Med Spas

Pursuant to the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA)

Last Updated: 03.11.2026.

This California Privacy Rights Notice supplements the Med Spas Privacy Policy and applies solely to residents of the State of California. It describes your rights under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, “CCPA/CPRA”), and explains how you can exercise those rights.

If you are a California resident and have questions about this notice or wish to submit a privacy request, please contact us at [email protected].

1. Personal Information We Collect

As described in our Privacy Policy, we collect personal information from your interactions with us, our website, and our services — including through cookies and similar tracking technologies. Over the past 12 months, we have collected the following categories of personal information:

Identifiers — name, email address, phone number, IP address, and online identifiers
Personal records — billing address, appointment history, and payment confirmation details
Commercial information — services requested or received, booking history, and purchase records
Sensitive personal information — health and medical history, including information you provide on intake forms, consent documents, and in consultation with our practitioners
Internet or network activity — pages visited, links clicked, browser type, and interaction with our website and digital communications
Geolocation data — approximate location derived from IP address or, where permitted, device GPS data
Inferences — preferences and interests inferred from the above information to personalize your experience

2. How We Use Personal Information

We use the personal information described above for the following business and commercial purposes:

Providing, scheduling, and delivering aesthetic and wellness services
Processing payments and managing your account
Communicating with you about appointments, aftercare, and service updates
Sending promotional communications and special offers (with your consent; you may opt out at any time)
Improving our website, booking platform, and client experience through analytics
Complying with legal and regulatory obligations, including medical recordkeeping requirements
Detecting and preventing fraudulent or unauthorized activity
Serving targeted advertising on our website and third-party platforms based on your browsing and interaction history

3. Sharing & “Sale” of Personal Information

We may share your personal information with third parties for business purposes, as described in our Privacy Policy. Under the CCPA/CPRA, certain sharing of personal information with advertising and marketing partners — including through cookies and device-based identifiers — may be classified as a “sale” or “sharing” of personal information, even if no money changes hands.

What We May Sell or Share

Over the past 12 months, we may have sold or shared the following categories of personal information with advertising and marketing partners for the purpose of targeted advertising:

Identifiers (e.g., cookie IDs, device identifiers, IP addresses)
Internet or network activity (e.g., pages viewed, links clicked, browsing behavior on our site)
Commercial information (e.g., services browsed or booked)
Inferences drawn from the above

What We Do Not Sell or Share

We do not sell or share the following categories of personal information:

Sensitive personal information, including health and medical records
Personal information of individuals we know to be under 16 years of age
Financial account details or payment card information

Categories of Third Parties

Personal information may be shared with:

Digital advertising networks and platforms (e.g., Google, Meta/Facebook, Instagram)
Analytics providers (e.g., Google Analytics)
Social media platforms for integration and retargeting purposes

4. Your California Privacy Rights

If you are a California resident, you have the following rights under CCPA/CPRA. These rights are subject to certain exceptions and limitations permitted by applicable law.

Your Right	What It Means	How to Exercise It
Right to Know / Access	Request details about what personal information we collect, use, disclose, and sell about you.	Submit a verifiable consumer request to [email protected]
Right to Delete	Request deletion of personal information we have collected from you, subject to certain exceptions.	Submit a verifiable consumer request to [email protected]
Right to Correct	Request correction of inaccurate personal information we maintain about you.	Contact us at [email protected] with the corrected information.
Right to Opt Out of Sale / Sharing	Direct us not to sell or share your personal information for cross-context behavioral advertising.	Use the “Do Not Sell or Share My Personal Information” link on our website, or email [email protected]
Right to Limit Use of Sensitive Information	Direct us to limit the use and disclosure of sensitive personal information (including health data) to only what is necessary to provide our services.	Contact us at [email protected]
Right to Non-Discrimination	We will not discriminate against you for exercising any of your privacy rights.	No action required — this right is automatic.

5. How to Opt Out of Sale or Sharing

You have the right to opt out of the sale or sharing of your personal information for targeted advertising at any time. You can exercise this right through any of the following methods:

Option 1 — Website Opt-Out Link

Click the “Do Not Sell or Share My Personal Information” link located in the footer of our website. This will allow you to opt out of cookie-based tracking and advertising for the device and browser you are using.

Option 2 — Global Privacy Control (GPC)

If your browser or browser extension is configured with the Global Privacy Control (GPC) opt-out preference signal, we will treat this as a request to opt out of the sale or sharing of your personal information for the device and browser used to visit our site. For information on enabling GPC, visit globalprivacycontrol.org.

Option 3 — Email Request

Send a written opt-out request to [email protected] with the subject line “California Opt-Out Request.” Please include your name, email address, and any relevant account information so we can process your request accurately.

Please note that opting out of the sale or sharing of personal information applies to cookie-based and device-identifier-based advertising. It does not affect the collection of personal information necessary to provide our services or fulfill our legal obligations.

6. Submitting a Verifiable Consumer Request

To exercise your Right to Know, Right to Delete, or Right to Correct, you must submit a verifiable consumer request. We are required to verify your identity before fulfilling your request to protect your privacy and security.

How to Submit

Email: [email protected] — include “California Privacy Request” in the subject line
Include your full name, email address, phone number (if applicable), and a description of your request

Verification Process

We will ask you to provide information that allows us to verify your identity, such as confirming the email address associated with your account or matching other identifying details we have on file. We will not use the information you provide for verification for any purpose other than processing your request.

Response Timeline

We will acknowledge receipt of your request within 10 business days and provide a substantive response within 45 calendar days of receiving it. If we require additional time (up to 90 days total), we will notify you in writing.

Authorized Agents

You may designate an authorized agent to submit a request on your behalf. The agent must provide written proof of your authorization, and we may require you to verify your identity directly with us before processing the request.

7. Sensitive Personal Information

Under CPRA, certain categories of personal information are classified as “sensitive,” including health and medical information, biometric data, and precise geolocation. Med Spas collects sensitive personal information (specifically health history and treatment records) solely for the purpose of providing safe, personalized aesthetic services.

We do not use sensitive personal information to infer characteristics about you, and we do not sell or share it for advertising purposes. You have the right to request that we limit our use and disclosure of your sensitive personal information to only what is necessary to provide the services you have requested. To exercise this right, contact us at [email protected].

8. Financial Incentives

Med Spas does not offer financial incentives, discounts, or different levels of service in exchange for the collection, retention, or sale of your personal information. We will not discriminate against you for exercising any of your California privacy rights.

9. Other California Privacy Notices

“Shine the Light” Law (California Civil Code § 1798.83)

California residents may request information about personal information we have disclosed to third parties for their direct marketing purposes during the preceding calendar year. If applicable, you may submit this request by emailing [email protected] with the subject line “Shine the Light Request.”

Minors (Under 16 Years of Age)

We do not knowingly sell or share the personal information of consumers under 16 years of age. If you are between 13 and 15 years old, we will not sell or share your personal information for targeted advertising without your explicit opt-in consent. If you are under 13, a parent or guardian must opt in on your behalf.

10. Changes to This Notice

We may update this California Privacy Rights Notice from time to time. When we make material changes, we will revise the “Last Updated” date and post the updated notice on our website. We encourage California residents to review this notice periodically.

11. Contact Us

For questions, requests, or concerns related to this California Privacy Rights Notice, please contact:

Med Spas — Privacy Office

Email: [email protected]

Website: Med Spas