Privacy Policy | The House of Postiche Medical Hair Bank™

1. Information We Collect

We collect information you provide directly to us, depending on how you use the site:

Contact & Account Information

Name, email address, phone number, mailing address
Login credentials for the Patient Portal (handled by our authentication provider, Netlify Identity)

Patient Application Information

Date of birth, city, state, and ZIP code
Medical condition/diagnosis, duration and treatment status, physician name and phone number
Insurance status, uploaded prescriptions, insurance cards, and medical documentation
Wig style, length, texture, and color preferences
Payment plan preference

Hair Donation Information

Hair length, texture, color, thickness, treatment history, and general health
Photos of your hair that you choose to upload
Your motivation and story, if you choose to share one publicly

Orders & Bookings

Custom order specifications (length, texture, color, cap size, measurements)
Payment and shipping information (collected and processed directly by Stripe — see Payment Information below)
Event and appointment details for Traveling Studio bookings and same-day wig-slot reservations, including your preferred date and any notes you provide

Reviews, Stories & Campaigns

Reviews, ratings, and photos you submit
Information you choose to share publicly through a Fund a Wig campaign profile

Information Collected Automatically

Our hosting provider (Netlify) logs standard technical information such as IP address, browser type, and pages visited, for security and site-reliability purposes. We do not currently use third-party advertising or analytics trackers (such as Google Analytics or Facebook Pixel). We use your browser's local storage only to remember small on-site preferences, like whether you've dismissed a popup — this is not used to identify you or track you across other websites.

2. Health Information

Our Patient Application asks for information about your medical condition, treating physician, and insurance status so we can verify eligibility for our Medical Hair Bank program. We treat this information as sensitive and limit its use to processing your application, fulfilling your order, and — where you've asked us to — helping you document your condition for insurance purposes.

The House of Postiche is not a healthcare provider, health plan, or clearinghouse, and we are not a "covered entity" under HIPAA. We nonetheless handle medical information you share with us carefully, limit access to it internally, and do not sell it. We do not share your medical information with third parties except as described in this policy or with your explicit consent.

3. How We Use Your Information

To evaluate and process patient applications, hair donations, custom orders, and event/slot bookings
To communicate with you about your application, order, donation, or booking
To operate the Patient Portal and track your position on any applicable waitlist
To process payments and fulfill orders
To publish reviews, donation campaign profiles, or hair-donation stories, but only with your explicit consent, and only using the information you specifically agreed to share publicly
To send you updates you've opted into, such as our newsletter
To maintain the security, integrity, and proper functioning of the website
To comply with legal obligations

4. How We Share Your Information

We do not sell your personal information. We share information only with the service providers that help us run this website and program, and only to the extent needed for them to perform their function:

Stripe — processes payments for custom wig orders. Stripe receives your payment and shipping details directly; we do not store full card numbers.
Netlify — hosts this website, processes form submissions, powers Patient Portal login (Netlify Identity), and stores certain application data (Netlify Blobs).
Google Calendar API — used to schedule same-day wig-building slot requests. If you reserve a slot, your name, email, phone, and reservation details are used to create a calendar event and send you a calendar invite.
Mailchimp — manages our email newsletter, if you choose to subscribe.
Donorbox — processes Crown Keeper™ recurring contributions and Fund a Wig campaign gifts.

We may also share information if required by law, to protect the rights and safety of Postiche, our patients, or the public, or in connection with a business transfer such as a merger or sale of assets.

5. Payment Information

All payments on this site are processed by Stripe through a Stripe-hosted checkout page. Your card details are entered directly into Stripe's secure system and never pass through or are stored on our own servers. We receive confirmation of payment and order details (such as the items ordered and shipping address) but not your full card number.

6. Data Retention

We retain personal information for as long as needed to fulfill the purposes described in this policy — for example, for the duration of an active application, waitlist status, or ongoing patient relationship — and for a reasonable period afterward to comply with legal, accounting, or dispute-resolution obligations. You can request deletion of your information at any time; see Your Choices & Rights below.

7. Data Security

We use reasonable administrative and technical safeguards to protect your information, including relying on established, security-vetted providers (Stripe, Netlify, Google) for sensitive data handling like payments and authentication. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Your Choices & Rights

Access or correction: Contact us to request a copy of the information we hold about you, or to correct it.
Deletion: Contact us to request that we delete your information, subject to legal or operational retention needs (for example, completed order records).
Marketing emails: Every newsletter email includes an unsubscribe link.
Public content: If you've shared a review, donation story, or campaign profile publicly, contact us and we will remove it.

To exercise any of these rights, email support@mypostiche.com. We'll respond within a reasonable time.

9. Children's Privacy

This website is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

10. State Privacy Rights

Depending on where you live, you may have additional rights over your personal information under state law (for example, California residents have rights under the CCPA/CPRA to know, delete, and correct their personal information, and to opt out of certain uses). We do not sell personal information. To exercise any applicable state privacy right, contact us using the information below.

11. Changes to This Policy

We may update this policy from time to time. If we make material changes, we'll update the effective date at the top of this page. Continued use of the site after changes take effect means you accept the updated policy.

12. Contact Us

Questions about this policy or your personal information can be sent to:

The House of Postiche
P.O. Box 607285, Orlando, FL 32860
support@mypostiche.com
689-213-1842