Privacy Policy - Treomark

Treomark is built to need as little of your personal information as possible. This policy explains what we handle when you use the site, why we handle it, who it is shared with, and the choices you have. Plain-language summaries appear under each heading; the full text controls.

Who we are and what this covers

In short: This policy covers the Treomark public website and the forms on it.

Treomark ("Treomark," "we," "us") operates a directory of wellness providers that publishes provider information together with its source-review status. This policy applies to the Treomark public website and any form you submit on it. It does not cover provider websites, booking systems, or any other third-party service you reach by following a link from Treomark; those services have their own privacy practices.

Information we collect

In short: Only what you type into a form, plus the standard technical data any website processes to stay up and secure.

Information you give us

Contact requests. If you ask a provider to contact you through a profile, we collect your name, email address or phone number, preferred contact method, and your explicit consent. Claimed-provider forms can also accept a preferred time and optional non-medical message. For an unclaimed profile, Treomark shows a specific holding disclosure before enabling personal-detail fields and does not accept a message or time window. The form rechecks the exact profile and route before every submission.
Assistant questions. Where the Amfion Q&A assistant is enabled, the question you type and the conversation needed to answer it are processed to return source-aware information. The assistant is separate from the contact form and does not collect or deliver contact requests. Do not share contact or medical information in chat.
Profile claim requests. If you ask to claim a provider profile, we collect your name, business email address, phone number, and business domain so we can review whether you are authorized to represent that business.
Snapshot requests. If you request a Free AI Visibility Snapshot, we collect your website address, email address, business name, city, and an optional priority service so we can review eligibility, inspect your public website, email your report, and follow up once about your findings. This consent does not create a recurring marketing subscription.
Audit consultation requests. If you request a consultation about the Digital Trust & Discoverability Audit, we collect your name, role, business email address, business name, city, website address, and an optional note so we can assess fit and reply.
Messages you send us. If you contact us with a question or correction, we receive whatever you choose to include.

Information collected automatically

Our hosting and security infrastructure processes standard request data needed to serve and defend the site, such as IP address, browser type, requested pages, and timestamps. Where a form is protected against automated abuse, Cloudflare Turnstile evaluates technical signals from your browser to distinguish people from bots. We use this data to operate and secure the site, not to build advertising profiles.

If you explicitly allow first-party site measurement, Treomark records one of twenty-three bounded events covering search, city/service collections, profile and contact actions, service destinations, lead-form actions, Trust Passport use, provider visibility pages and their request forms, provider comparisons, or Research views, downloads, and internal navigation. Events can include only the stable internal identifiers or closed labels required by that action, such as a result count, position, or coarse referrer category. They never include a raw search, page URL, website address, business name, name, email address, phone number, form content, IP address, user agent, cookie identifier, or browser fingerprint.

What we deliberately do not collect

In short: No accounts, no advertising trackers, no selling data, and no medical records.

We do not require an account to browse, search, or compare providers.
We do not set advertising or third-party tracking cookies on the public site.
We do not build or buy advertising profiles about you.
We do not sell your personal information, and we do not share it for targeted advertising.
We do not ask for, and do not want, your medical history or records.

Health and other sensitive information

In short: Please never type medical details into any Treomark form. Treomark is not a healthcare service.

Treomark is a directory, not a healthcare provider, and this site is not a HIPAA-covered service. The contact form exists only to ask a provider to get in touch. Do not include medical conditions, symptoms, medications, treatment history, or any other sensitive information in a contact request or any other form on this site. Questions about eligibility, risks, and treatment belong in a direct conversation with a licensed clinician.

How we use information

In short: To hold or route an accepted request exactly as disclosed, answer source-aware questions, review profile claims, and keep the site running and safe.

For a claimed profile, to make an accepted request available through that provider's approved private route. For an eligible unclaimed profile, to hold the request for up to 30 days and make it available only if ownership of that exact location is approved before expiry. We never describe a held request as delivered or received.
To answer assistant questions from the provider's published, source-linked information.
To review a profile claim and verify authority to represent a business.
To review a visibility snapshot request, inspect the submitted public website, email the eligibility decision and report, and send one findings follow-up; and to assess and reply to an audit consultation request. Snapshot and consultation data never changes what Treomark publicly shows about any practice.
To respond to questions, corrections, and requests you send us.
To operate, secure, debug, and improve the directory.
To detect, prevent, and respond to fraud, abuse, and security incidents.
To comply with legal obligations and enforce our Terms of Service.

We do not use the contents of contact requests for marketing, and we do not send marketing email to consumers who submit them.

In short: With the exact provider only when the disclosed route permits it, with vendors that run our infrastructure, and where the law requires. Never sold.

The provider you chose. A claimed provider can view an accepted request in its private Treomark dashboard. For an unclaimed profile, no consumer information is sent to a public or unverified provider address; only an approved ownership claim for the exact location can unlock an unexpired request.
Service providers. We rely on a small set of vendors to operate the site, such as Cloudflare for content delivery, security, and bot protection, Amfion for source-aware Q&A where enabled, and a transactional email service for account, claim, sanitized provider-acquisition notices, and visibility snapshot decisions, reports, follow-ups, and consultation replies. Treomark does not put a consumer's name, email, phone, message, or medical content in provider notification email. These vendors process data on our behalf under appropriate confidentiality and may not use it for their own advertising.
Legal and safety. We may disclose information where required by law, or where reasonably necessary to protect the rights, safety, or property of visitors, providers, Treomark, or the public.
Business changes. If Treomark is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction, subject to this policy or one at least as protective.

We do not sell your personal information.

Cookies and similar technologies

In short: No advertising or analytics cookies, no cross-site tracking, and no measurement unless you allow the narrow first-party events described here.

Treomark does not set advertising or analytics cookies, and there is no cross-site tracking. Treomark remembers your measurement choice in browser local storage for 180 days so it does not ask on every visit. The random measurement identifier remains in session storage and expires when that browser session ends, so it is not used to connect activity across visits. You can change your decision at any time through Privacy choices in the footer. If you decline, or if your browser sends Global Privacy Control or Do Not Track, the browser emitter makes no analytics request and does not create a measurement session identifier. Any server request carrying either privacy signal is also discarded. Where a form is protected by Cloudflare Turnstile, Cloudflare may set strictly necessary cookies or use similar technologies for that security function.

Provider comparison selections are stored separately in your browser's local storage so they can remain available between visits. Clearing the comparison removes that saved set. If you copy a comparison link, the selected public profile slugs appear in the URL so the recipient can open the same comparison.

Third-party content and links

In short: Maps come from OpenStreetMap, security checks from Cloudflare, and provider links leave our site entirely.

Maps. Provider profiles can display a location map. Map images load from OpenStreetMap's servers when the map appears, which means your browser sends a standard request (including your IP address) to OpenStreetMap at that time.
Bot protection. Where enabled, Cloudflare Turnstile runs on forms as described above.
Provider websites and booking. Links to a provider's website, phone number, or booking route take you to services we do not control. Their privacy practices are their own; review them before submitting information there.

How long we keep information

In short: Accepted contact requests are removed from the active application no later than 30 days after acceptance. Encrypted disaster-recovery backups follow a separate 30-day rotation.

We keep submitted information to a minimum. Trusted intake must positively resolve either an approved claimed-provider route or the explicitly disclosed exact-location holding state before personal details are enabled. The daily purge uses a conservative cutoff so the request, its private events, notification intents, correlated delivery metadata, and hashed IP and browser security metadata leave the active application no later than 30 days after acceptance. An unretrieved claim-pending request is deleted; claiming later does not restore it. Encrypted disaster-recovery backups are isolated from normal use and rotate on their own 30-day lifecycle, so an already deleted request can remain in a sealed backup until that backup expires. If we restore a backup, we run the contact-request purge and verify there is no expired backlog before reopening traffic. Claim requests are retained while the claim is reviewed and for a reasonable period afterward to document the decision. Visibility snapshot requests that do not proceed are purged 30 days after they close; delivered snapshot requests, their reports, and correlated email delivery metadata are purged 90 days after delivery; consultation requests that do not proceed are purged 90 days after they close. Other security logs rotate on a short schedule. We may retain information longer where the law requires it or where it is needed to resolve a dispute.

First-party acquisition events expire after 30 days. The session identifier is retained only as a secret-keyed one-way correlation value; staff reporting exposes only aggregate totals and suppresses cohorts smaller than two. These events cannot be used for provider ranking, verification, credentials, publication, lead routing, or provider performance claims.

How we protect information

In short: Encryption in transit, hardened infrastructure, minimal storage. No system is perfect.

The site is served over HTTPS, protected by a strict content-security policy, and operated on hardened infrastructure with bot protection on public forms. Collecting little and keeping it briefly is itself our strongest safeguard. No method of transmission or storage is completely secure, so we cannot guarantee absolute security; if we learn of a breach affecting your personal information, we will notify you as required by law.

Your privacy rights and choices

In short: Ask us to access, correct, or delete what you submitted, and we will act on it regardless of where you live.

You can request access to, correction of, or deletion of personal information you submitted through the site by contacting us (see How to contact us). We honor these requests for all visitors, not only where a statute requires it.

Depending on your state of residence, you may also have specific statutory rights, such as the right to know what personal information a business has collected, the right to request deletion or correction, the right to opt out of the sale or sharing of personal information, and the right not to be discriminated against for exercising those rights. Treomark does not sell personal information or share it for targeted advertising, so there is no sale or sharing to opt out of. To exercise any right, contact us; we will verify the request using the information you provide about your prior submission and respond within the time the applicable law allows. If we decline a request, you may appeal by replying to our response, and we will have the appeal reviewed.

Children

In short: Treomark is for adults.

Treomark is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has submitted information to us, contact us and we will delete it.

Information about providers

In short: Profiles are business information from public and provider-supplied sources, and providers can correct their own.

Provider profiles are built from provider-supplied details, public records, and independently reviewed public sources, and each published fact carries its source-review status. This is published business information about a practice. Where a practice operates under an individual's name, some business information can also identify that person; we publish it because it is professional information already made public in the ordinary course of business. Providers can claim their profile to correct or update information, and anyone can contact us to flag information they believe is inaccurate or should not be published. We review such requests against our sourcing policy and applicable law.

Visitors outside the United States

In short: Treomark is operated from the United States for a United States audience.

Treomark is operated from the United States and is directed to people seeking wellness providers in the United States. If you visit from elsewhere, your information will be processed in the United States, where privacy laws may differ from those of your home jurisdiction. Submitting a form from outside the United States means your submission will be handled as described in this policy.

Changes to this policy

In short: The date at the top always reflects the current version, and meaningful changes will be visible on this page.

We may update this policy as the product and applicable requirements change. The date at the top reflects the most recent revision. If a change meaningfully reduces your rights under this policy, we will make that change visible on this page before it takes effect.

How to contact us

In short: Reach us through the site and we will respond.

Questions, requests, and complaints about privacy can be sent to privacy@treomark.com. Include enough detail for us to locate any submission your request concerns without adding medical information.

Treomark does not provide medical advice, diagnose conditions, or determine treatment eligibility. Consult a licensed clinician before receiving any regulated medical or aesthetic service.