# Website Privacy Policy

**State Supplement: California**
*This document serves as a template for a California medical spa's public-facing website privacy policy, integrating both federal baseline requirements and the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA).*

---

## 1. Introduction
Welcome to our website. We respect your privacy and are committed to protecting your personal information. This Privacy Policy lets you know how your personal information is processed and used. We will take steps to use your personal information only in ways that are compatible with this Privacy Policy.

## 2. Information We Collect
We collect information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household, or device ("Personal Information").

In particular, we have collected the following categories of Personal Information from consumers within the last twelve (12) months:
- **Identifiers:** Name, postal address, email address, Internet Protocol (IP) address.
- **Personal Information Categories:** Telephone number, medical information, or health insurance information (note: medical information subject to CMIA/HIPAA is often exempt from CCPA, see section 5).
- **Commercial Information:** Records of products or services purchased.
- **Internet or other similar network activity:** Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.

## 3. Use of Personal Information
We may use or disclose the personal information we collect for one or more of the following purposes:
- To fulfill or meet the reason you provided the information.
- To provide, support, personalize, and develop our Website, products, and services.
- To process your requests, purchases, transactions, and payments.
- For testing, research, analysis, and product development (non-medical data).

## 4. Specific California Rights (CCPA/CPRA)
If you are a California resident, California law provides you with specific rights regarding your personal information:

- **Right to Know and Data Portability:** You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months.
- **Right to Delete:** You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions.
- **Right to Correct:** You have the right to request correction of inaccurate personal information we maintain about you.
- **Right to Opt-Out:** You have the right to direct us *not* to sell or share your personal information. (Note: We do not sell your personal information).
- **Right to Limit Use of Sensitive Personal Information:** You have the right to direct us to limit our use of your sensitive personal information to that use which is necessary to perform our services.
- **Non-Discrimination:** We will not discriminate against you for exercising any of your CCPA rights.

**Exercising Your Rights:** To exercise the rights described above, please submit a verifiable consumer request to us via our designated contact email or phone number.

## 5. Exemption for Medical Information
Please note that medical information governed by the California Confidentiality of Medical Information Act (CMIA) or protected health information (PHI) governed by the Health Insurance Portability and Accountability Act (HIPAA) is generally exempt from the CCPA/CPRA. Your medical privacy rights are outlined in our separate Notice of Privacy Practices (NPP).

## 6. Do Not Track Signals
California Business and Professions Code Section 22575(b) provides that California residents are entitled to know how we respond to "Do Not Track" browser settings. We currently do not respond to DNT signals as there is no uniform industry standard.

## 7. Changes to Our Privacy Policy
We reserve the right to amend this privacy policy at our discretion and at any time. When we make changes, we will post the updated notice on the Website and update the notice's effective date.

*Effective Date: April 17, 2026*