Government and Law Enforcement Requests
Version 1.1 · effective 2026-11-12 · JJC Creative LLC
This describes what JJC Creative LLC does when a public authority asks for data we hold. It applies to law enforcement, regulators, courts and national security authorities in any jurisdiction. It is a short document because it describes a process we actually follow, rather than one we would like to be seen to have.
What we hold, and what we mostly do not
Most requests we could receive are aimed at the wrong party. We are a processor for our customers' data about their own customers — appointment records belonging to a spa or clinic. We are not the controller of it, we hold it on their instruction, and the business that collected it is almost always the right recipient of a request about it.
Where a request concerns a customer's data rather than our own records, we will direct the authority to that customer and, unless prohibited, tell the customer the request exists so they can respond as controller. Where the law compels us to act directly, we do what the rest of this page describes.
We require valid legal process
We do not disclose data voluntarily. A request must arrive as valid legal process — a subpoena, court order, warrant or the statutory equivalent in the requesting jurisdiction — issued by an authority with jurisdiction over us.
A request that arrives by email or telephone without accompanying process is not acted on. We will ask for the process.
Every request is reviewed for legality
Every request receives a documented legal review before any data is disclosed. The review is conducted by the company's principal, with outside counsel engaged where the request is contested, unclear, concerns a jurisdiction we are not established in, or asks for more than appears legally justified.
The review establishes, at a minimum:
- that the authority has jurisdiction over us;
- that the process is facially valid and properly served;
- that the data sought is specified rather than open-ended;
- that we actually hold the data described, and in what role;
- whether the customer who controls the data should receive it instead.
No disclosure is made until that review is complete and recorded.
We will challenge requests we believe are unlawful
Where a request appears to us unlawful, overbroad, jurisdictionally improper, or inconsistent with the rights of the people whose data is sought, we will object and challenge it — including in court where that is the available route, and including where complying would be simpler.
This commitment also appears in our Data Processing Agreement, so it is owed to our customers contractually and not only as a statement of intent.
We disclose the minimum the request actually compels
Where disclosure is required, we produce the narrowest set of data that satisfies the request. In practice that means limiting to the individuals, the date range and the fields specified; declining to supply adjacent records because they were convenient to include; and never producing a whole account, table or export where specific records would answer the request.
Where a request is broader than it needs to be, we will ask for it to be narrowed before producing anything.
We tell people where we lawfully can
Where a request concerns a customer's data, we notify that customer before disclosing, so they can seek to protect the interests of the individuals concerned. We withhold notice only where a court or statute prohibits it, and where a non-disclosure order expires we will give notice then.
We keep a record of every request
Each request is logged, whether or not we disclose anything. The record includes the date received, the authority and jurisdiction, the legal instrument relied on, what was sought, the reasoning of the legal review, who conducted it, whether we objected or challenged, what was disclosed, and whether the affected customer was notified.
Records are retained for a minimum of five years.
Emergency requests
Where an authority asserts a risk of death or serious physical injury, we will consider a request on an expedited basis. Expedited does not mean unreviewed: the review above still happens, and the disclosure is still limited to what the emergency requires. Emergency requests are logged like any other.
What we have received so far
As at 2026-11-12, JJC Creative LLC has received no requests from any public authority for user data — no subpoenas, no court orders, no warrants, and no national security requests of any kind.
We will update this page if that changes, to the extent the law permits us to say so.
How to serve a request
Legal process should be served on:
JJC Creative LLC
110 Channel St #629, San Francisco, CA 94158, United States
privacy@trywellth.co
Sending a copy to that address alongside formal service helps us respond promptly. Emailing us alone is not service.