# Website Privacy Policy

**State Supplement: Maryland**
*This document serves as a template for a Maryland medical spa's public-facing website privacy policy, integrating federal requirements and the strict data minimization standards of the Maryland Online Data Privacy Act (MODPA).*

---

## 1. Introduction
Welcome to our website. We respect your privacy and are committed to protecting your personal information. This Privacy Policy details how we collect, use, and process your personal information when you visit our website, book an appointment, or interact with our digital services. 

## 2. Information We Collect (Data Minimization)
We strictly adhere to the data minimization principles mandated by the Maryland Online Data Privacy Act (MODPA), effective October 1, 2025. We collect only the information that is "reasonably necessary and proportionate" to provide the specific cosmetic medical services you request.

We may collect the following categories of Personal Data:
- **Identifiers:** First and last name, email address, postal address, phone number.
- **Commercial Information:** Products, treatments, or services you have specifically inquired about.
- **Internet Activity:** Basic browsing interactions strictly necessary for website functionality.

## 3. Strict Prohibitions on Sensitive Data
In compliance with MODPA:
- **We DO NOT sell your sensitive data.** This includes any data revealing racial or ethnic origin, religious beliefs, health status, or biometric data.
- **We DO NOT collect or process sensitive data for targeted advertising.** Any collection of health-related inquiries is used solely to respond to your request for treatment information or scheduling.

## 4. Specific Uses of Personal Information
We use the personal information we collect exclusively for the following business purposes:
- To provide our aesthetic services and respond to your direct inquiries.
- To process your payments securely.
- To improve our website and customer service.
- To send administrative information regarding your appointments.

## 5. Your Rights Under the Maryland Online Data Privacy Act (MODPA)
If you are a resident of Maryland, and we meet the requisite processing thresholds set by the MODPA, you are granted specific rights regarding your personal data:
- **Right to Access:** You have the right to confirm whether we process your personal data and to access such data.
- **Right to Correct:** You have the right to correct inaccuracies in your personal data.
- **Right to Delete:** You have the right to delete personal data provided by or obtained about you.
- **Right to Data Portability:** You have the right to obtain a copy of your personal data in a portable, readily usable format.
- **Right to Opt-Out:** You have the right to opt-out of the processing of your personal data for purposes of targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects. 

To exercise these rights, please contact us using the information provided on our contact page. We will authenticate your request and respond within the timeframes mandated by MODPA.

## 6. Data Security & Breach Notification
We safeguard your personal data through industry-standard administrative, technical, and physical security measures. 
- **Notification:** In the event of a security breach involving your computerized, unencrypted personal information, we will notify you and relevant authorities in compliance with the Maryland Personal Information Protection Act (MPIPA). Notice will be provided as soon as reasonably practicable, but in no case later than forty-five (45) days after the discovery of the breach.

## 7. Exemption for Medical Information
Please note that "protected health information" (PHI) collected by a covered entity governed by the Health Insurance Portability and Accountability Act (HIPAA), is subject to specific medical privacy laws that interact with and supersede general website data privacy rules. The rights provided by MODPA generally do not apply to PHI.

If you are a patient receiving medical aesthetic treatments, the privacy of your clinical and health information is governed by our separate Notice of Privacy Practices (NPP).

## 8. Changes to Our Privacy Policy
We may update this privacy policy from time to time to comply with changes in state or federal regulations. The updated version will be indicated by an updated "Effective Date."

*Effective Date: October 1, 2025*