# Website Privacy Policy

**State Supplement: Utah**
*This document serves as a template for a Utah medical spa's public-facing website privacy policy, integrating federal requirements and the Utah Consumer Privacy Act (UCPA).*

---

## 1. Introduction
Welcome to our website. We respect your privacy and are committed to protecting your personal information. This Privacy Policy details how we collect, use, and process your personal information when you visit our website, book an appointment, or interact with our digital services.

## 2. Information We Collect
We collect information that identifies or could reasonably be associated with you ("Personal Data"). 

We may collect the following categories of Personal Data:
- **Identifiers:** First and last name, email address, postal address, phone number.
- **Commercial Information:** Products, treatments, or services you have inquired about or purchased.
- **Internet Activity:** Browsing history, IP address, device information, and interactions with our website.
- **Sensitive Data (UCPA):** Under the Utah Consumer Privacy Act, data revealing your medical history or health condition is considered "sensitive data." We will provide clear notice and an opportunity to opt-out prior to processing this specific category of data for non-medical marketing purposes.

## 3. Use of Personal Information
We use the personal information we collect for the following business purposes:
- To provide our aesthetic services and respond to your inquiries.
- To process your payments securely.
- To improve our website and customer service.
- To send administrative information and marketing communications (subject to your opt-out rights).

## 4. Your Rights Under the Utah Consumer Privacy Act (UCPA)
If you are a resident of Utah, and we meet the requisite processing thresholds set by the UCPA, you are granted specific rights regarding your personal data:
- **Right to Access:** You have the right to confirm whether we process your personal data and to access such data.
- **Right to Delete:** You have the right to delete personal data that you have provided to us.
- **Right to Data Portability:** You have the right to obtain a copy of your personal data in a portable, readily usable format.
- **Right to Opt-Out:** You have the right to opt-out of the processing of your personal data for purposes of targeted advertising, or the sale of personal data. 

To exercise these rights, please contact us using the information provided on our contact page. We will authenticate your request and respond within 45 days as mandated by the UCPA.

## 5. Data Security & Breach Notification
We safeguard your personal data through industry-standard administrative, technical, and physical security measures. 
- **Notification:** In the event of a security breach involving your computerized, unencrypted personal information, we will notify you and relevant authorities in compliance with the Utah Protection of Personal Information Act (U.C.A. § 13-44-202). Notice will be provided in the most expedient time possible and without unreasonable delay.

## 6. Exemption for Medical Information
Please note that "protected health information" (PHI) collected by our clinic acting as a covered entity governed by the Health Insurance Portability and Accountability Act (HIPAA), is subject to specific medical privacy laws that interact with and supersede general website data privacy rules. The rights provided by the UCPA generally do not apply to PHI.

If you are a patient receiving medical aesthetic treatments, the privacy of your clinical and health information is governed by our separate Notice of Privacy Practices (NPP).

## 7. How We Share Your Information
We do not sell your personal data to data brokers. We may share your data with trusted third-party service providers (e.g., website hosts, email marketing platforms, EMR software, payment processors) who assist us in operating our business. These parties are contractually obligated to keep your information secure and process it only for authorized purposes. 

## 8. Changes to Our Privacy Policy
We may update this privacy policy from time to time to comply with changes in state or federal regulations. The updated version will be indicated by an updated "Effective Date."

*Effective Date: April 17, 2026*