Legal
PRIVACY POLICY
How Upgrade You, LLC and Jess LeFevre, CHPC collect, use, and protect your information, including the special care taken with any health details you share.
We collect only what we need to deliver your sessions and products, we never sell your personal information, and any health details you share are treated as protected, handled only through encrypted email and never stored in your browser.
Who We Are
This Privacy Policy explains how Upgrade You, LLC ("Upgrade You," "we," "us," or "our"), operated by Jess LeFevre, CHPC, and based in Orem, Utah, collects, uses, and protects your information. It applies to the website at UpgradeYou.Life, the Anti-Candida Kitchen application, and the sessions, courses, and products we offer. By using our site or services you agree to the practices described here. If you do not agree, please do not use the site. Questions can be sent to support@upgradeyou.life.
Information We Collect
Contact details you provide. When you book a session, sign up for an email list, or reach out to us, we may collect your name, email address, and, if you choose to share it, your phone number.
Booking and intake details. To schedule and deliver a session you may provide your time zone, availability windows, optional notes, and, for ceremony kit orders, a shipping address. The notes field is optional and may contain health information. See the Health Information section below for how this is handled.
Account details. If you create an account, our authentication provider collects your email address and login credentials on our behalf. We never see or store your password.
Payment details. Payments are processed by Stripe. We do not collect or store your full card number or banking details. Stripe handles that information directly under its own privacy and security standards.
Automatically collected details. Like most websites, we receive basic technical information such as your browser type, device, and general location, along with cookies as described below.
IP address for consent records. When you opt in to marketing email, we record the IP address you opted in from, together with the date and the form you used, as proof that consent was given. This is stored encrypted, is never used to track your browsing, and is kept only as evidence of that consent. Our website analytics are separate and do not store your IP address at all.
Health Information and HIPAA
Any health details you choose to share, such as in the optional notes field during booking, are treated as protected information. This information is transmitted only to Jess through an encrypted email inbox covered by a Business Associate Agreement (BAA), the HIPAA contract that binds a provider to protect health information. It is never sold, never shared for advertising, and never used for any purpose other than preparing for and delivering your session. The wellness quiz works differently: it runs entirely in your browser, so your answers are never sent to us at all.
We do not store health information in your browser, in cookies, in analytics tools, or in server logs. Stripe receives only the session name, the session price, and your name for the purpose of processing payment. Stripe never receives your notes, phone number, time zone, or availability.
The Anti-Candida Kitchen application stores your recipe, pantry, supplement, and symptom tracking data on your own device by default. If you are signed in and turn on cloud backup, that data is sent over an encrypted connection and stored only in encrypted form on our servers so it can sync across your devices. It is never sold, never shared for advertising, and you can delete it at any time from inside the app or by contacting us.
If you connect an accountability partner in the app, only the specific deal text you choose to share (for example, "I will cook if you walk") is sent to that partner and stored, in encrypted form, on our servers. Your health, symptom, supplement, and tracking data is never shared with a partner. If you turn on notifications in the app, we store a notification token for that device so your partner’s phone can alert them when you send or answer a deal. The alert names only the person and what happened, never the deal text, because a lock screen can be read by anyone. You can turn notifications off at any time in your device settings, and we delete the token when you sign out or delete your account.
When you order a research report, the condition you name, your question, and anything you tell us you have already tried are encrypted before they are stored and are used only to prepare your report. They are never sent to our payment processor, never used to segment you for marketing, and never shared with anyone. Preparing a report means searching public research databases such as PubMed for the condition name itself; no information identifying you is ever sent to those databases. Your finished report is held encrypted and reachable only through a private link, which you can ask us to delete at any time.
How We Use Your Information
We use the information we collect to schedule and deliver sessions, process payments, send booking confirmations and transactional emails, respond to your questions, deliver digital products and course access, send you content you have requested such as the free gift for email subscribers, and improve and secure our site.
We do not use your information for purposes you have not been told about, and we do not sell your personal information.
Payment Processing
All payments are handled by Stripe, a certified payment processor. Your card and banking information goes directly to Stripe and is protected under their security standards. We never see your full payment details. The only information we pass to Stripe is what is needed to identify your purchase, namely the session or product name, the price, and your name.
Data Retention
We keep information only as long as we actually need it. What governs that: how long you have an account or an active relationship with us; how long the law requires, which for payment and tax records in the United States is generally seven years; how long a dispute or legal claim could reasonably be brought; and, for marketing, until you unsubscribe or ask us to delete you. When something is no longer needed for any of those reasons we delete it or strip it of anything identifying. Records that exist to honour a choice you made are the exception: if you unsubscribe, we keep a minimal record of that address so we do not email you again, because deleting it would undo the very thing you asked for. You can request deletion at any time as described below.
Your Rights and Choices
Wherever you live, you can ask us to give you a copy of the personal information we hold about you, correct it if it is wrong, or delete it. You can unsubscribe from marketing email using the link in any email we send. To make any other request, email support@upgradeyou.life. We will respond within 30 days, and we will never charge you or treat you differently for asking. You can also delete your account and its data yourself from your account settings.
Delete Your Account and Data
You can delete your account and its data yourself at any time, without contacting us and without installing anything. On the website, sign in and go to your account settings on the members page. In the Anti-Candida Kitchen app, open Settings and choose Delete Account. You will be asked to confirm twice, because the deletion cannot be undone.
Deleting your account removes your sign-in account itself, along with the data we hold against it: your synced kitchen data (recipes, pantry, supplement and symptom tracking, journal entries and photos), your course notes and progress, your assessment answers, any accountability partner connection and shared deals, and your contact record with its purchase history and email log. Your account is signed out on every device.
Two things are kept on purpose. If you have asked us to stop emailing you, we keep the record of that request, because it is what stops a future signup from starting the emails again. We also keep records the law requires us to keep, such as payment and tax records, which in the United States is generally seven years. Purchases stay tied to your email address, so if you ever want access restored, write to support@upgradeyou.life. If you would rather we did the deletion for you, or the in-app control does not work, email support@upgradeyou.life and we will remove your account and data within 30 days.
Children's Privacy
Our services are intended for adults. We do not knowingly collect personal information from anyone under the age of eighteen. If you believe a minor has provided us with personal information, please contact us and we will delete it.
Security
We use reasonable administrative, technical, and physical safeguards to protect your information, including encrypted transmission of sensitive details and trusted providers who maintain their own security standards. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information at every step.
Your rights in the EU, the UK and Brazil
If you are in the European Economic Area, the United Kingdom or Brazil, you have additional rights under the GDPR, UK GDPR and LGPD. On top of access, correction and deletion, you can ask us to restrict how we use your information, object to a particular use, and receive the information you gave us in a portable machine readable file. Where we rely on your consent, you can withdraw it at any time, and doing so does not make anything we did before then unlawful.
To exercise any of these, email support@upgradeyou.life. We respond within one month.
If you think we have handled your information wrongly, you have the right to complain to your national data protection authority, and you can do that without contacting us first. In Germany that is your state's Datenschutzbeauftragter, in France the CNIL, in Spain the AEPD, in Ireland the Data Protection Commission, in the UK the Information Commissioner's Office, and in Brazil the ANPD. We would rather you told us first so we can put it right, but that is your choice and not a condition.
Why we are allowed to use your information
EU, UK and Brazilian law require us to name a lawful basis for each thing we do with your information. Ours are straightforward.
To take an order, deliver what you bought, run your account and answer your messages, the basis is performance of a contract with you. To keep records for tax and accounting, and to answer legal requests, the basis is compliance with a legal obligation. To keep the site secure, prevent fraud and abuse, credit a partner who referred you, and understand which pages people read, the basis is our legitimate interest in running the business, balanced against your privacy; our analytics is built so that it cannot identify you, which is part of that balance.
Two things rest on your consent, and only your consent: marketing email, and the referral cookie described in section 6. You can withdraw either at any time, by using the unsubscribe link or by clearing cookies. Health related information you give us, such as the condition you ask us to research or notes before a session, is special category data and rests on your explicit consent, given at the moment you provide it.
Where your information is stored
Upgrade You, LLC is based in Orem, Utah, and every provider listed in section 5 is based in the United States. If you are outside the United States, your information is transferred there and processed there.
The United States has not been judged by the European Commission to offer the same level of protection as EU law. Where we transfer personal information out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses, and the UK Addendum for UK transfers, which our providers enter into with us. Alongside that, the protections described in section 11 apply wherever your information sits: health related fields are encrypted by us before they reach any database, so a provider holds unreadable text rather than your notes.
You can ask us for more detail about these safeguards at support@upgradeyou.life.
Research reports
If you order a research report, you tell us a condition, what you want to know, and optionally what you have already tried. That is health information about you, and we treat it that way.
It is encrypted before it is stored and is never sent to our payment processor: Stripe sees your name, your email and what you bought, never what you asked about. We use it to search published medical literature and to write your report. The searches themselves carry only the condition name, never your identity, so the databases we search never learn who asked.
A research report is a summary of published research, not medical advice, not a diagnosis, and not a treatment plan. You can ask us to delete your intake and your report at any time.
Governing Law
This Privacy Policy is governed by the laws of the State of Utah, without regard to its conflict of law rules. Any dispute relating to this Policy is handled under the dispute resolution and arbitration terms set out in our Terms of Service.
Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the date shown at the bottom of this page. Significant changes will be communicated where appropriate. Your continued use of the site after an update means you accept the revised policy.
Contact Us
If you have any questions about this Privacy Policy or how your information is handled, please email us at support@upgradeyou.life. You can also reach us through the contact page.
Last updated: June 2026