# Notice of Privacy Practices (NPP)

**State Supplement: Massachusetts**
*This document outlines the privacy practices of the medical spa, meeting the requirements of federal HIPAA standards and specific Massachusetts confidentiality laws, including compliance with 201 CMR 17.00 data security rules.*

---

## 1. Our Commitment to Your Privacy
We understand that medical information about you and your health is personal. We are committed to protecting your medical information. We create a record of the care and services you receive to provide you with quality care and to comply with state and federal legal requirements.

This Notice describes how we may use and disclose your medical information, as well as your rights regarding this information under the Health Insurance Portability and Accountability Act (HIPAA) and Massachusetts state law.

## 2. How We May Use and Disclose Your Medical Information
- **For Treatment:** We may use medical information about you to provide aesthetic and medical treatments. We may disclose your information to doctors, nurses, and allied health professionals who are involved in your care.
- **For Payment:** We may use and disclose your medical information to bill and collect payment from you, an insurance company, or a third party.
- **For Health Care Operations:** We may use and disclose your medical information for practice operations, quality assessment, training, and business planning.

## 3. Massachusetts-Specific Protections & Data Security
In addition to federal laws, Massachusetts affords some of the most rigorous data security privacy protections over your patient records.
- **Written Information Security Program (WISP):** In compliance with Massachusetts Data Security Regulations (201 CMR 17.00), our clinic maintains a comprehensive WISP designed to safeguard your personal computerized records. This includes mandatory encryption protocols for your personal information when transmitted wirelessly or across public networks.
- **Confidentiality:** Patient records are strictly confidential and may not be disclosed without your specific written authorization, except where explicitly mandated or permitted by state or federal law.
- **Marketing, Photography, and Media:** Utilizing your health information or images (including before-and-after photographs or social media videos) for marketing purposes requires your explicit, signed written consent. We will not sell or share this data for outside marketing purposes.

## 4. Your Privacy Rights
You have the following rights regarding your medical information:
- **Right to Access:** You have the right to inspect and receive a copy of your medical records. We will provide access within a reasonable timeframe as mandated by HIPAA and Massachusetts administrative codes. We may charge a reasonable, cost-based fee for copying your records.
- **Right to Amend:** If you feel that medical information we have about you is incorrect or incomplete, you may ask us to amend the information.
- **Right to an Accounting of Disclosures:** You have the right to request a list of the disclosures we made of your medical information, excluding those made for treatment, payment, or operations.
- **Right to Request Restrictions:** You have the right to request a restriction or limitation on the medical information we use or disclose about you. We will comply with reasonable requests as required by law.
- **Right to Confidential Communications:** You have the right to request that we communicate with you about medical matters in a certain way or at a certain location.

## 5. Breach Notification
In the event of a breach of unsecured protected health information or unencrypted personal data, we will notify you in compliance with HIPAA Breach Notification Rules and the Massachusetts data breach notification law (M.G.L. c. 93H). Notice will be provided as soon as practicable and without unreasonable delay following the discovery of the breach.

## 6. Complaints
If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the Secretary of the Department of Health and Human Services. You will not be penalized for filing a complaint.

*Effective Date: April 17, 2026*