Legal
Privacy Policy
How we collect, use, and protect information for the practices and clients who trust BuboSoma with their data.
🕊 Last updated: 9/30/2026Two different time frames, in plain language
90 days: your account after you cancel. When a clinic cancels, its account stays available in read-only mode for 90 days so it can export its data. After that, the account and practice data may be deleted.
7 years: client text and email messages. SMS and email messages between a clinic and its clients are part of the client record. They are kept for 7 years from the date each message was created, including after a clinic cancels, and cannot be deleted earlier at a client’s request. They are deleted automatically when the 7 years end. Read the full retention section.
01Who this covers
BuboSoma serves two kinds of users, and it's worth being clear about the difference between them.
Subscribers are the massage therapy businesses, solo practitioners, clinics, and franchise operators who sign up for BuboSoma to run their practice. Subscribers hold their own client relationships and are responsible for how they use client information within the Service.
Clients are the individuals who book appointments, submit intake forms, or otherwise interact with a Subscriber through BuboSoma. If you're a client of a practice that uses BuboSoma, that practice is who you have a direct relationship with. BuboSoma is primarily the software Subscribers use to manage that relationship.
If you're a client with questions about how your specific information is used, your practice is often best placed to answer, though you're always welcome to contact us directly too.
02Information we collect
From Subscribers, when you sign up and use BuboSoma, we collect:
- Business name, address, phone number, and email
- Practitioner and staff names, roles, and login credentials
- Billing information, processed through our payment partner
- Business tax and compliance information relevant to payment processing
From Clients, through a Subscriber's use of BuboSoma, we may collect:
- Contact details (name, email, phone number)
- Appointment history and scheduling preferences
- Intake form responses, which may include health-related information relevant to treatment, such as areas of concern, contraindications, or conditions disclosed for the practitioner's safety and care planning
- Practice notes and treatment-related information submitted through available forms and records.
- Payment and transaction information, processed through our payment partner
Automatically, through use of the Service:
- IP address, device type, and browser information
- Usage data, such as pages visited, features used, and login times
- Cookies and similar technologies, used to keep you logged in and understand how the Service is used
We don't ask Subscribers or Clients for more than is necessary, and we ask Subscribers to collect from their own clients only what's needed for legitimate treatment, scheduling, and business purposes.
03A note on health information
Because BuboSoma is built for massage therapy practices, some information passing through the service, practice notes and treatment-related information submitted through available forms and records, intake responses, and treatment history, relates to a client's health. We take this seriously.
- We apply administrative, technical, and physical safeguards designed to protect this information, including encryption at rest and in transit.
- We do not sell, rent, or use health-related information for advertising purposes, ever.
- Subscribers remain responsible for obtaining any consents required under applicable law before collecting health-related information from their own clients.
04How we use information
We use the information we collect to:
- Provide, operate, and maintain the Service, scheduling, practice notes and treatment-related information submitted through available forms and records, client records, payments, and communications
- Process transactions and send related confirmations
- Send appointment reminders, confirmations, and other transactional communications on behalf of Subscribers
- Respond to support requests and communicate with Subscribers about their accounts
- Monitor and improve the security, performance, and reliability of the Service
- Comply with legal obligations, including tax, financial, and payment-processing recordkeeping requirements
- With consent, send product updates or marketing communications, which you can opt out of at any time
We do not use client health-related information to build advertising profiles, and we do not sell personal information to third parties for their own marketing purposes.
06Payments
Payment processing is handled through our payment partner, currently Stripe. When you make or receive a payment through BuboSoma, your payment card information is collected and processed directly by Stripe under Stripe's own privacy policy. BuboSoma does not store full payment card numbers on our own servers.
07Data retention
We retain information for as long as a Subscriber's account is active, and for a reasonable period afterward to comply with legal, tax, and recordkeeping obligations. Subscribers can request export or deletion of their data at any time, your information is yours, and you're never locked into staying with us to keep access to it.
Some information may be retained longer where required by law, such as financial transaction records for tax purposes.
Client communications. SMS and email exchanged between a Subscriber and their clients through BuboSoma are retained for seven years from the date the record was created and are considered part of the client record. Treating practitioners can view the full communication history for their own clients. Message exports are available to practice management at the client's location and to account-level administrators.
Because these communications may contain health-related information, they are handled with the same safeguards described in Section 03. Communications are automatically purged at the end of the seven-year retention period, and, because this period reflects recordkeeping obligations tied to the client record, cannot be deleted earlier at a client's request.
08Your choices and rights
Depending on where you live, you may have rights over your personal information, including the ones below. These are available to residents of states with comprehensive privacy laws.
| Right | What it means |
|---|---|
| Access | Request a copy of the personal information we hold about you |
| Correction | Ask us to correct inaccurate information |
| Deletion | Some records, including client communications retained under Section 07, may not be eligible for early deletion. |
| Opt-out | Opt out of certain uses of your information, including marketing |
| Portability | Receive your information in a portable format |
For privacy, legal, security, and support questions, contact jade@bubosoma.com. If you're a client of a Subscriber, we may need to direct your request to that Subscriber, since they control the underlying client relationship, but we're glad to help facilitate it either way.
09Service providers
BuboSoma works with the following categories of service providers, who may process information on our behalf:
- Payment processing (Stripe)
- Text message reminders and communications (Telnyx)
- Email marketing, where Subscribers opt in (Mailchimp)
- Calendar sync (Google Calendar)
- Accounting sync, where Subscribers opt in (QuickBooks, planned, not yet active)
- Cloud hosting and infrastructure
11Children's privacy
BuboSoma is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information without appropriate consent, contact us at jade@bubosoma.com and we will address it.
12Security
We use administrative, technical, and physical safeguards designed to protect the information in our care, including encryption, access controls, and regular review of our security practices. No system is 100% secure, and we encourage Subscribers and clients to use strong, unique passwords and to contact us immediately if they suspect unauthorized access to their account.
13Massage Pathology Pro
Massage Pathology Pro is BuboSoma's clinical pathology reference for massage therapists, at bubosoma.com/massage-pathology-pro/. You can read it without an account.
Suggestions. If you use "Suggest a condition or correction," we collect the words you type, where you opened the form (search, What Am I Seeing?, or the menu), which condition page was open, the app version, and the time. We do not ask for your name or email with a suggestion, and we do not store your IP address with it. To limit spam, we keep a scrambled (hashed) version of your IP address for up to 24 hours to count how many suggestions come from the same visitor. Before a suggestion is saved, email addresses, phone numbers, dates, and long numbers are automatically removed. We use suggestions only to review and improve the library, and we delete each suggestion 90 days after we finish reviewing it. Because suggestions are not linked to your identity, we cannot find or delete a specific suggestion for you.
Searches that find nothing. When a search in Massage Pathology Pro finds no matching condition, or What Am I Seeing? finds only weak matches, we may record the search words so we can add missing conditions. Before saving, the words are automatically cleaned to remove email addresses, phone numbers, dates, long numbers, and phrases that look like a person's name. We record only the cleaned words, where the search was made, and how many times it was searched. We do not store an account, IP address, or device identifier with these records. To prevent abuse, a scrambled (hashed) version of your IP address may be kept for up to one hour to limit how many searches are recorded from one visitor. Records are deleted 12 months after the words were last searched.
Please do not enter client information. Do not type client names, dates of birth, contact details, or other identifying information into searches, What Am I Seeing?, or suggestions.
Information kept on your device. Massage Pathology Pro stores your text-size choice and your acceptance of the Medical Disclaimer in your browser's local storage. When free accounts are available, favorites and recent conditions will also be stored in your browser. This information stays on your device and is not sent to us. You can remove it by clearing your browser's site data.
Voice search. If you use the microphone button, your browser's speech service (for example, Google or Apple) may process your audio to turn it into text. BuboSoma does not receive the audio.
14Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we'll notify Subscribers by email or through the Service, and update the "Last updated" date at the top of this page. Continued use of the Service after changes take effect means you accept the updated Policy.
15Contact us
Questions about this Privacy Policy or how we handle your information can be sent our way any time.
Get in touch
We reply to sales and early-access questions within 1 business day.
For privacy, legal, security, and support questions, contact jade@bubosoma.com