A2P SMS Privacy & Security Policy

2.1 Appointment Reminders

Automated SMS messages sent to opted-in users to confirm, remind, or reschedule appointments and service engagements.

Sample message: "Hi [Name], this is a reminder of your appointment with Elite Brand Builders and EliteOS on [Date] at [Time]. Reply STOP to opt out."

2.2 Transactional Alerts

Messages triggered by account activity including payment confirmations, order updates, access credentials, and security notifications.

Sample message: "Your Elite Brand Builders / EliteOS account has been updated. If you did not make this change, call 314-720-3038. Reply STOP to opt out."

2.3 Marketing and Promotional

Outbound promotional messages sent only to users who have provided explicit prior written consent to receive marketing communications.

Sample message: "Special offer from Elite Brand Builders! [Offer details]. Reply STOP to opt out. Msg&Data rates may apply."

2.4 Customer Support (Two-Way Messaging)

Interactive two-way SMS to facilitate customer service inquiries, feedback, and issue resolution.

Sample message: "Hi from the Elite Brand Builders support team. How can we help you today? Reply STOP to end messages."

3.1 Web Opt-In (Online Form)

Users complete an opt-in form at https://elitebrandbuilders.com/ that includes:

• A clearly labeled phone number field
• An unchecked checkbox with disclosure language such as: "By checking this box, I agree to receive text messages and/or calls from Elite Brand Builders and EliteOS (HealthBeat 365 Inc.) including appointment reminders, transactional alerts, and marketing messages. Message frequency varies. Message & Data rates may apply. Reply STOP to opt out, HELP for assistance."
• A link to this A2P Policy and to the full Privacy Policy

3.2 Verbal / In-Person Opt-In

• Verbal consent is documented with a timestamp, representative name, and confirmation SMS sent to the user
• Representative scripts include all required disclosures

3.3 SMS Keyword Opt-In

• Users may text a keyword (e.g., JOIN or START) to our number to opt in
• An auto-reply confirmation is immediately sent with program description, frequency, opt-out instructions, and HELP info

3.4 Double Opt-In (Where Required)

For marketing campaigns, we employ a double opt-in process where the user's subscription is confirmed via a follow-up confirmation message prior to any campaign messages being sent.

5.1 Universal Opt-Out Keywords

The Company's messaging system honors all standard opt-out keywords in compliance with CTIA requirements:

STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT – immediately removes user from all marketing lists

5.2 Processing Time

Opt-out requests are processed within 24 hours. Users who opt out will receive a single final confirmation message acknowledging their request, then no further marketing messages.

5.3 Transactional Exceptions

Users who opt out of marketing communications may still receive legally required or service-critical transactional messages (e.g., appointment confirmations, account security alerts) as permitted under TCPA and carrier guidelines, unless they expressly request complete messaging cessation.

5.4 HELP Response

When a user texts HELP, the automated response will include: "Elite Brand Builders and EliteOS: For help, call 314-720-3038 or visit https://elitebrandbuilders.com/. Reply STOP to opt out."

6.1 Data Collected

In connection with A2P messaging, we collect and store:

• Mobile phone numbers (opt-in numbers only)
• Opt-in source, date, time, and method
• Message logs including send/delivery/read status
• Opt-out records and timestamps
• Consent confirmation records

6.2 No Sale or Sharing of Phone Numbers

The Company does not sell, rent, trade, or share subscriber phone numbers with any third party for their own marketing or solicitation purposes. Phone numbers are used exclusively to deliver the services described in this policy.

6.3 Third-Party SMS Providers

The Company may utilize registered third-party SMS aggregators or CPaaS providers (e.g., Twilio, Bandwidth, Sinch) to deliver messages. These providers are contractually bound to CTIA compliance standards and are prohibited from using subscriber data for any purpose other than message delivery.

6.4 Retention

Consent records and opt-out records are retained for a minimum of four (4) years to support legal compliance and audit requirements. Message logs are retained for a minimum of two (2) years.

7.1 Technical Safeguards

• All subscriber data is stored in encrypted databases using AES-256 encryption at rest
• Data transmission is protected by TLS 1.2 or higher encryption in transit
• Access to messaging systems and subscriber databases is restricted by role-based access controls (RBAC)
• Multi-factor authentication (MFA) is required for all administrative access
• Regular security audits and penetration testing are conducted

7.2 Organizational Safeguards

• Employees with access to subscriber data receive annual privacy and security training
• Access is granted on a least-privilege basis
• Contractor and vendor agreements include data security and confidentiality provisions

7.3 Incident Response

In the event of a data breach involving subscriber phone numbers or messaging data, the Company will:

• Contain and investigate the incident within 72 hours
• Notify affected users in accordance with applicable state breach notification laws
• Report to relevant carriers and TCR if required
• Document the incident and remediation actions taken

8.1 TCR Registration

The Company registers all A2P messaging campaigns through The Campaign Registry (TCR) and maintains current registrations for all active use cases. Campaign details accurately reflect message content, opt-in methods, and sample messages.

8.2 Prohibited Content

The Company's messaging campaigns do not include content related to:

• SHAFT categories: Sex, Hate, Alcohol, Firearms, Tobacco (including cannabis)
• Phishing, malware, or deceptive content
• Illegal goods or services
• High-risk financial services (payday loans, cryptocurrency solicitation)

8.3 Message Volume and Throughput

The Company operates within carrier-approved throughput limits for its registered campaigns. Message volume spikes are coordinated with our SMS provider to ensure compliant delivery.

8.4 Number Vetting

All phone numbers used for outbound A2P messaging are registered, vetted, and maintained in accordance with carrier requirements. The Company does not use shared short codes for campaigns requiring dedicated sender identification.