Effective date: October 6, 2026
This Data Processing Addendum ("DPA") is part of the 247 Routine Platform Terms between TAO Digital Agency LLC ("247 Routine," "we") and the subscribing Spa ("Spa," "you").
1. Roles
For personal information about your clients that you provide to us, or that we process to run your Spa's features (sequences, broadcasts, rewards, memberships, restock requests), you decide why it is processed and we process it on your behalf, as your service provider and processor. For member account security, app operation, and members' own requests under privacy laws, we may also act directly toward members, as described in our Privacy Policy.
2. Details of processing
| Item | Description |
|---|---|
| Subject matter | Providing the 247 Routine Platform |
| Duration | The subscription term, plus the deletion period in Section 9 |
| Nature and purpose | Hosting, storing, organizing, and displaying member information; sending notifications and messages; calculating points and rewards; providing the Esti assistant; support and security |
| Data subjects | Your clients who use or are invited to the app; your staff users |
| Personal information | Contact details, appointment and membership history, routine and check-in data, rewards data, restock requests, device and usage data |
| Consumer health data | Skin type, concerns, logs, photos, products and reactions, only with the member's consent |
| Excluded data | Protected health information under HIPAA, payment card data, government ID numbers, biometric identifiers |
3. Our obligations
We will:
- process personal information only to provide the Platform, under your documented instructions (these Terms, your settings, and your written requests), unless the law requires otherwise, in which case we will tell you unless the law prohibits it;
- not sell or share personal information for targeted advertising, not use it for any purpose outside providing the Platform, and not combine it with personal information from other sources except as allowed by law to provide the Platform;
- require everyone who processes it to keep it confidential;
- protect it with appropriate administrative, technical, and physical safeguards, including encryption in transit and at rest, access controls, and logging;
- assist you, considering the nature of the processing, in responding to members' privacy requests and in meeting your own legal obligations;
- notify you without undue delay, and in any event within 72 hours, after we confirm a security incident affecting your members' personal information, with the information you reasonably need to meet your own notice obligations;
- comply with laws that apply to us as a service provider or processor, including the Washington My Health My Data Act and state consumer privacy laws, and tell you if we can no longer meet our obligations; and
- give you information reasonably needed to show our compliance with this DPA, such as answers to a reasonable security questionnaire once a year.
4. Your obligations
You will:
- have a lawful basis, and provide all notices and obtain all consents required by law, to share your clients' information with us and to message them;
- not send us protected health information, payment card data, or other excluded data; and
- give instructions that comply with the law.
5. Sub-processors
You authorize us to use sub-processors to provide the Platform. We will keep a current list of sub-processors available on request, and notify you at least 14 days before adding or replacing one. If you object on reasonable data protection grounds, we will work with you in good faith; if we cannot resolve the objection, you may end the affected service and receive a pro-rated refund of prepaid fees for it. We will bind each sub-processor to data protection terms at least as protective as this DPA, and we remain responsible for their performance.
Current categories of sub-processors: cloud hosting and database, file storage, push notifications, text messaging, email, AI model providers, error monitoring, and customer support.
6. Consumer health data
We will collect and share consumer health data only with the member's consent as described in our Privacy Policy, honor members' requests to withdraw consent or delete it, and never sell it. We will not use facial recognition or create biometric identifiers from photos.
7. Location of processing
We process and store personal information in the United States.
8. Member requests
If a member contacts you about information in the Platform, you can use the Spa Manager tools to respond, or forward the request to us. If a member contacts us about your Spa's use of their information, we will forward the request to you, unless we are required to respond directly.
9. Return and deletion
When your subscription ends, you may export your data for 30 days. After that, we will delete your members' personal information that we hold for you, within a further 30 days, except where the law requires us to keep it, or where a member keeps an account with another participating Spa. Deleted data is removed from backups on our normal backup cycle.
10. Liability and conflicts
This DPA is subject to the limitation of liability in the Platform Terms. If this DPA conflicts with the Platform Terms on data protection, this DPA controls.