Privacy Policy
40 Years of Zen — Main Website Privacy Policy
Last updated: September 10, 2026
40 Years, Inc., doing business as 40 Years of Zen ("40 Years of Zen," "we," "us" or "our"), values your privacy. In this Privacy Policy (this "Policy") we describe the information we collect from and about you on the Main Site and through our related applications and services (together, the "Services"), how we use and disclose it, and the choices and rights you have.
By visiting the Main Site or using the Services, you agree that your personal information will be handled as described in this Policy. Your use of the Services, and any dispute over privacy, is subject to this Policy and our Main Website Terms and Conditions, including its limitations on damages and its dispute resolution and arbitration provision. Our Terms and Conditions are incorporated into this Policy by reference.
This Privacy Policy applies to the 40 Years of Zen main website only — the site at 40yearsofzen.com and any successor or replacement domain we use for it, including 40yoz.framer.website (the "Main Site") — and to the programs, bookings, events and communications we provide through it.
It does not apply to our online store at https://shop.40yearsofzen.com. The Shop is hosted on Shopify and has its own separate Shop Privacy Policy, which governs information collected when you browse or buy there
1. Information we collect
Information you give us
We collect information directly from you when you request information, book or inquire about a program, complete intake or screening forms, purchase services, register an account, subscribe to communications, or otherwise contact us. Depending on the interaction, this may include:
• Contact details — name, email address, home or work address, telephone or mobile number.
• Account details — username, password, preferences and settings.
• Booking and payment information — program and date selected, billing name and address, payment card or bank account details (collected and processed by our payment processors), invoices, transaction history.
• Demographic information you choose to provide — such as ZIP code, age, date of birth, gender, interests and preferences.
• Program and health-related information — intake questionnaires, health history, medications and supplements, screening and eligibility responses, consent forms, and information you share with our team before, during or after a program.
• Neurophysiological and session data — EEG and brain-map data, session and equipment usage data, training metrics, notes and reports generated during your program.
• Communications — the content of emails, calls, messages and support requests, and our notes about them.
Information we collect automatically
We and our service providers automatically collect information about your use of the Services through cookies, pixels and similar technologies, including your IP address, browser and device type, operating system, domain names, referring URLs, pages viewed, access times and interactions with our pages and emails. We use this primarily to operate and secure the Services, understand how visitors use them, and produce aggregate statistics. We may combine this with other information we collect about you.
Information from other sources
We may receive information about you from our service providers (for example, scheduling, payment, email and analytics providers), from advertising and marketing partners, from our affiliates, and from social media platforms if you interact with our pages or use a social login feature. If you use a social login, we will request permission to collect the information that feature makes available, which typically includes your name, email address and profile picture. We may combine this information with what we already hold about you.
2. Sensitive personal information
Some of the information we collect — including health information, intake responses and neurophysiological data such as EEG recordings and brain maps — is treated as sensitive personal information (and in some states as biometric or neural data) under applicable privacy laws.
• We collect and use sensitive personal information only to deliver, personalize and support your program, to determine eligibility and safety, to communicate with you about your care and results, to improve our protocols and equipment, and where required or permitted by law.
• We do not sell sensitive personal information, and we do not use or disclose it for cross-context behavioral or targeted advertising.
• We do not use sensitive personal information for purposes other than those permitted under applicable law without first obtaining your consent.
• Where required, we obtain your written authorization before disclosing program health records to a third party you designate.
40 Years of Zen is a wellness and education provider, not a healthcare provider, and generally is not a "covered entity" under HIPAA. Information you provide to us is therefore protected by this Policy and applicable state privacy law rather than by HIPAA. If any part of our services is provided by a licensed clinician who is a covered entity, that clinician's HIPAA notice will govern the records they create.
3. How we use your information
• Providing the Services — to schedule, deliver and support your program; to process bookings, deposits, invoices and payments; to prepare brain maps, reports and program materials; to respond to your inquiries; and for customer service.
• Safety and eligibility — to screen for contraindications, to make participation decisions, and to support you during and after a program.
• Marketing — to send newsletters, offers, event invitations and other communications by email, text (if you opt in) or post; and to show you relevant advertising, subject to the choices described in Section 6.
• Analytics and improvement — to understand how the Services are used, on an aggregated and individual basis, and to improve our programs, protocols, equipment and website.
• Security and fraud prevention — to authenticate users, secure our systems, and detect, investigate and prevent fraudulent, unsafe or unlawful activity.
• Legal compliance — to comply with applicable legal obligations, respond to lawful requests, and establish, exercise or defend legal claims.
• Protecting rights — to enforce this Policy, our Terms and Conditions, and our other agreements, and to protect our rights and interests and those of our users and others.
4. How we disclose your information
• Service providers. Companies that perform services for us — website hosting, scheduling, payment processing, email and SMS delivery, analytics, advertising support, customer service, shipping, IT and security. They may use your information only to perform services for us.
• Affiliates. Our parent company, subsidiaries and entities under common control, for the purposes described in this Policy.
• Promotional partners. From time to time we may run a joint promotion with another organization and share the contact information of participants for that promotion. We will tell you at the point of collection when this applies.
• Advertising partners. See Section 5 and Section 6.
• At your direction. Anyone you ask us to share information with, including practitioners you designate.
• Business transfers. If we are acquired by or merged with another company, if substantially all of our assets are transferred, or as part of a bankruptcy proceeding, we may transfer information we have collected to the acquiring party.
• Legal process. To comply with law, a judicial proceeding, court order, subpoena or other legal process.
• Protection of rights and safety. Where we believe it necessary to investigate, prevent or act on illegal activity, suspected fraud, threats to the safety of any person, or violations of our Terms or this Policy.
• Aggregated or de-identified information. We may share information that no longer identifies you for marketing, research or similar purposes. We will maintain and use such information in de-identified form and will not attempt to re-identify it except as permitted by law.
5. Sale and sharing of personal information
We do not sell your personal information for money. However, some privacy laws define "sale" and "share" broadly to include the disclosure of identifiers and browsing activity to advertising partners through cookies and similar technologies. To the extent we use advertising and analytics cookies on the Main Site, that activity may be considered a "sale" or a "share" for cross-context behavioral advertising under laws such as the California Consumer Privacy Act and the Texas Data Privacy and Security Act.
You can opt out at any time by using the "Your Privacy Choices" or cookie preferences link on the Main Site, by broadcasting a Global Privacy Control signal from your browser, or by emailing info@40yearsofzen.com. We do not sell or share sensitive personal information, neurophysiological or health information, or the personal information of anyone we know to be under 16.
6. Cookies, tracking and your choices
Cookies
A cookie is a small text file placed on your device. We and our service providers use session cookies (which expire when you close your browser) to operate the site and keep you signed in during a visit, and persistent cookies (which remain until they expire or you delete them) to remember preferences and to measure and improve performance. Most browsers let you refuse or delete cookies through their settings or Help menu. If you disable cookies, some areas of the Main Site may not function properly.
Pixels and web beacons
We and our service providers use pixels (also called web beacons or clear GIFs) — tiny, invisible graphics with a unique identifier — on web pages and in HTML emails to manage content, compile usage statistics, and understand whether emails are opened, clicked or forwarded.
Analytics
We use third-party analytics providers, such as Google Analytics, to evaluate use of the Services. These providers use cookies and similar technologies to perform their services. You can learn about Google Analytics and opt out at https://tools.google.com/dlpage/gaoptout.
Interest-based advertising
We use third parties such as ad networks to serve advertisements on the Main Site and on third-party websites and platforms, based on your visits to our site and other sites. These third parties may use cookies, pixels and similar technologies, and their use of information is governed by their own privacy policies. We may provide them with information about your use of the Services.
You may opt out of many third-party ad networks through the Network Advertising Initiative at https://optout.networkadvertising.org and the Digital Advertising Alliance at https://optout.aboutads.info. Opting out means participating members will stop delivering targeted ads to you; you will still see advertising. Opt-outs are stored in cookies, so they may not persist if you clear cookies, use a different browser or device, or configure your browser to reject cookies.
Opt-out preference signals
The Main Site recognizes the Global Privacy Control (GPC) signal. Where we receive a GPC signal from your browser, we treat it as a request to opt out of the sale or sharing of personal information for that browser and device. We do not otherwise respond to "Do Not Track" signals, which have no agreed standard.
Marketing emails
You may stop receiving our newsletter or marketing emails by using the unsubscribe link in any such email or by contacting info@40yearsofzen.com. We may still send you non-promotional messages about your bookings, payments or account.
7. Text messaging (SMS)
If you provide your mobile number and opt in, we may send you appointment reminders, schedule and weather updates, preparation instructions, task reminders, follow-up messages and offers. Message frequency varies. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages. Reply STOP to opt out or HELP for help. Consent is not a condition of purchase. Full SMS program terms are in Section 10 of our Main Website Terms and Conditions.
We do not sell, rent or share mobile numbers, SMS opt-in information or consent data with third parties or affiliates for their marketing or promotional purposes. All categories of disclosure described in this Policy exclude text messaging originator opt-in data and consent, which is not shared with any third party.
8. Public and user-generated content
If we offer reviews, testimonials, community features or other interactive areas and you choose to post, the information you post — such as your name, city and the content itself — may be visible to others. We are not responsible for the privacy or accuracy of information you choose to make public, and we cannot prevent it being used in ways that violate this Policy, the law or your privacy. Please do not post health information you do not want to be public.
9. Third-party websites
The Services may contain links to third-party websites. Access to and use of those sites is governed by their privacy policies, not this one. We encourage you to review the privacy statements of any site you visit. We are not responsible for the content or privacy practices of sites other than the Main Site.
10. Security
We have taken steps designed to protect the information we collect from loss, misuse, unauthorized access, disclosure, alteration and destruction. No method of transmission over the internet or method of electronic storage is completely secure, however, and we cannot guarantee absolute security.
You should take steps to protect against unauthorized access to your account, including choosing a strong password that nobody else knows or can easily guess and keeping your login credentials private. We are not responsible for lost, stolen or compromised passwords, or for activity on your account resulting from unauthorized password use.
11. Retention
We keep personal information for as long as needed for the purposes described in this Policy. In practice, retention depends on the type of information: booking, payment and tax records are generally kept for the period required by law; program, intake and neurophysiological records are generally kept for the period appropriate to support your continuing care and our legal obligations; marketing contact details are kept until you unsubscribe and for a reasonable period afterwards to honor your opt-out; and website and analytics logs are kept for a shorter period. When information is no longer needed we delete or de-identify it.
12. Your privacy rights
Depending on where you live, you may have some or all of the following rights in relation to your personal information. These rights are not absolute, apply only in certain circumstances, and in some cases we may decline a request as permitted by law.
• Know and access — to request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties to whom we disclosed it.
• Delete — to request that we delete personal information we hold about you.
• Correct — to request that we correct inaccurate personal information.
• Portability — to receive a copy of your personal information in a portable format.
• Opt out of sale, sharing and targeted advertising — as described in Section 5.
• Limit use of sensitive personal information — to direct us to limit use of sensitive personal information to permitted purposes.
• Opt out of profiling — to opt out of profiling in furtherance of decisions producing legal or similarly significant effects. We do not currently engage in such profiling.
• Non-discrimination — we will not discriminate against you for exercising any of these rights.
How to make a request
Submit a request using the "Your Privacy Choices" link on the Main Site or by emailing info@40yearsofzen.com with the subject line "Privacy Request." We will need to verify your identity before processing your request, and may ask for information that matches what we already hold. We will respond within the time required by applicable law (generally 45 days, extendable where permitted).
Authorized agents
You may use an authorized agent to submit a request on your behalf. Please state that you are acting as an agent. We will require proof of your authorization and may also require the consumer to verify their identity directly with us.
Appeals
If we decline your request, you may appeal by replying to our decision or emailing info@40yearsofzen.com with the subject line "Privacy Appeal." We will respond within the period required by applicable law and explain the reasons for our decision. If your appeal is denied, residents of states including Texas, Virginia, Colorado and Connecticut may contact their state Attorney General to submit a complaint.
13. Notice to California residents
The categories of personal information we have collected in the preceding 12 months, the sources, purposes, and the categories of recipients are described in Sections 1 through 5 above. In summary:
Category collected
Examples
Disclosed for a business purpose to
Identifiers
Name, postal address, email, phone, IP address, account ID
Service providers, affiliates, advertising partners
Customer records
Billing details, payment information, signature
Service providers (payments, accounting), affiliates
Commercial information
Programs booked, transaction and invoice history
Service providers, affiliates
Internet and network activity
Browsing and search activity, interactions with our site and emails
Service providers (analytics, advertising)
Geolocation data
Approximate location derived from IP address
Service providers
Sensitive personal information
Health and intake information, neurophysiological and EEG data, account credentials
Service providers only; not sold or shared
Inferences
Preferences and interests drawn from the above
Service providers, affiliates
We do not sell personal information for money and we do not sell or share sensitive personal information. To the extent advertising cookies constitute a "sale" or "share," you may opt out as described in Section 5. We retain each category for the periods described in Section 11.
Shine the Light. California residents may request information about our disclosure of personal information to third parties for their own direct marketing purposes by emailing info@40yearsofzen.com with the subject line "Shine the Light Request."
14. Notice to Texas and other state residents
If you are a resident of Texas, Virginia, Colorado, Connecticut, Utah, Oregon, Montana, Delaware, Nebraska, New Hampshire, New Jersey, Iowa, Indiana, Tennessee, Minnesota, Maryland, Kentucky, Rhode Island or another state with a comprehensive privacy law, you may exercise the rights described in Section 12 to the extent that law provides them. Texas residents: you may exercise your rights and appeal our decisions using the contact details in Section 18. We may sell or share personal information — but not sensitive or biometric personal information — for targeted advertising as described in Section 5. You may opt out at any time.
15. Visitors outside the United States
The Main Site is operated in the United States. If you access it from outside the United States, your information will be transferred to, stored and processed in the United States, where privacy laws may differ from those in your country. Where we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on a recognized transfer mechanism such as the European Commission's Standard Contractual Clauses or an adequacy decision. Where the GDPR or UK GDPR applies, our legal bases for processing are performance of a contract with you, our legitimate interests in operating and improving our business, compliance with legal obligations, and your consent (including for health data and marketing where required).
16. Children
The Services are intended for adults and are not directed to children. We do not knowingly collect personal information from anyone under 18 years of age. If we learn that we have collected personal information from a child under 18, we will delete it promptly. If you are a parent or guardian and believe your child has provided us with personal information, contact us at info@40yearsofzen.com. We do not have actual knowledge that we sell or share the personal information of consumers under 16.
17. Changes to this Policy
We may update this Policy to reflect changes to our information practices or for legal or operational reasons. We will post the updated Policy on the Main Site and revise the "Last updated" date. If we make material changes, we will provide additional notice as required by law, such as by email to the address associated with your account. We encourage you to review this page periodically.
18. Contact us
For questions about this Policy, about security on the Main Site, or to exercise your privacy rights:
40 Years, Inc. d/b/a 40 Years of Zen
1710 Keller Pkwy, #6090, Keller, TX 76248, United States
Email: info@40yearsofzen.com
Phone: (512) 886-1083