Privacy Policy

1Information We Collect

a. Information you provide directly

When you contact us, book an appointment, or receive services, we may collect:

• Name, email address, and phone number
• Appointment history and service preferences
• Client intake information, including relevant skin history, allergies, medications, and treatment notes collected through Boulevard
• Payment information processed through Boulevard's payment system
• Photos taken before/after treatments, where applicable, for your treatment records

b. Information collected automatically

Our Website is hosted on Squarespace and may automatically collect non-personally identifiable information, such as IP address, browser type, and general site usage. See Section 7 for details on cookies and tracking.

2Marketing Communications

We may use your name, email address, and phone number to send you information about promotions, new services, treatment reminders, or educational content related to Skin Society.

• Email: Every marketing email includes an unsubscribe link. You may opt out at any time.
• Text messages: Appointment confirmations and reminders are sent as part of our booking service through Boulevard. If we send promotional text messages, we will only do so with your express consent, and you may reply STOP at any time to opt out.

We do not sell your personal information, and we do not share your contact information with third parties for their own independent marketing purposes.

3Third-Party Services

We rely on trusted third-party providers to operate our business. These providers process information on our behalf:

• Boulevard — our appointment scheduling, payment processing, and client management platform. Boulevard processes your booking details, intake forms, and payment information. See Boulevard's Privacy Policy for details on their data practices.
• Squarespace — our website hosting provider. See Squarespace's Privacy Policy.

We do not control these providers' infrastructure or uptime and are not liable for technical issues or data handling that occurs outside our direct control, though we select providers who maintain industry-standard security practices.

4New York SHIELD Act & Data Security

As a New York business, we comply with the Stop Hacks and Improve Electronic Data Security (SHIELD) Act. Under the SHIELD Act, we:

• Maintain a data security program with reasonable administrative, technical, and physical safeguards appropriate to the size and complexity of our business
• Treat “private information” — including names combined with Social Security numbers, financial account numbers, biometric data, and medical or health information such as treatment history, conditions, and diagnoses — as protected data requiring heightened security
• Will notify affected New York residents and, where required, state regulators in the event of a data breach involving private information, within the timeframe required by New York law

5Health Information & HIPAA

Skin Society Medspa is not a HIPAA-covered entity. We do not bill insurance or transmit claims electronically, and the health-related information we collect (such as skin history or allergies noted on intake forms) is used solely to provide safe, informed treatment — it is not governed by HIPAA. We nonetheless treat this information as sensitive and protect it consistent with the SHIELD Act's heightened standards for medical information described in Section 4.

6Data Retention

We retain client intake forms, treatment records, and appointment history for as long as necessary to provide safe ongoing care, maintain business records, and comply with applicable recordkeeping obligations. Marketing contact information is retained until you opt out or request deletion.

7Cookies and Tracking Technologies

Our Website, through Squarespace, may use cookies and similar tracking technologies to recognize returning visitors, understand site usage, and improve performance. You can control or disable cookies through your browser settings, though this may affect certain site features.

8Your Privacy Choices

You may contact us at any time to:

• Unsubscribe from marketing emails or texts
• Request a copy of the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your information, subject to our recordkeeping obligations for treatment records

To exercise any of these choices, contact us using the information in Section 11.

9Changes to This Policy

We may update this Privacy Policy from time to time. Changes are effective immediately upon posting to this page, and your continued use of the Website after changes are posted constitutes acceptance of the updated policy.

10Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the State of New York, USA, without regard to conflict of law principles.

11Contact Us

If you have questions or concerns about this Privacy Policy, please contact us at: