Heala healing househealaJewish healing house

Legal

Privacy Notice

Version 2026-09-10.1 · Effective September 10, 2026

Who We Are

This Privacy Notice applies to Heala House LLC, doing business as Heala, and the website at heala.house. Heala House LLC is a New York limited liability company that hosts intimate Jewish gatherings in New York City.

Privacy questions and requests: hello@heala.house.

Information We Collect

We currently collect the following categories of information:

  • Name and email address, which we use to identify you and communicate with you about your reservations and account.
  • Account and profile information when you choose to create a Heala account, such as the name and email associated with your profile.
  • Basic Google account information — such as name and email — when you choose to sign in with Google. Google provides the information needed to authenticate you and create or link your account.
  • Event reservation and transaction information, including the event you reserved, attendee name and email, transaction identifiers, transaction amount and currency, reservation status, and any cancellation or refund history connected to the reservation.
  • Waitlist information, including your name, email, and waitlist or notification status for events you have asked to be notified about.
  • Newsletter subscription information, including your email address, subscription status, and any unsubscribe or suppression flags.
  • Communications you send directly to Heala, such as emails or messages to hello@heala.house.
  • Technical information generated through normal hosting and security infrastructure, such as IP address, browser and user-agent information, and request logs.
  • Email delivery and abuse-prevention records, including logs of the messages we send you and their delivery status, bounce and unsubscribe events, and short-lived counters derived from your IP address or email address that we use to rate-limit waitlist and newsletter sign-ups and prevent abuse.
  • Policy acceptance records. When you reserve a place, we record your agreement to the Terms and Conditions and Refund Policy, including the version of each document, the date and time in UTC, the email address used, the related payment session, and the IP address and browser user-agent of the request. We keep these as a legal and security record of the agreement.

We do not currently collect phone numbers, dietary preferences or allergies, accessibility information, or attendance or check-in records. Heala does not create device identifiers or collect behavioral site-usage analytics for advertising or analytics purposes. Stripe and Cloudflare may process security and fraud-prevention identifiers as described below.

An account is not always required to complete a transaction. Depending on the event, guest checkout may be available, in which case we collect only the information needed to fulfill that specific reservation.

Accounts and Authentication

Heala uses its hosting and authentication infrastructure to manage accounts. You can sign in with an email address and password, or you can sign in with Google. If you use Google sign-in, Google provides the basic account information needed to authenticate you and create or link your Heala account. Password authentication is handled by our managed authentication provider; Heala’s application database does not store your password. If you sign in with Google, Heala does not receive your Google password.

Payments

Stripe is Heala’s payment processor. Heala House LLC is the seller for all orders, and Stripe provides payment processing and, where enabled, tax calculation. When you pay for an event, you enter payment information directly into Stripe’s secure checkout.

Heala does not store full payment-card numbers or CVV/security codes. We retain information necessary to maintain reservation and refund records, such as Stripe transaction and customer identifiers, transaction amount and currency, and the name and email associated with the transaction. Some payment information, such as card brand, last four digits, and billing ZIP/postal code, may be received from Stripe temporarily for transaction or receipt processing and is not persisted in Heala’s application database.

Heala does not currently offer subscriptions or recurring billing.

How We Use Information

We use the information we collect to:

  • Create and manage your account;
  • Process reservations, transactions, and waitlist sign-ups;
  • Operate events and manage event capacity;
  • Process cancellations and refunds;
  • Send transactional messages related to your reservation, including confirmations, reminders, changes, cancellations and safety information. When you complete a reservation, we also add the email address used for the reservation to the Heala newsletter, which shares news about future gatherings. You may unsubscribe at any time without affecting a reservation.
  • Maintain security, prevent misuse, and protect our community;
  • Maintain business and payment records and comply with legal, accounting, and tax obligations;
  • Operate and improve Heala’s services.

We do not use your information for behavioral advertising, profiling, targeted advertising, or third-party analytics.

Newsletter and Emails

When you complete a reservation, we add the email address used for the reservation to the Heala newsletter. Every newsletter includes an unsubscribe link, and you may unsubscribe at any time without affecting your reservation. If you previously unsubscribed, completing another reservation will not resubscribe you. Transactional messages about your reservation may still be sent.

You can also subscribe to the newsletter directly on the site, through the newsletter form or prompt, without making a reservation.

Even if you unsubscribe from marketing emails, we may still send you transactional and service communications that are necessary to operate your account or fulfill your reservation — for example, transaction confirmations, refund updates, waitlist notifications, and event changes. Unsubscribing from marketing does not delete your transaction or event records.

Who We Share Information With

We share information only with the people and providers needed to operate Heala’s services:

  • Heala House LLC’s owner and Manager, Elana Kopelman, can view reservation, waitlist and subscriber records in order to operate gatherings and provide customer support.
  • Stripe, for payment processing and, where enabled, tax calculation, and for transaction support.
  • Cloudflare, for website delivery, security, traffic protection, and bot management.
  • Lovable and its underlying hosting and cloud infrastructure, as applicable, for website hosting and operation.
  • Supabase / Lovable Cloud, for database and authentication infrastructure.
  • Email-delivery infrastructure used by Lovable, including Mailgun where applicable, to send transactional and marketing emails.
  • Google, only when you choose Google sign-in, to authenticate you and provide basic account information.
  • Professional advisers or authorities, where reasonably necessary or legally required, such as for legal, accounting, or tax advice or in response to valid legal process.

We do not share your information with analytics providers, advertising networks, data brokers, or customer-support platforms. Heala does not sell personal information.

Cookies and Similar Technologies

Heala does not use advertising or analytics cookies. The site uses limited browser storage that is necessary or useful for basic functionality, such as keeping you signed in, remembering that the newsletter prompt has been shown, and preserving basic site behavior. Specifically, our authentication provider stores a sign-in token in local storage, a heala-newsletter-seen flag in local storage records that the newsletter prompt has already been shown, and a short-lived heala:txn:<event> value in session storage links you back to your reservation after checkout.

Cloudflare. Heala’s website is delivered through Cloudflare, which provides hosting security, traffic protection, and bot management. Cloudflare sets a necessary cookie named __cf_bm to distinguish automated traffic from human visitors and protect the site from abuse. This cookie is short-lived and is not used for advertising or cross-site profiling.

Stripe. When you begin checkout, Stripe sets cookies and uses browser storage for payment processing, session management, security, and fraud prevention. This includes persistent identifiers such as __stripe_mid. Stripe’s checkout is loaded only when you start a transaction, and these technologies are governed by Stripe’s own privacy policy.

Event Photography

Photography or video may take place at Heala gatherings. Event photographs may appear on Heala’s website, social media, or other promotional channels. Consistent with our Terms & Conditions, if you do not want to appear in identifiable promotional content, you may tell us before or during the event, and we will make reasonable efforts to accommodate your request. We do not currently store photography-consent preferences through the website.

Sensitive Information

Heala does not ask attendees to state their religious beliefs as part of ordinary registration, and we do not collect health, allergy, accessibility, or waiver information through the site. Participation in events that are explicitly Jewish in nature could, however, reveal or permit inferences about religious interests or affiliation. Event-specific waivers may be used separately in the future.

Data Retention

We retain information for as long as reasonably necessary for the purposes described in this notice, including providing our services, maintaining transaction, refund, and event records, resolving disputes, maintaining security, and meeting legal, accounting, and tax obligations. We keep policy acceptance records as a legal and security record of the agreement and retain them for as long as reasonably necessary for accounting, tax and dispute purposes.

You may contact hello@heala.house to ask about deletion of your personal information. We will evaluate such requests subject to information we need or are legally permitted or required to retain.

Privacy Choices and Requests

You may contact hello@heala.house to ask about, access, correct, or request deletion of the personal information Heala holds about you, subject to applicable law and legitimate record-retention requirements. You may also unsubscribe from marketing emails at any time using the unsubscribe link in those emails.

Depending on where you live, applicable law may provide additional privacy rights. We do not promise a specific response deadline where the law does not require one.

Security

We use reasonable technical and organizational safeguards to protect the information we collect, including encryption in transit and access controls. No online service can guarantee perfect security.

Changes and Contact

We may update this Privacy Notice from time to time. The current version and its effective date will be posted on this page.

Privacy questions and requests should be sent to hello@heala.house.