Privacy Policy

Proposed Website Privacy Policy

1. Scope

CREATIONS MED SPA LLC ("Creations," "we," "us," or "our") respects your privacy. This Website Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit creationsmedspa.com, interact with our general website forms or chat, enter a promotion, join a marketing list, purchase a gift card, or use other online services that link to this Policy (collectively, the "Online Services").

This Policy applies to personal information handled through the Online Services. It does not replace notices that apply to protected health information, employment records, or information collected solely in a business-to-business capacity.

2. HIPAA and Medical Information

Creations treats protected health information maintained in medical records in accordance with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and other applicable healthcare privacy laws. Our separate Notice of Privacy Practices explains how protected health information may be used and disclosed, your HIPAA rights, and how to contact the designated privacy official. If this Policy conflicts with the Notice of Privacy Practices concerning protected health information, the Notice of Privacy Practices controls.

Do not submit medical histories, diagnoses, medications, treatment photographs, or other sensitive health details through a general website contact form, marketing form, sweepstakes form, or general website chat. Medical information is collected in person, through Meevo, or through a form or communication sent directly to you for your appointment. If you send medical information through another channel, we will handle it as required by applicable law, but ordinary email and text messaging may not be fully secure.

3. Personal Information We Collect

Information you provide:

• Contact information: Such as your name, email address, telephone number, and mailing address.
• Appointment and transaction information: Such as requested service, appointment date, purchases, gift cards, payment status, and related customer-service records. Payment card information is processed through our payment provider and should not be sent through general website forms or email.
• Marketing and communication preferences: Including records of consent to email, calls, or text messages and records of opt-out requests.
• Promotion information: Including sweepstakes entry details, eligibility information, and prize-administration records.
• Communications: Such as messages, inquiries, reviews, feedback, survey responses, and social-media interactions.
• Age and parent or guardian information: When reasonably necessary to confirm eligibility or obtain consent for a minor's services.
• Job-application information: If you apply for employment through the Online Services.

Medical and treatment information:

When you become a patient or client, we may collect medical history, treatment information, medications, photographs, skin-analysis images, consent forms, and other information needed for care. Medical records, including clinical before-and-after photographs, may be maintained in Meevo and in a restricted-access Microsoft OneDrive environment. To the extent this information is protected health information, it is governed by the Notice of Privacy Practices rather than this general Website Privacy Policy.

Information collected automatically:

• Device and browser information: Including IP address, browser type, operating system, device identifiers, language, and approximate location derived from IP address.
• Usage information: Including pages viewed, links clicked, referring pages, dates and times, session activity, and interactions with advertisements or communications.
• Cookie and similar-technology information: Including identifiers used for analytics, attribution, fraud prevention, and advertising.

Information from other sources:

We may receive information from scheduling and payment providers, marketing and communications providers, social-media platforms, advertising and analytics partners, promotion administrators, and other service providers when permitted by law and their applicable privacy terms.

4. How We Use Personal Information

• Provide and administer appointments, purchases, gift cards, customer service, and other requested services.
• Communicate about appointments, service updates, transactions, safety, and support.
• Send promotional email, calls, or text messages when we have the consent or other legal basis required by applicable law.
• Administer sweepstakes, special offers, loyalty or VIP programs, surveys, and events.
• Understand how the Online Services are used, measure advertising performance, improve content, and personalize general website experiences.
• Perform advertising and retargeting using information collected from public website activity, subject to applicable choices and restrictions.
• Protect patients, clients, staff, the Online Services, and our business; detect fraud or misuse; and maintain security.
• Comply with legal, regulatory, licensing, tax, accounting, recordkeeping, and law-enforcement obligations and establish or defend legal claims.
• Create aggregated or deidentified information that is not reasonably capable of identifying you and use it for lawful purposes.

We do not use protected health information from medical records, clinical intake or consent forms, patient communications, treatment photographs, or patient-portal activity for targeted advertising, and we do not upload that information to advertising platforms for audience matching.

5. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients:

• Service providers: That support scheduling, payment processing, gift cards, website hosting, forms, chat, email, text messaging, cloud storage, security, analytics, advertising measurement, and business operations. Current services include Meevo, HighLevel, and Microsoft services.
• Analytics and advertising partners: These parties may receive cookie identifiers, IP addresses, device information, approximate location, and public website activity. Technologies in use may include Google Analytics, Google Ads, Google Tag Manager, Meta advertising tools, LiveRamp-related technology, and DataMoon. Their handling of information is also governed by their own privacy terms.
• Professional advisers: Including legal counsel, accountants, auditors, insurers, and compliance consultants.
• Government authorities: Or other parties when disclosure is required or permitted by law, necessary to protect health or safety, or needed to establish or defend legal rights.
• A buyer, successor, or other party: Involved in a proposed or completed merger, financing, reorganization, sale, or transfer of some or all of our business or assets, subject to appropriate safeguards.
• Other parties: At your direction or with your consent.

We do not sell personal information for money. Our use of some advertising cookies or similar technologies may be considered a "sale," "sharing," or targeted advertising under certain state privacy laws. Where those laws apply, you may exercise the applicable opt-out right as described below.

6. Cookies, Analytics, and Advertising

Cookies and similar technologies help the Online Services function, remember settings, measure traffic and advertising, and support general-interest or targeted advertising. These technologies may be categorized as essential, functional, analytics, or advertising technologies.

You can limit cookies through your browser settings. Where a cookie-preference tool is offered, you may use it to manage nonessential technologies. Disabling cookies may affect site functionality.

We process legally recognized browser-based opt-out preference signals, such as Global Privacy Control, where required by applicable law and supported by our systems. We do not currently respond to browser "Do Not Track" signals because there is no uniform industry standard for them.

7. Email, Text Messages, and Calls

If you opt in to marketing, we may send promotional email, calls, or text messages. Marketing consent is separate from consent to receive appointment or service-related communications, and marketing consent is not required to request an appointment, receive services, make a purchase, or enter a sweepstakes through a free method of entry.

For promotional text messages, message frequency varies and message and data rates may apply. Reply STOP to cancel and HELP for help. Your opt-out request may generate one confirmation message. You may unsubscribe from promotional email using the link in the message. Opting out of marketing does not prevent necessary nonmarketing communications about an existing appointment, transaction, account, or safety matter. Consent may be recorded electronically or in person and may be revoked at any time by a reasonable method.

8. Sweepstakes and Promotions

A promotion may have additional official rules that describe eligibility, entry methods, dates, prizes, odds, restrictions, and sponsor information. The official rules control if they conflict with this Policy. No purchase is necessary to enter a sweepstakes, and marketing consent is not required when a free alternative method of entry is offered. Unless the official rules state otherwise after legal review, Creations promotions are limited to eligible Florida residents age 18 or older and are void where prohibited.

9. Minors

The Online Services are intended for a general audience and are not directed to children under 13. We do not knowingly collect personal information online from a child under 13 without legally required parental consent. If you believe a child under 13 submitted personal information through the Online Services, contact us so we can review and, when appropriate, delete it.

Creations may offer facials and massage services to clients age 16 or 17 with written consent and supervision by a parent or legal guardian. Additional age restrictions may apply to medical, injectable, wellness, or other services. A parent or guardian may contact us regarding a minor's information, subject to applicable healthcare privacy laws and verification requirements.

10. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Policy, including to provide services, maintain medical and business records, document consent and opt-out requests, administer promotions, comply with legal and professional obligations, resolve disputes, and enforce agreements. Retention periods vary based on the type and sensitivity of the information, the relationship involved, legal requirements, limitation periods, and security needs. When information is no longer required, we take reasonable steps to delete, deidentify, or securely dispose of it, subject to backup cycles and lawful preservation requirements.

11. Security

We use administrative, technical, and physical safeguards designed to protect personal information. These safeguards may include access controls, restricted permissions, encryption where appropriate, workforce training, vendor oversight, backups, and incident-response procedures. No transmission or storage system can be guaranteed to be completely secure. Please do not send sensitive medical or financial information through unsecured channels.

12. Your Privacy Choices and Requests

Depending on your relationship with us and applicable law, you may ask to access, correct, or delete certain personal information, or object to certain marketing or targeted-advertising activities. These requests are subject to identity verification and legal exceptions, including obligations to maintain medical, transaction, safety, tax, consent, opt-out, and legal-claim records. We may retain a limited suppression record after an opt-out so we can honor your choice.

Residents of states with applicable comprehensive privacy laws may have additional rights, such as data portability, opting out of targeted advertising or certain disclosures, using an authorized agent, or appealing a denied request. We will respond as required by the law applicable to the verified request.

Requests concerning protected health information or medical records are governed by the Notice of Privacy Practices and applicable healthcare law. To submit a general website privacy request, contact us using Section 16.

13. Third-Party Services and Links

The Online Services may link or redirect to third-party services, including Meevo, financing services if later introduced, social networks, maps, and other websites. Information you submit directly to a third party is governed by that party's privacy policy and terms. We encourage you to review them before submitting information.

14. Accessibility

We want our privacy information and Online Services to be accessible to people with disabilities. If you need this Policy in an alternative format or need help using an online feature, contact us using Section 16. We will work to provide reasonable assistance. This accessibility contact process does not limit any rights available under applicable law.

15. Changes to This Policy

We may update this Policy to reflect changes in our practices, technologies, services, or legal obligations. We will post the revised Policy and update its effective date. If a change is material, we may provide additional notice when appropriate. Your continued use of the Online Services after an update does not waive consent or authorization requirements imposed by law.

16. Contact Us

For questions about this Website Privacy Policy, general privacy requests, or accessibility assistance, contact: