Over 180 women have reported they were sexually assaulted at global spa chain Massage Envy, according to a BuzzFeed investigation published Monday.

The alleged assaults by Massage Envy employees reportedly occurred at locations across the country – the billion-dollar business owns just under 1,200 franchises in the U.S., with 40 locations in the Bay Area – and the reports range from digital and oral penetration to the groping of breasts and genitals.

Many of the victims claim Massage Envy mishandled or ignored their reports of assault. The BuzzFeed report suggests that these reported incidents are just the tip of the iceberg, as the number does not include cases that settled outside of court or assaults that went unreported.

"Dozens of women reported digital and oral penetration," wrote BuzzFeed. One incident involved a "California woman who said she opened her eyes during a prenatal massage to find her massage therapist sucking on her nipple." Two women reported sexual assault incidents at a Sacramento franchise, the only Northern California location cited in the investigation.

Massage Envy isn't liable for sexual assaults that take place at spas "because of the nature of the franchise arrangement," according to public statements and court fillings obtained by BuzzFeed. Individual spas "control their own day-to-day operations," a company spokesperson told BuzzFeed, "including figuring out how best to investigate inappropriate conduct."

Franchise owners are given little guidance in this regard, BuzzFeed claims, with the exception of a training video called "Behind Closed Doors," which advises therapists to address their guest's concerns "in a safe and secure environment in order to retain them as a valued client and avoid negative attention."

Companywide protocol does not require managers to contact local law enforcement or hire investigators, unless local law demands such actions, the report found. Many of the women cited in the investigation reached out to law enforcement on their own, after they say Massage Envy failed to address their reports of assault. Some of the massage therapists reportedly continued to see clients, even after they were accused of assault.

"Some have kept massage therapists on staff even after multiple misconduct complaints," BuzzFeed alleges. "Others have quietly fired therapists without reporting their offenses to police or state regulatory boards, allowing the therapists to move on to new professional opportunities with a clean record."

All of Massage Envy therapists undergo a background check and are informed of the company's "zero-tolerance policy" regarding inappropriate touching or actions "that infer sexual suggestiveness or explicit sexuality," a spokesperson told BuzzFeed. Names of therapists who are found to have violated the policy are entered into an internal database.

In response to SFGATE's request for comment, Massage Envy responded with the following statement:

"Each of these incidents is heartbreaking for us and for the franchisees that operate Massage Envy locations, and we will never stop looking for ways to help our franchisees provide a safe environment at Massage Envy franchise locations. The article references 180 reported incidents. These occurred over a span of 15 plus years and 125 million massages. But, we believe that even ONE incident is too many, so we are constantly listening, learning, and evaluating how we can continue to strengthen our policies with respect to handling of these issues."

BuzzFeed found that Massage Envy "has never had to answer in open court to a victim of sexual assault at one of its spas," but that could change with a civil lawsuit headed to court in January. Eight women have brought lawsuits against the same Philadelphia spa.

In past assault cases brought against Massage Envy, Buzzfeed says lawyers have argued that despite the fact that spas are independently owned, "it's the parent company that trains employees in Massage Envy policies, sets operational standards such as the need to investigate internally, and monitors the progress of those investigations — and that as a result, the parent company should be held accountable for those policies' failures."

Michelle Robertson is an SFGATE staff writer. Email her at mrobertson@sfchronicle.com or find her on Twitter at @mrobertsonsf.