How we handle your data

1. Who is responsible

Bwiti Life, operator of the retreat programs presented on bwitilife.com and hosted on the Mayan Riviera near Cancun, Mexico, is responsible for the data described here. Contact: info@bwitilife.com.

2. What we collect, and why

• Application form. Name, email, WhatsApp number, gender, date of birth, citizenship, city and country, job title, the program and dates you chose, your story, how you heard about us, and your acceptance of the terms. Purpose: to evaluate your application and contact you. Legal basis: the steps needed before entering into a contract with you, and your explicit consent for the health-related parts of your story.
• Discovery call booking. Your name, email and the phone number you give Calendly, the date and time of the call. Purpose: to hold the call. Calendly processes this under its own policy.
• Medical and psychological screening. Questionnaire answers, ECG and laboratory results, medications, medical and psychological history. Purpose: your safety and the physician's decision to clear you. Legal basis: your explicit consent, given when you send them. These are health data and are handled only by the medical team and the psychologist.
• During the retreat. Vitals, telemetry records, notes from the medical team and practitioners, and, if you share it, wearable data for the three months of continuing care. Purpose: your care during and after the program.
• Website use. With your consent, measurement data from the Meta pixel, Google Analytics and Microsoft Clarity; without consent, cookieless aggregate statistics from Cloudflare Web Analytics; and the source of your first visit (campaign parameters, referring site, landing page) attached to your application so we know which channel brought you. Details in the cookie policy.
• Server logs. The IP address, country and browser of requests to the site, kept briefly by our host for security.

3. What we never do

We do not sell or rent your data. We do not send the content of your application, your health information, the program you chose or the reason for your visit to any advertising platform. We do not use your story for marketing. Testimonials are published only with written permission and, if you ask, anonymised.

4. Who sees it

• Our team: the onboarding lead, the certified traditional practitioners, the physician and the psychologist, each for the part of your file they need.
• Processors we use: Cloudflare (hosting and the application database), Airtable (our application and guest records), Calendly (call scheduling), Google (fonts, analytics with consent), Meta (pixel with consent), Microsoft (Clarity with consent), and our email provider. Each acts on our instructions under its own data processing terms.
• Your own clinicians: only with your written consent, when you ask us for a summary.
• Authorities: only where the law obliges us.

Several of these processors are in the United States. Where you are in the European Union or the United Kingdom, transfers rely on the processors' standard contractual clauses or equivalent safeguards.

5. How long we keep it

• Applications that do not lead to a retreat: two years from the last contact, then deleted, unless you ask for earlier deletion.
• Guest files, including screening and care records: as long as required by the medical record-keeping rules that apply to our physician, and in any case not more than ten years after your last program, because they matter for your safety if you return.
• Website measurement data: as set by each provider, typically between two months and two years; see the cookie policy.
• Server logs: a few days.

6. Your rights

You can ask what we hold about you, obtain a copy, correct it, delete it (except where we must keep it), restrict or object to a use, withdraw a consent for the future, and receive your application data in a portable format. Write to info@bwitilife.com; we answer within one month. If you are in the European Union or the United Kingdom you may also complain to your data protection authority; in Mexico, to the INAI.

7. Security

Data is transmitted over HTTPS, stored with providers that encrypt at rest, and accessible only to the team members who need it, with individual accounts. Health information is not sent by ordinary email when it can be avoided. No system is perfectly secure; if a breach ever affects your data, we will tell you.

8. Children

Our programs are for adults. We do not knowingly collect data from anyone under eighteen, and applications from minors are deleted.

9. Changes

We may update this policy; the version published here applies. Significant changes are announced on this page. Related documents: cookie policy and terms and conditions.