# Notice of Privacy Practices (NPP)

**State Supplement: Texas**
*This document outlines the privacy practices of the medical spa, meeting the requirements of federal HIPAA standards and specific Texas medical confidentiality laws, including the Texas Medical Records Privacy Act (TMRPA).*

---

## 1. Our Commitment to Your Privacy
We understand that medical information about you and your health is personal. We are committed to protecting your medical information. We create a record of the care and services you receive to provide you with quality care and to comply with state and federal legal requirements.

This Notice describes how we may use and disclose your medical information, as well as your rights regarding this information under the Health Insurance Portability and Accountability Act (HIPAA) and Texas state law.

## 2. How We May Use and Disclose Your Medical Information
- **For Treatment:** We may use medical information about you to provide aesthetic and medical treatments. We may disclose your information to doctors, nurses, and allied health professionals who are involved in your care.
- **For Payment:** We may use and disclose your medical information to bill and collect payment from you, an insurance company, or a third party.
- **For Health Care Operations:** We may use and disclose your medical information for practice operations, quality assessment, training, and business planning.

## 3. Texas-Specific Protections (TMRPA)
In addition to federal laws, the Texas Medical Records Privacy Act (TMRPA) affords specific, expanded protections over your patient records.
- **Broad Application:** Texas law applies stringent privacy requirements not just to our clinical practitioners, but to any entity or business associate that comes into possession of your health information during our operations.
- **Employee Training:** All our employees are trained comprehensively on both state and federal privacy standards within 90 days of employment, as required by Texas law.
- **Marketing & Electronic Disclosures:** We must obtain your clear, written authorization before electronically disclosing your PHI for marketing purposes or any reasons outside of treatment, payment, and health care operations. 

## 4. Your Privacy Rights
You have the following rights regarding your medical information:
- **Right to Access:** You have the right to inspect and receive a copy of your medical records. We will provide access within a reasonable timeframe (typically within 15 business days as mandated by Texas law). We may charge a reasonable, cost-based fee for copying, the maximum limits of which are established by the Texas Medical Board.
- **Right to Amend:** If you feel that medical information we have about you is incorrect or incomplete, you may ask us to amend the information.
- **Right to an Accounting of Disclosures:** You have the right to request a list of the disclosures we made of your medical information.
- **Right to Request Restrictions:** You have the right to request a restriction or limitation on the medical information we use or disclose about you. We will comply with reasonable requests as required by law.

## 5. Breach Notification
In the event of a breach of unsecured protected health information or unencrypted personal data, we will notify you in compliance with HIPAA Breach Notification Rules and Texas Business and Commerce Code § 521.053. Notice will be provided without unreasonable delay and in no case later than the 60th day after determining the breach occurred. If the breach involves more than 250 Texas residents, we are legally mandated to notify the office of the Texas Attorney General.

## 6. Complaints
If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer, the Secretary of the Department of Health and Human Services, or the Texas Attorney General's Office. You will not be penalized for filing a complaint.

*Effective Date: April 17, 2026*