# Website Privacy Policy

**State Supplement: Illinois**
*This document serves as a template for an Illinois medical spa's public-facing website privacy policy, integrating both federal requirements and the Illinois Personal Information Protection Act (PIPA) and Biometric Information Privacy Act (BIPA).*

---

## 1. Introduction
Welcome to our website. We respect your privacy and are committed to protecting your personal information. This Privacy Policy details how we collect, use, and process your personal information when you visit our website, book an appointment, or interact with our digital services.

## 2. Information We Collect
We collect information that identifies or could reasonably be associated with you ("Personal Data"). 

We may collect the following categories of Personal Data:
- **Identifiers:** First and last name, email address, postal address, phone number.
- **Commercial Information:** Products, treatments, or services you have inquired about or purchased.
- **Internet Activity:** Browsing history, IP address, device information, and interactions with our website.

## 3. Biometric Information (Illinois BIPA)
The Illinois Biometric Information Privacy Act (BIPA) enforces stringent rules around the collection of biometric identifiers (such as retina scans, fingerprints, voiceprints, or scans of hand/face geometry).
- **Our Policy:** We do not collect biometric identifiers through our public website. If biometric data (like advanced 3D facial mapping) is required during an in-clinic consultation for aesthetic treatments, we will not collect such data until we have provided you with specific written disclosures and obtained your explicit, separate written release, as mandated by BIPA.
- **Biometric Data Retention:** If collected in-clinic, biometric data is permanently destroyed when the initial purpose for collecting it has been satisfied or within 3 years of your last interaction with us, whichever occurs first. We do not sell, lease, trade, or otherwise profit from biometric data.

## 4. Use of Personal Information
We use the personal information we collect for the following business purposes:
- To provide our aesthetic services and respond to your inquiries.
- To process your payments securely.
- To improve our website, customer service, and digital experience.
- To send administrative information, newsletters, and marketing communications (subject to your opt-out rights).

## 5. Data Security & Breach Notification (PIPA)
We safeguard your personal data through industry-standard administrative, technical, and physical security measures. 
- **Notification:** In the event of a security breach involving your computerized personal information defined under the Illinois Personal Information Protection Act (PIPA) (e.g., your name combined with a financial account number or medical information), we will notify you and relevant authorities in the most expedient time possible and without unreasonable delay, consistent with any measures necessary to determine the scope of the breach and restore system integrity.

## 6. Exemption for Medical Information
Please note that "protected health information" (PHI) collected by a covered entity governed by the Health Insurance Portability and Accountability Act (HIPAA), is subject to specific medical privacy laws that interact with and sometimes supersede general website data privacy rules. 

If you are a patient receiving medical aesthetic treatments, the privacy of your clinical and health information is governed by our separate Notice of Privacy Practices (NPP), not solely by this website policy.

## 7. How We Share Your Information
We do not sell your personal data. We may share your data with trusted third-party service providers (e.g., website hosts, email marketing platforms, EMR software, payment processors) who assist us in operating our business. These parties are contractually obligated to keep your information secure. 

## 8. User Rights and Choices
You may opt out of promotional emails at any time by utilizing the "unsubscribe" link included in our communications. You may request to review or correct personal information submitted through our website by contacting us directly.

## 9. Changes to Our Privacy Policy
We may update this privacy policy from time to time to comply with changes in state or federal regulations. The updated version will be indicated by an updated "Effective Date."

*Effective Date: April 17, 2026*