Key West Med Spa, PLLC Privacy Notice
At Key West Med Spa, PLLC ("we," "us," or "our"), we value the privacy of individuals who use our websites and related services (collectively, our "Services"). This Privacy Notice explains how we collect, use, share, and protect the personal information of users of our Services ("users," "you," or "your"). By using our Services, you agree to the collection, use, disclosure, and processing of your information as described in this Privacy Notice.
Personal information is information that identifies or could be used to identify a specific person. Personal information does not include deidentified information (anonymized or pseudonymized) or aggregated information derived from personal information.
We may collect a variety of personal information and other information about you or your devices from various sources, as described below. As a medical spa providing health-related services, we are a covered entity under the Health Insurance Portability and Accountability Act (HIPAA). If we collect or handle protected health information (PHI) about you—such as medical history, treatment details, or health records—this is governed by our Notice of Privacy Practices (outlined in a dedicated section below). Our general Privacy Notice applies to non-PHI personal information, but where PHI is involved, HIPAA requirements take precedence.
Information We Collect
Information You Provide to Us
- Registration Information. If you sign up for an account, register to use our Services, or sign up for emails or other updates, we may ask you for basic contact information, such as your name, email address, phone number, and/or mailing address. We may also collect certain demographic information when you register for our Services, including your age, gender, personal interests, income, and/or marital status.
- Communications. If you contact us directly, we may collect additional information from you. For example, when you reach out to our customer support team, we may ask for your name, email address, mailing address, phone number, or other contact information so that we can verify your identity and communicate with you. We may also store the contents of any message or attachments that you send to us, as well as any information you submit through any of our forms or questionnaires.
- Events. If you register for an event that we host, whether in-person or online, we may collect relevant information such as your name, address, title, company, phone number, or email address, as well as specific information relevant to the event for which you are registering.
- User Content. We may allow you and other users of our Services to share their own content with others. This may include posts, comments, reviews, or other user-generated content. Unless otherwise noted when creating such content, this information may be shared publicly through our Services.
Information We Collect Automatically
When you access or use our Services, we may automatically collect certain information about your device, browsing actions, and patterns, including:
- Details of your visits to our website, such as traffic data, location data, logs, and other communication data.
- Information about your computer or mobile device, including IP address, browser type, operating system, unique device identifiers, and mobile network information.
- Usage details, such as pages viewed, time spent on pages, links clicked, and referring/exit pages. We collect this information using technologies like cookies, web beacons, pixels, and similar tracking tools. For example, we may use Google Analytics or similar services to analyze trends and administer the site. You can manage your cookie preferences through your browser settings, but disabling cookies may limit some features of our Services.
Protected Health Information (PHI)
If you receive medical or health-related services from us, we may collect PHI, such as your medical history, treatment records, test results, insurance information, or before-and-after photos. This is collected during consultations, treatments, or through patient intake forms and is handled in compliance with HIPAA. See our Notice of Privacy Practices below for details.
How We Use Your Information
We use the personal information we collect for the following purposes:
- To provide, maintain, and improve our Services, including processing registrations, scheduling appointments, and delivering treatments.
- To communicate with you, such as sending appointment reminders, newsletters, promotional offers, or responding to inquiries.
- To process payments and billing.
- To analyze usage trends, conduct research, and enhance user experience.
- For marketing and advertising, including personalized recommendations based on your interests.
- To comply with legal obligations, enforce our terms, or protect our rights, property, or safety.
- For health care operations, such as quality assessment or administrative activities (for PHI, as permitted under HIPAA).
We may combine information from different sources to achieve these purposes.
How We Share Your Information
We do not sell your personal information. However, we may share it in the following ways:
- With Service Providers: We share information with third-party vendors who perform services on our behalf, such as payment processors, email service providers, IT support, or analytics tools. These providers are contractually obligated to protect your information and use it only for the services they provide.
- With Affiliates and Business Partners: We may share information with affiliated companies or partners for joint marketing or operational purposes.
- For Legal Reasons: We may disclose information if required by law, such as in response to a subpoena, court order, or government request, or to protect against fraud, security issues, or legal claims.
- In Business Transfers: If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.
- Publicly: User-generated content (e.g., reviews) may be visible to others unless specified otherwise. For PHI, sharing is strictly limited as described in our Notice of Privacy Practices below. We require all recipients to maintain the confidentiality and security of shared information.
Data Security
We implement reasonable administrative, technical, and physical safeguards to protect your personal information from unauthorized access, use, alteration, or destruction. These measures include encryption for data in transit and at rest, access controls, regular security audits, and employee training. However, no method of transmission over the internet or electronic storage is completely secure, so we cannot guarantee absolute security. In the event of a data breach involving PHI, we will notify affected individuals as required by HIPAA.
Your Rights and Choices
You have certain rights regarding your personal information, subject to applicable laws:
- Access and Correction: You may request access to or correction of your personal information.
- Deletion: You may request deletion of your information, though we may retain certain data for legal or operational reasons.
- Opt-Out: You can opt out of marketing communications by clicking the unsubscribe link in emails or contacting us. You may also opt out of certain cookies via browser settings.
- Do Not Sell/Share: We do not sell personal information, but if applicable under laws like the California Consumer Privacy Act (CCPA), you can request details on sharing. For PHI, additional rights apply under HIPAA (see Notice of Privacy Practices below). To exercise these rights, contact us using the information below. We will respond within a reasonable timeframe, typically 30-45 days, and may require identity verification.
Children's Privacy
Our Services are not intended for children under the age of 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent, in compliance with the Children's Online Privacy Protection Act (COPPA). If we become aware that we have collected such information, we will delete it promptly. If you believe a child under 13 has provided us with information, please contact us.
Notice of Privacy Practices (HIPAA)
This section serves as our Notice of Privacy Practices under HIPAA and describes how we may use and disclose your protected health information (PHI) and your rights regarding that information. Please review it carefully.
Uses and Disclosures of PHI
We may use or disclose your PHI without your authorization for:
- Treatment: To provide, coordinate, or manage your health care, such as sharing with physicians or specialists involved in your care.
- Payment: To bill and collect payment for services, including sharing with your insurance provider.
- Health Care Operations: For internal activities like quality assessment, auditing, training staff, or business planning. Other uses and disclosures require your written authorization, which you may revoke at any time. We may also disclose PHI as required by law (e.g., for public health reporting, abuse notifications, or court orders).
Your Rights Regarding PHI
- Access: You have the right to inspect and obtain a copy of your PHI (fees may apply for copies).
- Amendment: You may request corrections to inaccurate or incomplete PHI.
- Accounting of Disclosures: You can request a list of certain disclosures made of your PHI.
- Restrictions: You may request restrictions on uses/disclosures, though we are not always required to agree.
- Confidential Communications: You can request alternative communication methods (e.g., a different address).
- Copy of This Notice: You are entitled to a paper copy of this notice.
Our Responsibilities
We are required to maintain the privacy of your PHI, provide this notice, abide by its terms, and notify you of any changes. In case of a breach of unsecured PHI, we will notify you within 60 days.
Complaints
If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights. We will not retaliate against you for filing a complaint.
Changes to This Notice
We may update this Privacy Notice from time to time to reflect changes in our practices or legal requirements. We will post the revised notice on our website with the effective date. We encourage you to review it periodically. For material changes, we may provide additional notice, such as via email.
Contact Information
If you have questions about this Privacy Notice, our Notice of Privacy Practices, or wish to exercise your rights, please contact our Privacy Officer at:
- Email: info@keywestmedspa@gmail.com
- Phone: [Insert Phone Number]
- Mailing Address: Key West Med Spa, PLLC, 911 Virginia Street, Key West, FL 33040
Effective Date: March 10, 2026