# Notice of Privacy Practices (NPP)

**State Supplement: California**
*This document outlines the privacy practices of the medical spa, incorporating federal HIPAA standards and California's Confidentiality of Medical Information Act (CMIA).*

---

## 1. Our Commitment to Your Privacy
We understand that medical information about you and your health is personal. We are committed to protecting your medical information. We create a record of the care and services you receive to provide you with quality care and to comply with legal requirements. 

This Notice applies to all of the records of your care generated by our practice. It describes how we may use and disclose your medical information, as well as your rights regarding this information under the Health Insurance Portability and Accountability Act (HIPAA) and the California Confidentiality of Medical Information Act (CMIA).

## 2. How We May Use and Disclose Your Medical Information
- **For Treatment:** We may use medical information about you to provide aesthetic and medical treatments. We may disclose your information to doctors, nurses, or other personnel who are involved in taking care of you.
- **For Payment:** We may use and disclose your medical information so that the treatments and services you receive may be billed and payment may be collected from you, an insurance company, or a third party.
- **For Health Care Operations:** We may use and disclose your medical information for practice operations, such as quality assessment, employee review, and training.

## 3. California-Specific Protections (CMIA)
Under the California Confidentiality of Medical Information Act (CMIA), your medical information is afforded protections that may be stricter than federal law. 
- **Authorization Required:** We will not use or disclose your medical information for marketing purposes, or sell your medical information, without your explicit written authorization.
- **Before-and-After Photos:** Publishing any clinical photography for promotional, educational, or marketing purposes requires your strict, signed consent specifically outlining the intended use.
- **Exceptions:** We may only disclose your medical information without your authorization when compelled by law, court order, or for specific public health activities as mandated by California statutes.

## 4. Your Privacy Rights in California
You have the following rights regarding your medical information:
- **Right to Access (15-Day Rule):** Under California law, you have the right to inspect and receive a copy of your medical records. We will provide access or copies within fifteen (15) days of your written request, which is stricter than the federal 30-day requirement. We may charge a reasonable, cost-based fee.
- **Right to Amend:** If you feel that medical information we have about you is incorrect or incomplete, you may ask us to amend the information.
- **Right to an Accounting of Disclosures:** You have the right to request a list of the disclosures we made of your medical information, excluding those made for treatment, payment, or operations.
- **Right to Request Restrictions:** You have the right to request a restriction or limitation on the medical information we use or disclose about you.
- **Right to Confidential Communications:** You have the right to request that we communicate with you about medical matters in a certain way or at a certain location.

## 5. Breach Notification
In the event of a breach of unsecured protected health information, we will notify you "in the most expedient time possible and without unreasonable delay" in accordance with California Civil Code § 1798.82 and HIPAA Breach Notification Rules.

## 6. Complaints
If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the Secretary of the Department of Health and Human Services. In California, you may also file civil actions for negligent disclosures under the CMIA. You will not be penalized for filing a complaint.

*Effective Date: April 17, 2026*