# Website Privacy Policy

**State Supplement: Rhode Island**
*This document serves as a template for a Rhode Island medical spa's public-facing website privacy policy, integrating federal requirements and the framework of the Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA).*

---

## 1. Introduction
Welcome to our website. We respect your privacy and are committed to protecting your personal information. This Privacy Policy details how we collect, use, and process your personal information when you visit our website, book an appointment, or interact with our digital services.

## 2. Information We Collect
We collect information that identifies or could reasonably be associated with you ("Personal Data"). 

We may collect the following categories of Personal Data:
- **Identifiers:** First and last name, email address, postal address, phone number.
- **Commercial Information:** Products, treatments, or services you have inquired about or purchased.
- **Internet Activity:** Browsing history, IP address, device information, and interactions with our website.
- **Sensitive Data (RIDTPPA):** Under the Rhode Island Data Transparency and Privacy Protection Act, data revealing your medical history, mental or physical health condition, or diagnosis is considered "sensitive data." If we collect this prior to formal clinical intake via web forms, we do so ONLY with your explicit, affirmative, opt-in consent.

## 3. Strict Prohibitions on Sensitive Data
In accordance with the RIDTPPA:
- **We DO NOT process your Sensitive Data** for general marketing or tracking purposes without first obtaining your explicit, separate opt-in consent.
- You have the right to withdraw this consent freely at any time.

## 4. Use of Personal Information
We use the personal information we collect for the following business purposes:
- To provide our aesthetic services and respond to your direct inquiries.
- To process your payments securely.
- To improve our website and customer service.
- To send administrative information and, subject to your consent, marketing communications.

## 5. Your Rights Under the Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)
If you are a resident of Rhode Island, and our business operations meet the requisite thresholds set by the RIDTPPA (effective January 1, 2026), you are granted robust rights regarding your personal data:
- **Applicability Framework:** Unlike many other state privacy laws, **the RIDTPPA does not provide a blanket exemption for non-profit organizations**. If our MSO or clinic operates under or partners with a non-profit foundation structure, these rights still apply to you without limitation.
- **Right to Know/Access:** You have the right to confirm whether we process your personal data and to access such data.
- **Right to Correct:** You have the right to correct inaccuracies in your personal data.
- **Right to Delete:** You have the right to delete personal data provided by or obtained about you.
- **Right to Data Portability:** You have the right to obtain a copy of your personal data in a portable, readily usable format.
- **Right to Opt-Out:** You have the right to opt-out of the processing of your personal data for purposes of targeted advertising, the sale of personal data, or certain profiling practices. We honor recognized Universal Opt-Out Mechanisms (UOOMs).

To exercise these rights, please contact us using the information provided on our contact page. We will authenticate your request and respond within 45 days.

## 6. Data Security & Breach Notification
We safeguard your personal data through industry-standard administrative, technical, and physical security measures. 
- **Notification Timeframe:** In the event of a security breach involving your computerized, unencrypted personal information, we will notify you in compliance with Rhode Island law (R.I. Gen. Laws § 11-49.3-4). Notice will be provided as soon as practical, and **in absolutely no case later than 45 days** following the determination that a breach occurred.

## 7. Exemption for Medical Information
Please note that "protected health information" (PHI) collected by our actual clinic acting as a covered entity governed by the Health Insurance Portability and Accountability Act (HIPAA), is subject to specific medical privacy laws that interact with and supersede general website data privacy rules. The broad rights provided by the RIDTPPA generally do not apply to clinical PHI.

If you are a patient receiving medical aesthetic treatments, the privacy of your clinical and health information is governed by our separate Notice of Privacy Practices (NPP).

## 8. Changes to Our Privacy Policy
We may update this privacy policy from time to time to comply with changes in state or federal regulations. The updated version will be indicated by an updated "Effective Date."

*Effective Date: January 1, 2026*