How we handle your data

1. Who is responsible

Bwiti Life, operator of the retreat programs presented on bwitilife.com and hosted on the Mayan Riviera near Cancun, Mexico, is responsible for the data described here. Contact: info@bwitilife.com.

2. What we collect, and why

• Application form. Name, email, WhatsApp number, gender, date of birth, citizenship, city and country, job title, the program and dates you chose, your story, how you heard about us, and your acceptance of the terms. Purpose: to evaluate your application and contact you. Legal basis: the steps needed before entering into a contract with you, and your explicit consent for the health-related parts of your story.
• Discovery call booking. Your name, email and the phone number you give Calendly, the date and time of the call. Purpose: to hold the call. Calendly processes this under its own policy.
• Medical and psychological screening. Questionnaire answers, ECG and laboratory results, medications, medical and psychological history. Purpose: your safety and the physician's decision to clear you. Legal basis: your explicit consent, given when you send them. These are health data and are handled only by the medical team and the psychologist. The health assessment and the documents you upload with it are kept apart from the rest of your file, in a protected medical storage (see section 7).
• During the retreat. Vitals, telemetry records, notes from the medical team and practitioners, and, if you share it, wearable data for the three months of continuing care. Purpose: your care during and after the program.
• Free guide download. First name, email, WhatsApp number if you give it, whether the guide is for a woman or a man, the edition and program length you chose, the page you were on, and the source of your first visit. Purpose: to send you the guide, invite you to a discovery call and follow up about it. Legal basis: your consent, which you can withdraw at any time with the unsubscribe link in our emails or by writing to us.
• Website use. With your consent, measurement data from the Meta pixel, Google Analytics and Microsoft Clarity; without consent, cookieless aggregate statistics from Cloudflare Web Analytics; and the source of your first visit (campaign parameters, referring site, landing page) attached to your application so we know which channel brought you. Details in the cookie policy.
• Server logs. The IP address, country and browser of requests to the site, kept briefly by our host for security.

3. What we never do

We do not sell or rent your data. We do not send the content of your application, your health information, the program you chose or the reason for your visit to any advertising platform. We do not use your story for marketing. Testimonials are published only with written permission and, if you ask, anonymised.

4. Who sees it

• Our team: the onboarding lead, the certified traditional practitioners, the physician and the psychologist, each for the part of your file they need.
• Processors we use: Cloudflare (hosting and the application database), Amazon Web Services (the protected storage for your health assessment and the documents you upload with it, in its European Union region, under a HIPAA Business Associate Agreement), Airtable (our application and guest records), Calendly (call scheduling), Google (fonts, analytics with consent), Meta (pixel with consent), Microsoft (Clarity with consent), and our email provider. Each acts on our instructions under its own data processing terms.
• Your own clinicians: only with your written consent, when you ask us for a summary.
• Authorities: only where the law obliges us.

Several of these processors are in the United States. Where you are in the European Union or the United Kingdom, transfers rely on the processors' standard contractual clauses or equivalent safeguards.

5. Wearable devices

If you choose to, you can connect a wearable account (Garmin, Withings, Oura, WHOOP, or Fitbit and Pixel Watch through Google) from your health assessment. Connecting is optional, and you approve each type of data on the device maker's own page.

• What we read: health and activity readings such as heart rate, resting heart rate, heart rate variability, ECG recordings and their classification, blood pressure, blood oxygen (SpO2), breathing rate, stress and recovery scores, sleep, temperature, weight and body composition, workouts, steps, VO2 max and, where you allow it, women's health data such as pregnancy status. We never read location or GPS routes.
• Why: only for your medical screening before your retreat and to follow your progress over the three months after it. Our physicians review it as part of your medical file.
• Who handles it: it is stored encrypted on Amazon Web Services under a HIPAA Business Associate Agreement, with your other medical information (see section 8), and is shown only to the members of our team in charge of your health review. No other company receives it.
• Never sold, never shared: we do not sell, rent or share wearable data with anyone, and do not use it for advertising.
• No artificial intelligence: wearable data is not processed by any artificial intelligence or machine-learning system, and is never used to train, evaluate or improve one.
• Your control: you can disconnect at any time from your health assessment or by writing to info@bwitilife.com. You can ask to see, correct, export or delete the data we received; deleting your file erases it for good. Disconnecting stops any further sharing.

6. How long we keep it

• Applications that do not lead to a retreat: two years from the last contact, then deleted, unless you ask for earlier deletion.
• Free guide downloads: two years from the last contact, then deleted; sooner if you unsubscribe and ask us to.
• Guest files, including screening and care records: as long as required by the medical record-keeping rules that apply to our physician, and in any case not more than ten years after your last program, because they matter for your safety if you return.
• Website measurement data: as set by each provider, typically between two months and two years; see the cookie policy.
• Server logs: a few days.

7. Your rights

You can ask what we hold about you, obtain a copy, correct it, delete it (except where we must keep it), restrict or object to a use, withdraw a consent for the future, and receive your application data in a portable format. Write to info@bwitilife.com; we answer within one month. If you are in the European Union or the United Kingdom you may also complain to your data protection authority; in Mexico, to the INAI.

8. Security

Data is transmitted over HTTPS, stored with providers that encrypt at rest, and accessible only to the team members who need it, with individual accounts. Health information is not sent by ordinary email when it can be avoided. No system is perfectly secure; if a breach ever affects your data, we will tell you.

Medical information. Your health assessment and the documents you upload with it are kept on Amazon Web Services (AWS), in a private storage area reserved for medical information and covered by a Business Associate Agreement under HIPAA, the United States health privacy law. They travel over an encrypted connection (HTTPS) and are stored encrypted (AES-256) with an encryption key that belongs to Bwiti Life; any unencrypted connection to the storage is refused. They are not kept with our general client records or in our email. Only the members of our team in charge of your health review can open your file; every time a file is opened it is recorded, and these records are kept for six years. HIPAA does not bind us as a business in Mexico: we choose to hold your medical information to its safeguards. There is no official HIPAA certification, and we do not claim one. More in What HIPAA-aligned means.

9. Children

Our programs are for adults. We do not knowingly collect data from anyone under eighteen, and applications from minors are deleted.

10. Changes

We may update this policy; the version published here applies. Significant changes are announced on this page. Related documents: cookie policy and terms and conditions.