Privacy Policy

1. Introduction

Hello Gorgeous Med Spa ("Company," "we," "us," or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our services, or interact with us.

2. Information We Collect

Personal Information

We may collect the following types of personal information:

• Name, address, phone number, and email address
• Date of birth and gender
• Payment information (credit card numbers are not stored on our servers)
• Emergency contact information

Protected Health Information (PHI)

As a medical provider, we collect health-related information including:

• Medical history and current health conditions
• Medications and allergies
• Treatment records and clinical notes
• Before and after photographs
• Lab results and diagnostic information
• Insurance information (if applicable)

Automatically Collected Information

When you visit our website, we may automatically collect:

• IP address and browser type
• Device information
• Pages visited and time spent
• Referring website
• Cookies and similar technologies

3. How We Use Your Information

We use your information for the following purposes:

Treatment Purposes

• Providing medical aesthetic services
• Creating and maintaining your medical record
• Communicating with you about your care
• Scheduling appointments and sending reminders
• Following up on treatment outcomes

Payment and Operations

• Processing payments and invoicing
• Managing your account
• Verifying insurance coverage (if applicable)
• Internal quality improvement

Communication

• Sending appointment reminders
• Providing treatment information
• Sending promotional offers (with your consent)
• Responding to inquiries

4. How We Share Your Information

We may share your information in the following circumstances:

With Your Consent

• When you authorize us to share information with other providers
• For marketing purposes (only with explicit consent)
• For before/after photos (only with signed photo release)

Without Your Consent (as permitted by law)

• For treatment, payment, and healthcare operations
• To comply with legal requirements
• To prevent serious threats to health or safety
• For public health activities
• To health oversight agencies
• In response to lawful court orders

Service Providers

We may share information with third-party service providers who assist us in operating our business (e.g., payment processors, scheduling software, email services). All service providers are required to sign Business Associate Agreements (BAAs) and maintain HIPAA compliance.

5. Your Rights Under HIPAA

You have the following rights regarding your health information:

6. Data Security

We implement appropriate technical and organizational measures to protect your information:

• Encrypted data transmission (SSL/TLS)
• Encrypted data storage
• Access controls and authentication
• Regular security assessments
• Staff training on privacy and security
• Physical security of records

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. If you have reason to believe your information has been compromised, please contact us immediately.

7. Data Retention

We retain your information as follows:

• Medical Records: Minimum 10 years after last treatment (as required by Illinois law)
• Minor Patient Records: Until patient reaches age 23 or 10 years after last treatment, whichever is later
• Billing Records: 7 years
• Marketing Data: Until you unsubscribe or request deletion

8. Cookies and Tracking

Our website uses cookies and similar technologies to:

• Remember your preferences
• Analyze website traffic
• Improve user experience
• Deliver targeted advertising (with consent)

You can control cookies through your browser settings. Note that disabling cookies may affect website functionality.

10. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these sites. We encourage you to review the privacy policies of any site you visit.

11. Children's Privacy

Our services are not intended for individuals under 18 years of age without parental/guardian consent. We do not knowingly collect information from children under 13. If you believe we have collected information from a child, please contact us.

12. Breach Notification

In the event of a data breach affecting your Protected Health Information, we will notify you in accordance with HIPAA requirements (within 60 days of discovery) and take appropriate steps to mitigate harm.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date. Your continued use of our services constitutes acceptance of any changes.

14. How to File a Complaint

If you believe your privacy rights have been violated, you may:

1. Contact our Privacy Officer (see below)
2. File a complaint with the U.S. Department of Health and Human Services Office for Civil Rights

We will not retaliate against you for filing a complaint.