a communication or provide a service you explicitly request. These cookies are disclosed in the banner and are not subject to optional cookie choices. You do not have to consent to them. A cookie does not qualify for this exemption simply because it is useful to our business; advertising and other nonessential cookies remain subject to the applicable consent requirements.

Our designated contact for privacy requests is departmentcontact@dralexlovell.com. The EU cookie banner provides the initial cookie-preference controls; we do not currently provide a separate website privacy-request form. You may also email us to ask about tracking, withdraw consent, or make an applicable opt-out request. Where we rely on consent, you have the right to withdraw it at any time, as easily as you gave it. Withdrawal does not affect the lawfulness of processing that took place before withdrawal.

Where advertising tools transmit identifiers and browsing or interaction information to Google, Meta, or other enabled advertising partners, that activity may constitute a “sale,” “sharing,” or “targeted advertising” under applicable US state privacy laws, even if we do not receive money for the information. These terms have legal meanings broader than an ordinary sale.

To opt out of sale, sharing, or targeted advertising, email departmentcontact@dralexlovell.com. No account creation or identity verification is required merely to make that request, although we may need limited information to identify the relevant record. We apply the request to information and processing within our control and instruct relevant providers as required by applicable law.

You can also use your browser to restrict or delete cookies. Browser settings may need to be applied separately on each device, and blocking cookies may affect website functions. Our website automatically recognizes and honors Global Privacy Control (GPC) signals as requests to opt out of the sale or sharing of personal information, including sharing for cross-context behavioral advertising, where applicable. Support for older Do Not Track signals has not been verified. You may also email departmentcontact@dralexlovell.com to submit a privacy request directly.

EMAIL AND OTHER COMMUNICATIONS

You can unsubscribe from marketing through the link in our messages or by emailing departmentcontact@dralexlovell.com. We act without undue delay and within the legal deadline. For Canadian commercial electronic messages, requests are implemented within 10 business days at the latest. Where European or UK law applies, an objection to direct marketing ends that processing, including related profiling.

Essential booking, transaction, account, security, or legal messages may continue when necessary and permitted. We may retain minimal suppression information to make sure you are not added back to marketing lists. A purchase is not blanket consent to optional marketing or third-party advertising.

HOW LONG WE KEEP INFORMATION

We retain personal information only for as long as reasonably necessary for the disclosed purpose or a specific legal obligation. We consider the sensitivity of the information, the ongoing relationship, applicable limitation and recordkeeping requirements, and whether less identifying information would meet the purpose.

Account and membership information is retained while needed to administer your relationship and close the account. Inquiries and ordinary correspondence are retained until the issue is resolved and any proportionate follow-up period has ended. Transaction and accounting records are retained for the applicable legal recordkeeping period. Marketing records are retained while the subscription remains active, with minimal consent or suppression evidence afterward where needed.

One-to-one notes, raw recordings, transcripts, and AI summaries have separate retention periods communicated in the session notice. Raw recordings are not automatically retained for as long as summaries or business records. Cookie and tracking durations vary by technology and configuration; you may request information about them by email. Security logs, complaints, consent evidence, and rights-request records are retained only for their relevant security, accountability, or legal purpose.

When information is no longer needed, we delete it or irreversibly de-identify it. Any temporary retention in backups is limited, protected from ordinary use, and subject to applicable deletion requirements, including special rules for consumer health data. A legal exception to deletion is applied only to information and purposes it actually covers.

INTERNATIONAL PROCESSING

We operate from Utah, United States. Our providers may process information in the United States and other countries. Information processed abroad may be subject to lawful access by authorities in those countries.

The specific processing destinations and contractual transfer safeguards for our current provider configuration have not yet been fully verified. We do not represent that information remains exclusively in the United States or that a particular transfer certification or contractual mechanism covers every provider. Where EEA or UK transfer restrictions apply, a valid transfer mechanism and any required additional safeguards are necessary. Ordinary use of the website is not consent to unrestricted international transfers.

Contact departmentcontact@dralexlovell.com to request available information about processing locations and safeguards, including copies of applicable safeguards where the law entitles you to them. Where Canadian law applies, we remain accountable for information transferred to providers for processing. Applicable federal and provincial requirements for contractual and other protections continue to apply.

YOUR PRIVACY RIGHTS

You may contact us about your information wherever you live. Your legal entitlements depend on the law that applies to you and to the processing. Rights may include access to information and a copy of it; correction; deletion; portability; restriction of processing; withdrawal of consent; objection to certain uses; limits on sensitive-information use; and opt-outs from sale, sharing, targeted advertising, or certain profiling. Some laws also entitle you to information about particular recipients or disclosures. We do not unlawfully discriminate or retaliate against you for exercising these rights.

EEA and UK residents: where the GDPR or UK GDPR applies, you may exercise the rights above as applicable, object to processing based on legitimate interests for reasons related to your situation, and object to direct marketing at any time. You also have protections concerning solely automated decisions with legal or similarly significant effects. You may complain directly to your competent data protection authority or the UK Information Commissioner’s Office without first contacting us.

US residents: applicable state laws may provide rights to know or confirm processing, access, correct, delete, obtain a portable copy, opt out of sale or targeted advertising, and decline certain consequential profiling. Sensitive-data processing may require consent or be subject to a right to limit use. California’s additional rights include opting out of sharing for cross-context behavioral advertising and limiting certain uses of sensitive personal information. Statutory rights apply when the law’s jurisdictional and applicability requirements are met; a small business is not automatically exempt from every privacy law.

The category descriptions in section 2 identify information, sources, purposes, and recipient categories. The advertising-related categories described in section 6 are device or online identifiers, internet activity, and related nonsensitive interaction information. Sensitive information is excluded from that advertising use. The descriptions above also cover the preceding 12 months for the Services and tools in use at the time. Section 6 describes our current EU cookie-consent controls; it does not imply that those controls were in place throughout that entire period. A provider identified as planned or used only where deployed did not receive information before its deployment.

Canada: where applicable federal or provincial law applies, you may request access and correction, obtain information about our uses and disclosures, withdraw consent subject to lawful limits, and challenge our compliance. We explain any consequences of withdrawal before acting on it. Additional rights may apply in your province, including Quebec. Complaints may be directed to the Office of the Privacy Commissioner of Canada or the relevant provincial authority, including Quebec’s Commission d’accès à l’information.

Consumer health data: applicable health-data laws may provide additional access, withdrawal, deletion, recipient-information, and appeal rights. Our separate Consumer Health Data Privacy Policy explains these rights and how to use them.

HOW TO MAKE A REQUEST AND WHAT TO EXPECT

Email departmentcontact@dralexlovell.com. This is our designated privacy-request channel. Tell us what you would like us to do and the email address or other identifier used with the Department. You do not need special legal wording or an account. We do not currently offer a separate privacy-request form or telephone request line.

For access, deletion, or similar requests, we may ask for proportionate information to verify your identity and protect your information. We use that information only for handling and securing the request. Authorized representatives may act where permitted; we may request evidence of their authority. We do not impose unnecessary verification on an advertising opt-out.

We respond within the deadline that applies. EEA and UK requests are ordinarily answered within one month, with up to two additional months where legally permitted and with notice during the first month. PIPEDA access requests are ordinarily answered within 30 days, subject to lawful extension and notice. Many US state access, correction, and deletion requests have a 45-day period, but some laws use different deadlines. We apply the applicable period and only a legally permitted extension. Opt-out requests are handled sooner where required, including California’s maximum of 15 business days. We do not use a longer access-request period to delay a marketing objection or advertising opt-out.

If we cannot fully comply, we explain the applicable reason, any information retained, and available review or complaint options. We ordinarily handle requests without charge. Any exception must be permitted by law, explained in advance, and proportionate.

Where an appeal right applies, send an appeal to departmentcontact@dralexlovell.com, using “Privacy Appeal” if convenient. We review the decision, provide a written outcome within the applicable legal period, and explain how to contact the relevant regulator if the appeal is denied. You may contact a regulator without giving up any other remedy.

SECURITY AND ADULT AUDIENCE

We use reasonable administrative, technical, and organizational safeguards appropriate to the information, including controls on access and provider use. No method of transmission or storage is completely secure. We address security incidents and provide notifications as required by applicable law.

The Services are intended for adults aged 18 or older. We do not knowingly seek personal information from children. If you believe a child has supplied information, contact us so we can investigate and take the steps required by law, including deletion where appropriate.

POLICY CHANGES

We update this Policy when our practices or obligations change. The latest revision date identifies the current version. For material changes, we provide additional notice as appropriate and obtain fresh consent where required before beginning the affected processing. A policy update does not override choices you already made or authorize an incompatible use of previously collected information.

Questions or requests: departmentcontact@dralexlovell.com

The rest of the fine print

L-01

L-03

Consumer Health Data Privacy →