Health-adjacent customer information is collected without documented privacy practices
- Evidence (Client-provided)
- Intake notes indicate health and wellness goals are stored in a shared spreadsheet with no stated retention or access policy.
- Recommendation
- Document a basic privacy and data-handling practice, restrict spreadsheet access, and map which records may be health-adjacent.