# Website Privacy Policy

**State Supplement: New York**
*This document serves as a template for a New York medical spa's public-facing website privacy policy, integrating both federal baseline requirements and the New York SHIELD Act.*

---

## 1. Introduction
Welcome to our website. We respect your privacy and are committed to protecting your personal information. This Privacy Policy details how we collect, use, and process your personal information when you visit our website, book an appointment, or interact with our digital services.

## 2. Information We Collect
We collect information that identifies or could reasonably be associated with you ("Personal Data"). 

We may collect the following categories of Personal Data:
- **Identifiers:** First and last name, email address, postal address, phone number.
- **Commercial Information:** Products, treatments, or services you have inquired about or purchased.
- **Internet Activity:** Browsing history, IP address, device information, and interactions with our website.
- **Private Information (as defined under NY SHIELD Act):** We strive to minimize the collection of "private information" through our website. However, any biometric data, financial account numbers, or online account credentials collected are secured in compliance with New York state law.

## 3. Use of Personal Information
We use the personal information we collect for the following business purposes:
- To provide our aesthetic services and respond to your inquiries.
- To process your payments securely in compliance with PCI standards and state law.
- To improve our website, customer service, and digital marketing efforts.
- To send administrative information, newsletters, and marketing communications (subject to your opt-out rights).

## 4. Specific New York Data Protections (SHIELD Act)
We maintain a comprehensive written data security program to ensure the security, confidentiality, and integrity of "private information" collected from New York residents, as mandated by the New York Stop Hacks and Improve Electronic Data Security (SHIELD) Act. Our program includes administrative, technical, and physical safeguards appropriate to the size and complexity of our business.

- **Data Breach Notification:** In the unfortunate event of a security breach involving your computerized private information, we will notify you and the New York State Attorney General in the most expedient time possible, as required by the SHIELD Act (General Business Law § 899-aa).

## 5. Exemption for Medical Information
Please note that "protected health information" (PHI) collected by a covered entity governed by the Health Insurance Portability and Accountability Act (HIPAA), and patient records governed by New York Public Health Law, are subject to strict medical privacy laws superseding general website data privacy rules. 

If you are a patient receiving medical aesthetic treatments, the privacy of your clinical and health information is governed by our separate Notice of Privacy Practices (NPP), not solely by this website policy.

## 6. How We Share Your Information
We do not sell your personal data. We may share your data with trusted third-party service providers (e.g., website hosts, email marketing platforms, EMR software, payment processors) who assist us in operating our business. These parties are contractually obligated to adhere to security standards mirroring our own. 

## 7. User Rights and Choices
You have the right to request access to the personal information we have collected about you and to request correction of inaccurate data. You may opt out of promotional emails at any time by utilizing the "unsubscribe" link included in our communications.

## 8. Changes to Our Privacy Policy
We may update this privacy policy from time to time to reflect changes in our practices or changes in state/federal regulations. The updated version will be indicated by a revised "Effective Date."

*Effective Date: April 17, 2026*