Privacy policy
This Privacy Policy explains how personal data is collected, used, stored and disclosed in connection with IHPSO - International Human Potential Standards Organization.
Operated by: Biohack Global Holdings LLC
30 N Gould St Ste N
Sheridan, WY 82801
United States
Email: info@ihpso.com
Biohack Global Holdings LLC is the controller of personal data processed for IHPSO purposes unless another entity is expressly identified as controller for a particular processing activity.
1. Scope
This Policy applies to personal data processed in connection with the IHPSO website, Professional Membership, eligibility checks, Professional IDs, Core Education, assessments, Certificates and Badges, Public Registry profiles, credential verification, Contact and /connect enquiries, service communications, Provider or Partnership enquiries, qualification documentation and support interactions.
Where applicable data-protection laws, including the GDPR, apply to a processing activity, IHPSO processes personal data in accordance with those requirements.
2. Categories of personal data
Depending on how a person interacts with IHPSO, we may process identity and contact data, Membership data, professional and eligibility data, Professional ID and Registry data, education and assessment data, enquiry/relationship data and technical data.
Identity and contact data may include name, email address, country, professional contact details, organisation or practice, and position or role.
Membership data may include Membership start and renewal information, Membership status, paid-through date, B2B/18+ declaration, declaration version and timestamp, subscription status and payment-related reference information. IHPSO does not need to collect a date of birth merely to record the 18+ declaration.
Professional and eligibility data may include professional qualification, professional field, eligibility information, qualification evidence and information supplied during Membership review.
Professional ID and Registry data may include Professional ID, Membership status, Education Completion, Certificates and Badges, Registry publication status, IHPSO Verified information, Professional Provided information, and current/historical status information.
Education and assessment data may include course access, lesson completion, assessment attempts, assessment scores, pass/fail status, course completion and Certificate or Badge issuance.
Enquiry and relationship data may include Contact form submissions, /connect submissions, organisation, Area of Interest, proposed Partnership or Provider interest, messages, and source/event/campaign/language tracking parameters.
Technical data may include IP address, browser information, device information, session information, security logs, necessary cookies and similar technologies. Non-essential analytics or marketing technologies, where used, are subject to applicable consent requirements.
3. Why we process personal data
IHPSO may process personal data to administer Membership, provide Core Education and assessments, maintain Professional IDs and the Public Registry, enable credential verification, protect governance/integrity, provide communication/support and assess Partnership/Provider enquiries.
Submitting an enquiry does not automatically create Membership, Provider Recognition, Partnership or any other IHPSO status.
4. Legal bases
Where the GDPR or comparable rules requiring a legal basis apply, IHPSO may rely on performance of a contract, steps prior to entering into a contract, legitimate interests, legal obligation and consent, depending on the processing activity.
Legitimate interests may include operating and securing IHPSO, preventing fraud, maintaining professional and Registry integrity, administering governance procedures, managing professional enquiries and maintaining appropriate business records. IHPSO considers the rights and interests of affected individuals when relying on legitimate interests.
Consent may be used for optional marketing communications or non-essential technologies where consent is required. Newsletter consent is separate from a business enquiry and is not required in order to contact IHPSO.
5. B2B Membership declaration
Professional Membership is B2B-only. Before purchase, the applicant confirms that they are at least 18 years old and purchase Professional Membership in a professional or business capacity, not for primarily private or consumer purposes.
IHPSO records the declaration accepted, declaration version, timestamp and relevant Member/order reference. No date of birth is collected solely for this confirmation.
6. Qualification documents
Where eligibility requires qualification evidence, IHPSO may temporarily process uploaded qualification documents.
The current system is designed so that qualification documents are stored privately rather than made publicly accessible; the file is not intended to become part of the Public Registry; completed eligibility results in deletion of the underlying uploaded document; and incomplete or abandoned qualification submissions are subject to automatic deletion within a limited period, currently no later than 7 days.
IHPSO may retain the resulting eligibility decision or verification record even after the underlying document has been deleted. Document deletion does not necessarily mean deletion of the fact that eligibility was verified.
7. Public Registry
Some professional information is intentionally made public after the applicable approval process. A published Registry profile may contain Professional ID, name, current Membership status, IHPSO Education Completion, Certificates or Badges, IHPSO Verified professional information and Professional Provided information selected for publication.
Information marked Professional Provided has been supplied by the Professional and is not necessarily independently verified by IHPSO. Payment alone does not cause a profile to become public.
8. Credential verification
Certificate and Badge verification may remain available after Membership status changes. For example: Certificate: VALID; Membership: EXPIRED. This permits third parties to verify historical Education Completion while separately seeing current Membership status. Verification and relevant integrity records may therefore need to be retained beyond the active Membership period.
9. Service providers and processors
IHPSO uses service providers to operate the platform. Current material service providers include, where applicable: Shopify (website, commerce, checkout, customer/account and subscription infrastructure); Courses Plus / Architechpro OÜ (Core Education, course progress, assessments); Brevo (service-email delivery, including the confirmation email sent after a /connect enquiry, and, separately where applicable, marketing communications); Cloudflare (private qualification-document storage; Cloudflare Turnstile bot and security checks on the /connect form; and a Cloudflare Worker that technically routes an enquirer's first name and email address to Brevo for the enquiry confirmation); Re:amaze (support/contact functionality where used); Sufio (invoice-related functionality where used); and Mega Community (installed for potential future community functionality but intended to remain inactive/unconfigured until intentionally launched).
Brevo is used for IHPSO transactional and service-email delivery. In the current account configuration, Brevo also processes technical email interaction data, including delivery information, email opens and link interactions, because open and click tracking cannot presently be disabled completely for the IHPSO account. IHPSO uses the most privacy-minimising settings reasonably available within the service. These interaction signals are not used to determine Membership status, eligibility, Professional Standing, Professional IDs, Certificates or other credentials. Newsletter and marketing communications remain separate from service communications and are subject to separate, optional consent and double opt-in where applicable. Launch-unnecessary services including PushOwl, Messaging and Point of Sale have been removed from the current setup.
10. International data transfers
IHPSO operates internationally. Personal data may therefore be processed in countries other than the country in which the individual is located, including the United States and locations in which IHPSO service providers operate.
Where applicable data-protection law requires safeguards for international transfers, IHPSO and its service providers may rely on adequacy decisions, Standard Contractual Clauses or other recognised contractual/statutory transfer mechanisms.
11. Retention
IHPSO retains personal data only for as long as reasonably necessary for the purpose for which it was collected and for applicable contractual, integrity, tax, accounting, legal or dispute-resolution requirements. Different categories may have different retention periods.
Qualification documents: underlying uploaded documents are intended to be deleted following completion of the eligibility process, with an automatic backstop of up to 7 days for incomplete/abandoned cases.
Membership and transaction records may be retained for applicable business, accounting, tax, contractual and legal- record requirements.
Education records and credentials may be retained for longer periods where necessary to preserve Education Completion, Certificates, credential verification and Professional ID history.
Governance records relating to suspension, revocation, appeals, fraud or material integrity matters may be retained where reasonably necessary to protect IHPSO integrity and address future disputes.
Contact and /connect enquiries should be retained only for as long as reasonably necessary for the relationship or purpose for which the enquiry was submitted. Marketing information should be retained until consent is withdrawn, the person unsubscribes, or retention is otherwise no longer justified.
12. Cookies and similar technologies
IHPSO may use cookies and similar technologies required to operate the website, maintain sessions, provide account functionality, maintain security, operate checkout/Membership functions and remember necessary preferences.
Non-essential analytics or marketing technologies, where used, should be subject to any consent requirements applicable to the visitor. PushOwl, which previously declared browsing-behaviour and cookie-identifier access, has been removed from the launch configuration.
13. Marketing communications
A person submitting a Contact enquiry, /connect enquiry, Provider interest or Partnership interest does not automatically subscribe to marketing communications. Newsletter consent is separate and optional.
Where double opt-in is used, the subscription is activated only after the required confirmation step. A person may unsubscribe from marketing communications at any time. Service communications necessary for Membership, security, education or account operation are different from optional marketing communications.
14. Rights
Depending on applicable law and jurisdiction, individuals may have rights including access, correction, deletion, restriction of processing, objection, data portability, withdrawal of consent and complaint to an appropriate supervisory authority.
Requests may be sent to info@ihpso.com. IHPSO may require reasonable information to verify the identity of the requester before acting on a request. Some information may need to be retained despite a deletion request where retention is required or justified by law, contract, credential integrity, fraud prevention or legal claims.
15. Corrections to Public Registry data
Professionals may request correction of inaccurate Registry information. A request to correct Professional Provided data is distinct from a request to alter an IHPSO Verified record. IHPSO may require evidence before changing verified information.
16. Security
IHPSO uses reasonable technical and organisational measures intended to protect personal data against unauthorised access, loss, misuse, unauthorised alteration or inappropriate disclosure. No online system can guarantee absolute security.
Users are responsible for protecting their own account credentials and should report suspected account compromise promptly.
17. Children
IHPSO Professional Membership is available only to individuals aged 18 or over. IHPSO does not knowingly offer Professional Membership to minors.
18. Changes to this Policy
IHPSO may update this Privacy Policy where necessary to reflect legal requirements, changes to processing, service- provider changes, platform developments or new IHPSO services. The effective date and version will be displayed with the Policy. Where a material change affects existing Members, appropriate notice will be provided where required.
19. Contact
For privacy questions or requests: IHPSO - International Human Potential Standards Organization, operated by Biohack Global Holdings LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States. Email: info@ihpso.com.