Privacy Policy

---

 Crescent Holistic Health Effective date: 8/21/2026  Last updated: 8/21/2026 

Crescent Clearing, LLC, a Florida limited liability company doing business as Crescent Holistic Health ("Crescent Holistic Health," "we," "us," or "our"), is a virtual holistic health practice operated by Cynthia Fluck, AFMP, CECP, CBCP. We provide applied functional medicine consulting, hormone and lab interpretation, nervous system and lifestyle guidance, and remote energy work to clients located in the United States and internationally.

This policy explains what information we collect, why we collect it, who we share it with, and what you can do about it. It applies to crescentholistic.com, ltf.crescentholistic.com, any other website or landing page we operate, our email and text messaging programs, and our services.

Contact for privacy questions: Crescent Holistic Health, 11161 E State Rd 70, Unit 110-944, Lakewood Ranch, FL, 34202  Email: cynthia@crescentholistic.com

Most people assume that any business handling health information is covered by HIPAA. That is not how the law works, and we would rather tell you plainly than let you assume something inaccurate.

HIPAA applies to "covered entities" — health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically in connection with certain insurance transactions — and to their business associates. Crescent Clearing, LLC dba Crescent Holistic Health does not bill insurance and does not conduct those transactions, so we are generally not a HIPAA covered entity.

That does not mean your health information is unprotected. It means the protection comes from this policy, from our contracts with the platforms we use, from state health privacy laws such as the Washington My Health My Data Act, and from the ordinary duty of confidentiality we take seriously in any case. We hold your health information to the standard we would want for our own.

Some of the platforms we use — including our client portal — are built to HIPAA standards and we have executed the appropriate agreements with them where offered. Where a laboratory or licensed provider is involved in ordering or interpreting a test, that provider's own obligations apply to the records they hold.

If your situation depends on whether HIPAA applies, ask us and we will tell you exactly how your information is handled.

• Contact details. Name, email address, mailing address, and telephone or mobile number.
• Health and wellness information. Symptoms, menstrual and menopausal history, sleep, mood, energy, digestion, weight, medications and supplements, medical and family history, stress and trauma history, goals, and anything else you choose to tell us. This includes answers to our online assessments and intake forms and anything you share in a session, by email, or by message.
• Laboratory results. Hormone panels such as the DUTCH test and any other results you order through us or share with us.
• Appointment and scheduling information.
• Payment information. Payments are processed by our payment processor. We receive confirmation of payment and limited details such as the last four digits of a card. We do not store full payment card numbers.
• Communications. Emails, texts, portal messages, form submissions, and session notes.
• Guardian and dependent details. Where a client is a minor, we collect the name and contact details of the parent or legal guardian who enrolled them.

When you visit our websites we and our analytics and advertising providers may collect IP address, approximate location derived from it, browser and device type, operating system, referring page, pages viewed, time on page, and similar usage data, using cookies, pixels, and similar technologies. Section 9 explains this in detail and tells you how to turn it off. 

• Referral information, where an existing client or colleague tells us your name.
• Booking, appointment, and payment confirmations from the platforms we use to run the practice.
• Publicly available professional information, such as a LinkedIn profile, where you have contacted us through that platform.

We do not buy contact lists, and we do not append data purchased from data brokers to your record.

We treat your health information as the most sensitive category of information we hold, and we apply the following rules to it.

• We collect it for one purpose: to work with you, or to prepare to work with you.
• We do not sell it. Not now, not under any circumstance, and not in any form.
• We do not share it with advertisers, ad networks, data brokers, or social media platforms for marketing.
• We do not use it to build advertising audiences, lookalike audiences, or targeting segments.
• We do not put it in a text message. If we need to reach you about a result, the text says a result is ready and directs you to a private channel.
• We share it only with the service providers listed in Section 10 who need it to deliver the service you asked for, and only under contract.
• Where we present a client story publicly, we either have written permission naming that client, or we blend details from several people so that no individual is identifiable. Where a story is a composite, we say so.

• To provide the services you have asked for, including consultations, lab interpretation, protocols, and energy work.
• To schedule, confirm, and remind you about appointments.
• To fulfil orders, including sending laboratory kits and delivering reports.
• To answer your questions and provide support.
• To send you the emails you signed up for, and text messages if you separately agreed to those.
• To take payment and keep financial records.
• To improve our services and understand which of our pages and emails are useful, using aggregated and de-identified data wherever possible.
• To market our services to people who have asked to hear from us, using contact and interest information but not health information.
• To meet legal, tax, and regulatory obligations, and to establish or defend legal claims.

We do not use your health information to train artificial intelligence models, and we do not permit our service providers to do so.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

If you give us your mobile number and separately check the box agreeing to receive text messages, we use it only to send you the messages you agreed to.

• Two separate consents. One for service messages such as appointment reminders, kit shipping updates, and messages about work already in progress. One for marketing messages. You may agree to either, both, or neither.
• Consent is never required. You can become a client, buy anything we sell, and receive everything you have paid for without ever agreeing to a text message.
• Frequency. Message frequency varies. In practice it is generally no more than a handful of messages per month.
• Cost. Message and data rates may apply. These are charged by your mobile carrier, not by us.
• Stopping. Reply STOP to any message to opt out. Reply HELP for help, or email cynthia@crescentholistic.com.
• Carriers. Mobile carriers are not liable for delayed or undelivered messages.
• What we never text. We do not put symptoms, diagnoses, laboratory results, or any other health details in a text message.

Your mobile number and your consent to receive texts are kept separate from every other category of information in this policy and are never disclosed, sold, rented, or passed to any third party for their own purposes. The only parties who ever see your mobile number are the messaging providers who deliver the message on our behalf, and they may use it for no purpose other than delivery.

If you sign up for our emails, we send you a mix of educational writing and occasional information about services we offer. Every marketing email includes an unsubscribe link that works, and our physical mailing address, as required by the CAN-SPAM Act.

Unsubscribing from marketing email does not stop transactional messages — appointment confirmations, order and shipping notices, and messages about work already underway. Those are part of the service you asked for. If you want to stop those as well, email us and we will close out your file.

We do not sell your personal information. We have never sold it and we do not share it for cross-context behavioural advertising, as those terms are defined under California law.

We share personal information only in these circumstances:

• Service providers. The platforms listed in Section 10, who process information on our behalf, under contract, and only on our instructions.
• At your direction. If you ask us to send your results to your physician or another practitioner, we do.
• Payment processing. With our payment processor, to take payment.
• Legal requirements. Where we are required by law, subpoena, or court order, or where we believe in good faith that disclosure is necessary to prevent serious harm.
• Business transfer. If the practice is ever sold, merged, or transferred, your information may transfer with it. If that happens we will notify you before your information becomes subject to a materially different privacy policy, and you will be able to delete your information first.

We do not share your information with other clients, with "affiliates" for their own marketing, with event co-sponsors, or with advertising and analytics partners in any form that includes health information.

 Our websites use cookies and similar technologies. These fall into three groups.

• Strictly necessary. Needed to make pages, forms, and checkout work. These cannot be turned off.
• Analytics. We use Google Analytics and Microsoft Clarity to understand which pages people read, where visitors come from, and where pages confuse people. Microsoft Clarity is configured to mask form input, so it does not capture what you type into a form.
• Advertising. We use the LinkedIn Insight Tag to measure whether our posts and advertising bring people to our sites and lead to enquiries. It runs on crescentholistic.com and on our lab experience pages. It does not run on our hormone pattern assessment, and it never receives your answers, your intake information, or your laboratory results.

 Our commitment on health information and tracking. Advertising and analytics technologies never receive your health information. Specifically:

• No advertising or analytics technology ever receives your answers to a health question, anything from an intake form, or any laboratory result. Those are collected by us and by the platforms listed in Section 10, and by nobody else.
• We do not run advertising pixels on our hormone pattern assessment, on our client portal, or on any page where results are shown.
• Microsoft Clarity is configured to mask form input, so it does not capture what you type.
• On our marketing and product pages, including the pages where our lab experience is described and ordered, the LinkedIn Insight Tag records that a visit and a purchase happened so we can tell which of our posts and advertising work. It records the page, not the person's health.

If you would rather no advertising technology saw your visit at all, use the opt-outs below or send a Global Privacy Control signal, and we will honor it. If you ever find one of our pages that appears to break these rules, tell us and we will fix it that day.

How to turn tracking off.

• Most browsers let you block or delete cookies in their settings.
• Google Analytics opt-out: tools.google.com/dlpage/gaoptout
• Meta ad preferences: facebook.com/adpreferences
• LinkedIn ad settings: linkedin.com/psettings/advertising
• Industry opt-outs: optout.aboutads.info and optout.networkadvertising.org

Global Privacy Control. We honor the Global Privacy Control (GPC) signal. If your browser or extension sends a GPC signal, we treat it as a request to opt out of sharing for advertising purposes.

We run a small virtual practice on third-party platforms. The following providers may process your information on our behalf. Each is bound by contract to use it only to provide their service to us.

 GoHighLevel / LeadConnector 

 Website pages, forms, CRM, email and text delivery 

 Contact details, form answers, email and text activity 

 Practice Better 

 Client portal, intake forms, scheduling, secure messaging, session notes 

 Full health information for active clients 

 Rupa Health 

 Laboratory test ordering 

 Name, contact details, test ordered 

 Zapier 

 Moves information between the platforms above 

 Contact details, appointment and status data 

Stripe

Payment processing 

Name, email, payment details 

 Google Analytics 

 Website analytics 

 Usage data, IP address. No health information. 

Microsoft Clarity

Website analytics and session replay 

Usage data and page interactions across our lab experience pages, including the hormone pattern assessment. Configured to mask all form input, so it does not receive what you type. No health information. 

LinkedIn

Advertising measurement

That a visit or a purchase happened, on crescentholistic.com and on our lab experience pages. Not run on the hormone pattern assessment. No health information. 

Meta (Facebook)

Advertising measurement 

Usage data on crescentholistic.com only. Not run anywhere in the lab experience funnel. No health information. 

Zoom or equivalent video platform 

Live sessions

Name, email, session audio and video, session transcription for records and training (with real-time permission given.)

We keep this list current. If you want to know exactly which providers hold your information at any moment, ask and we will tell you.

Our providers are located in the United States, and information you give us is stored and processed in the United States.

We serve clients outside the United States. If you are in the European Economic Area, the United Kingdom, or Switzerland, the following applies.

Controller. Crescent Holistic Health is the controller of your personal data.

Lawful basis. We rely on your explicit consent to process health data, which is special category data under Article 9 of the GDPR. We rely on contract to deliver services you have purchased, on legitimate interests to run and secure the practice, and on legal obligation where the law requires us to keep records.

Withdrawing consent. You can withdraw your consent at any time by emailing us. Withdrawal does not affect processing that already happened, and it may mean we can no longer work with you.

Your rights. You have the right to access, correct, erase, restrict, and object to processing, and the right to data portability. You also have the right to lodge a complaint with your local supervisory authority.

International transfers. Your data is transferred to and stored in the United States. Where required, we rely on the European Commission's Standard Contractual Clauses, and equivalent UK and Swiss mechanisms, as the basis for that transfer.

Whoever and wherever you are, you may ask us to:

• Tell you what information we hold about you and where we got it.
• Give you a copy of it in a portable format.
• Correct anything that is wrong.
• Delete it, subject to records we are legally required to keep.
• Stop marketing to you, by email, by text, or both.
• Withdraw a consent you previously gave.

Email cynthia@crescentholistic.com to make any of these requests. We will confirm receipt promptly and respond within 45 days, or within the shorter period your local law requires. We may need to verify your identity before acting, which for health information usually means confirming details only you would know. We will not charge you, and we will not treat you differently for asking.

If you are in California. Under the CCPA as amended by the CPRA you have the rights above, plus the right to limit the use of sensitive personal information and the right not to face discrimination for exercising your rights. Health information is sensitive personal information. We use it only to provide the services you requested, which is a permitted use, and we do not sell or share it. You may use an authorised agent to make a request.

If you are in Washington. The Washington My Health My Data Act gives you specific rights over consumer health data, including the right to withdraw consent and the right to have your consumer health data deleted. Those rights and how to use them are described in our separate Consumer Health Data Privacy Policy, linked from our homepage.

If you are in Nevada, Connecticut, Colorado, Virginia, Oregon, Texas, or another state with a consumer privacy law, you have rights substantially similar to those listed above, and we honour them regardless of whether we are strictly required to.

• Client health records and session notes: seven years after your last appointment, or longer where state law requires. For a client who was a minor, seven years after they reach the age of majority.
• Financial and tax records: seven years.
• Marketing contact records: until you unsubscribe, plus a suppression record kept indefinitely so we do not accidentally email you again.
• Text messaging consent records: four years after consent is withdrawn, which is the period we may need them to demonstrate that consent was given.
• Website analytics: as configured in the platform, generally no more than 26 months.

When a retention period ends we delete the information or de-identify it so it can no longer be linked to you.

We use platforms that encrypt information in transit and at rest, we use multi-factor authentication on every account that offers it, we limit access to the practice owner and any contractor who genuinely needs it, and we review who has access when anyone's role changes.

No system is perfectly secure, and anyone who tells you otherwise is selling something. If a breach occurs that affects your personal information, we will notify you and the relevant authorities as required by the Florida Information Protection Act and any other law that applies to you.

Our website and services are not directed to children under 13, and we do not knowingly collect personal information from them online.

We do sometimes work with minors as clients. A minor is only enrolled by a parent or legal guardian, who provides the health information, receives all communications, and holds the account. We do not send marketing email or text messages to a minor. If you believe a child has given us information without a guardian's involvement, email us and we will delete it.

Our pages sometimes link to other websites, including scheduling pages, laboratories, and articles. We are not responsible for their privacy practices, and this policy does not apply to them.

If we change this policy we will update the "Last updated" date at the top. If the change is material — for example, a new category of sharing — we will tell you by email before it takes effect.

Crescent Holistic Health 11161 E State Rd 70, Unit 110-944, Lakewood Ranch, FL, 34202 Email: cynthia@crescentholistic.com

If you have a privacy concern, email us first. We would rather hear it directly and fix it. If you are in the EEA or UK you also have the right to complain to your supervisory authority, and if you are in California you may contact the California Privacy Protection Agency.