How the ICONIC Board collects, uses, protects, and handles the personal information of applicants, credential holders, and website visitors.
Effective January 1, 2025The ICONIC Board collects personal information in order to evaluate credential applications, maintain the integrity of the credentialing program, and provide services to credential holders and the public. The categories of information we collect are described below.
When you apply for an ICONIC Board credential or renew an existing credential, we collect the following information:
| Category | Examples |
|---|---|
| Identity Information | Full legal name, preferred professional name, date of birth, professional title |
| Contact Information | Email address, phone number, mailing address, professional website URL |
| Credentials and Education | Training certificates, school names and dates of completion, prior certifications, licenses held, transcripts or syllabi |
| Practice Details | Practice modalities, years of experience, client population served, practice setting (individual, group, institutional), city and state of practice |
| Professional History | Prior disciplinary actions, license history, professional affiliations, references |
| Continuing Education Records | CE activity completions, dates, providers, topics, attestations submitted at renewal |
Application fees, renewal fees, and any other payments to the ICONIC Board are processed by our third-party payment processor, PayPal, Inc. The ICONIC Board does not directly collect or store full payment card numbers, bank account numbers, or other sensitive financial data. Payment information you enter is transmitted directly to PayPal using industry-standard encryption. We retain transaction records including PayPal order IDs, payer email addresses, payment amounts, dates, and confirmation references for accounting and credentialing recordkeeping purposes.
PayPal's privacy practices are governed by the PayPal Privacy Policy.
When you visit the ICONIC Board website, we may collect standard web analytics information, including pages visited, time spent on the site, browser type, device type, general geographic region (country or state-level), and referring URL. This data is collected in aggregate and is used to understand how our website is used and to improve the visitor experience. We do not collect this data at a level that identifies individual visitors by name or credential holder identity.
If you contact us via email, support form, or other written communication, we retain a record of that correspondence, including the content of the message and any follow-up exchanges. This allows us to provide consistent service and to maintain a record of credential-related communications.
The ICONIC Board uses the information it collects for specific, defined purposes related to credentialing and professional standards. We do not use personal information for purposes unrelated to the Board's credentialing mission without your consent.
Processing Credential Applications. We use application data to evaluate whether applicants meet eligibility requirements for the credential tier sought, verify the authenticity and accuracy of submitted credentials and training documentation, contact applicants regarding the status of their application, and issue or deny credentials based on the application review.
Maintaining the Practitioner Directory. We use credential holder information to populate and maintain the public practitioner directory, update directory listings to reflect current credential status (Active, Lapsed, Revoked), and allow members of the public to verify the credentials of individuals listed in the directory.
Communicating Credential Status. We use contact information to notify credential holders of application decisions, credential approval and issuance, renewal reminders and deadlines, continuing education compliance status, any Board investigations or compliance actions that affect the credential, and material updates to Board policies, Terms of Service, or the Code of Professional Conduct.
Continuing Education Compliance Tracking. We use application and renewal data to track each credential holder's CE completion history, verify CE submissions at renewal, identify CE deficiencies and issue cure notices, and maintain audit-ready records of CE compliance for each credential holder.
Board Operations and Recordkeeping. We use collected data to maintain the legal and administrative records of the credentialing program, respond to disputes or appeals, comply with applicable legal obligations, and analyze aggregate program data (never individual data) to improve credential standards and Board programs.
We do not use your personal information for advertising, marketing to third parties, or any commercial purpose unrelated to your credential application or maintenance.
The ICONIC Board maintains a public practitioner directory as a core function of its credentialing mission. The directory allows members of the public, employers, and institutions to verify practitioner credentials and locate qualified holistic health professionals. Directory listing is a condition of holding an active ICONIC Board credential, as described in the Terms of Service.
The following information about active credential holders is accessible in the public directory:
The following information is never listed in the public directory:
When a credential lapses (due to non-renewal) or is revoked (due to a Board finding), the active directory listing is updated to reflect the change in status. In cases of credential revocation, the Board may maintain a notation of the revocation in the publicly accessible directory for up to seven (7) years following the revocation date. This practice exists to protect the public and maintain the integrity of the credential program. It is consistent with standard practice among professional credentialing bodies.
The ICONIC Board does not sell, rent, or trade personal information to any third party. Personal information is shared only in the limited circumstances described below.
Payment Processor. Payment data is transmitted to Stripe, Inc. for the purpose of processing application and renewal fees. Stripe receives only the information necessary to complete the transaction. The Board does not share credential application content or practice details with Stripe.
Email Service Provider. We use a third-party email delivery service to send transactional communications, including application status notifications, renewal reminders, and Board announcements. This provider receives your email address and, where necessary, your name for the purpose of delivering communications. Our email service provider is contractually prohibited from using this data for any other purpose.
Legal and Regulatory Requirements. We may disclose personal information if required to do so by applicable law, court order, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of the ICONIC Board, its credential holders, or the public. We will notify affected credential holders of such disclosures to the extent permitted by law.
Professional Standards Investigations. In cases involving credentialed practitioners who are also licensed by a state regulatory body, and where a formal Board investigation has found a substantiated ethics violation, the Board may share relevant findings with applicable state licensing boards as required by applicable professional standards law or at the discretion of the Board's legal counsel. Credential holders will be notified prior to any such disclosure where legally permissible.
Successor Organizations. In the event of a merger, acquisition, reorganization, or transfer of Board governance, credential holder data may be transferred to a successor organization, provided that the successor organization is bound by a privacy policy no less protective than this one. Credential holders will be notified of any such transfer in advance.
We do not share personal information with advertisers, data brokers, analytics companies, or any commercial third parties not specifically described in this Policy.
The ICONIC Board retains personal information for as long as necessary to fulfill the purposes for which it was collected, to maintain the integrity of the credentialing record, and to comply with applicable legal obligations. The following retention standards apply.
| Data Category | Retention Period |
|---|---|
| Credential Application Records (all tiers, approved and denied) | 7 years from date of application decision |
| Active Credential Records | Maintained indefinitely while credential is in good standing |
| Lapsed Credential Records | 7 years from date of lapse; may be retained longer if reinstatement is pending |
| Revoked Credential Records | 7 years from date of revocation as permanent administrative record |
| Continuing Education Records | Duration of active credential plus 4 years following last renewal |
| Payment and Transaction Records | 7 years for accounting and legal compliance purposes |
| Communications and Correspondence | 3 years from last communication, or for the duration of any open dispute or inquiry |
| Website Analytics Data | 26 months (aggregate data only; no individual identifiers retained) |
Following the applicable retention period, personal information will be securely deleted or anonymized such that it can no longer be associated with an identifiable individual. Credential records that have been anonymized may be retained indefinitely for aggregate statistical and program improvement purposes.
Active Credentials: The Board maintains credential records indefinitely while a credential is in good standing because the credential record constitutes a permanent professional record. This is consistent with standard practice for professional credentialing bodies and serves the public interest in credential verification.
Depending on your jurisdiction and applicable law, you may have certain rights regarding your personal information held by the ICONIC Board. We respect these rights and will respond to verified requests within 30 days of receipt, or as required by applicable law.
You may request a copy of the personal information the ICONIC Board holds about you, including your application file, credential record, and CE history.
You may request correction of inaccurate personal information in your credential record. Corrections to credential-related information (e.g., name, practice location) may be made through the credential holder portal.
You may request deletion of personal information. Note that deletion requests are subject to important limitations described below, particularly for active and historical credential records.
You may object to certain uses of your personal information, including receipt of non-essential communications. You may update communication preferences through your credential holder account.
The right to deletion is subject to significant limitations in the context of professional credentialing. Specifically:
Deletion requests that do not fall into the above categories will be evaluated and, where feasible, honored within 30 days of verification. We will inform you of the specific reason if a deletion request cannot be honored.
To submit a request to access, correct, or delete your information, or to exercise any other available rights, please use the contact form at iconicboard.org/support with "Privacy Rights Request" in the subject line. We will verify your identity before processing any request affecting credential records.
The ICONIC Board website uses a minimal number of cookies and tracking technologies, consistent with our commitment to collecting only what is necessary to operate the site effectively.
Essential Cookies. We use session cookies to maintain login state in the credential holder portal. These cookies are strictly necessary for portal functionality and cannot be disabled while using the portal.
Analytics. We use standard website analytics to understand aggregate patterns in how visitors use the site, such as which pages are most visited and how visitors navigate the site. Analytics data is collected in aggregate and does not personally identify individual visitors. We do not use advertising-based tracking technologies, cross-site tracking cookies, or behavioral analytics platforms.
No Advertising Tracking. The ICONIC Board does not use advertising cookies, retargeting pixels, social media tracking pixels, or any third-party advertising technology on its website. We do not participate in advertising networks or permit advertising platforms to collect data from ICONIC Board website visitors.
Third-Party Embeds. If you interact with third-party content embedded on the site (such as a contact form or payment widget), those third parties may set their own cookies consistent with their privacy policies. We minimize third-party embeds wherever possible.
Cookie Management. You may control or disable cookies through your browser settings. Disabling cookies may affect certain features of the credential holder portal. Your browser's help documentation provides instructions for managing cookies.
The ICONIC Board implements security measures appropriate to the nature and sensitivity of the information we hold. While no digital system can guarantee absolute security, we apply the following practices to protect personal information.
Encryption at Rest. Sensitive credential holder data, including credential application contents, professional history disclosures, and any other personally sensitive information, is stored using AES-256 encryption at rest. This means that even in the event of a data breach, raw data files would not be human-readable without the encryption key.
Encryption in Transit. All data transmitted between your browser and the ICONIC Board website is protected by TLS (Transport Layer Security) encryption. The site is served exclusively over HTTPS. Connections over unencrypted HTTP are automatically redirected to HTTPS.
Access Controls. Access to credential holder data is restricted to Board staff and contractors with a legitimate operational need. All staff with access to personal data are subject to confidentiality obligations. Access privileges are reviewed regularly and revoked promptly when no longer needed.
Payment Security. Payment data is handled exclusively by Stripe, which is certified to PCI DSS (Payment Card Industry Data Security Standard) Level 1. The Board does not transmit, store, or process raw payment card data on its own systems.
Incident Response. In the event of a data security incident affecting personal information, the Board will assess the scope and nature of the incident, notify affected individuals and applicable regulatory authorities as required by law, and take prompt remedial action. Affected credential holders will be notified without undue delay and in accordance with applicable breach notification requirements.
Limitations. No security system is impenetrable. The Board cannot guarantee the security of data transmitted over the internet, and transmission of information to or from the site is at your own risk. You are responsible for maintaining the confidentiality of your credential holder portal login credentials.
For questions, concerns, or requests related to this Privacy Policy or the ICONIC Board's data practices, please contact us using the information below.
Privacy Inquiries
ICONIC Board of Holistic Health
Contact Form at iconicboard.org/support
Please include "Privacy Policy" in the subject line of your inquiry.
Response Time. We will acknowledge privacy inquiries within five (5) business days and will provide a substantive response within 30 days, or as required by applicable law.
Policy Updates. This Privacy Policy may be updated periodically to reflect changes in our practices or applicable law. Material changes will be communicated to active credential holders by email at least 30 days before taking effect. The "Effective Date" at the top of this page reflects when the current version took effect. We encourage you to review this Policy periodically.
This Privacy Policy is effective as of January 1, 2025. The ICONIC Board of Holistic Health is a professional credentialing body. This Policy applies only to information collected by the ICONIC Board in connection with credentialing activities and website use.
ICONIC Board — Standards & Credentialing Division
Standards & Credentialing Division, ICONIC Board