# Website & Consumer Health Data Privacy Policy

**State Supplement: Nevada (NPICICA & SB370 Compliant)**
*This document serves as a template for a Nevada medical spa's public-facing website privacy policy, integrating federal requirements, the Nevada Privacy of Information Collected on the Internet from Consumers Act (NPICICA), and the strict consumer health data rules under Nevada SB370.*

---

## 1. Introduction
Welcome to our website. We respect your privacy and are committed to protecting your personal and health information. This Privacy Policy details how we collect, use, and process your personal information when you visit our website, book an appointment, or interact with our digital services. 

## 2. Information We Collect
We collect information that identifies or could reasonably be associated with you ("Personal Data"). 

We may collect the following categories of Personal Data:
- **Identifiers:** First and last name, email address, postal address, phone number.
- **Commercial Information:** Products, treatments, or services you have inquired about or purchased.
- **Internet Activity:** Browsing history, IP address, device information, and interactions with our website.
- **Consumer Health Data:** Information related to your past, present, or future physical health status, including aesthetic concerns, treatment inquiries, or bodily measurements.

## 3. Strict Prohibitions on Consumer Health Data (Nevada SB370)
In accordance with Nevada SB370:
- **We DO NOT sell your Consumer Health Data.** This is strictly prohibited.
- **We DO NOT share your Consumer Health Data with third parties** without your separate, explicit, affirmative consent (opt-in), except as strictly necessary to fulfill the services you have requested.
- **No Geofencing:** We do not implement geofencing around any healthcare facility to identify or track consumers, or to send health-related advertisements.

## 4. Use of Personal Information
With your consent, we use the personal information collected for the following business purposes:
- To provide our aesthetic services and respond to your direct inquiries.
- To process your payments securely.
- To improve our website and customer service.
- To send administrative information regarding your appointments.

## 5. Your Rights Under Nevada Law (NPICICA & SB370)
If you are a resident of Nevada, you are granted specific rights regarding your personal and health data:
- **Right to Opt-Out of Sale (NPICICA):** Under Nevada law (NRS 603A.340), Nevada residents may submit a request directing us not to make any certain "sales" of covered information we have collected or will collect about you. *Please note, we do not sell your personal data.* To submit such an opt-out request, please contact us via the designated email address provided on our contact page.
- **Health Data Rights (SB370):** You have the right to confirm whether we are collecting, sharing, or selling your consumer health data. You have the right to access this data, including a list of all third parties with whom we have shared the data. You have the right to withdraw your consent. You have the right to request the immediate deletion of your consumer health data.

To exercise these rights, please contact us. We will authenticate your request and respond within 45 days.

## 6. Data Security & Breach Notification
We safeguard your personal data through industry-standard administrative, technical, and physical security measures. 
- **Notification:** In the event of a security breach involving your computerized, unencrypted personal information, we will notify you and relevant authorities in compliance with Nevada data breach notification law (NRS 603A.220). We are committed to executing these notifications without unreasonable delay.

## 7. Exemption for Medical Information
Please note that "protected health information" (PHI) collected by our clinic acting as a covered entity governed by the Health Insurance Portability and Accountability Act (HIPAA), is subject to specific medical privacy laws that interact with and supersede general website data privacy rules. 

If you are a patient receiving medical aesthetic treatments, the privacy of your clinical and health information is governed by our separate Notice of Privacy Practices (NPP).

## 8. Changes to Our Privacy Policy
We may update this privacy policy from time to time to comply with changes in state or federal regulations. The updated version will be indicated by an updated "Effective Date."

*Effective Date: April 17, 2026*