Privacy Policy for Allure Med Spa

Effective Date: 05/04/2022


Allure Med Spa (“we,” “our,” “us”) is committed to protecting your privacy and ensuring the security of your personal information. As a nurse practitioner–owned and operated medical practice, we follow all applicable federal and state privacy laws, including the Health Insurance Portability and Accountability Act (HIPAA). This Privacy Policy explains how we collect, use, protect, and disclose your information when you visit our website, contact our practice, or receive services from us.


1. Protected Health Information (PHI) & HIPAA Compliance

As a medical practice, we may collect and maintain Protected Health Information (PHI) as defined by HIPAA. PHI includes any identifiable information related to your health, treatment, or payment for services.


We follow strict policies to protect PHI by ensuring:

  • Compliance with HIPAA Privacy and Security Rules
  • Secure storage of records and patient files
  • Access only by authorized personnel
  • Encrypted systems for scheduling, charting, and communication
  • Business Associate Agreements (BAAs) with third-party vendors that handle PHI


We will never share your PHI without your written authorization unless permitted or required by law (e.g., medical emergencies, public health reporting, or court orders).


2. Information We Collect

We may collect the following types of information:

a. Personal Information

  • Name
  • Email address
  • Phone number
  • Date of birth
  • Address
  • Appointment details
  • Payment information


b. Medical/Health Information (PHI)

  • Medical history
  • Treatment records
  • Photos or videos for clinical documentation
  • Consultation details


c. Website Data

When you interact with our website, we may automatically collect:

  • IP address
  • Device type
  • Browser type
  • Pages visited


Cookies and analytics data (e.g., Google Analytics)


3. How We Use Your Information

We use personal and health information for:

  • Scheduling and managing appointments
  • Providing medical and aesthetic treatments
  • Creating and updating medical records
  • Communicating with you regarding services, follow-ups, and recommendations
  • Processing payments
  • Improving our website, services, and marketing
  • Complying with legal, regulatory, or HIPAA requirements


We may use non-PHI data for marketing purposes, such as newsletters or promotions. You may opt out at any time.


4. How We Protect Your Information

We use administrative, technical, and physical safeguards to protect your personal and medical information, including:

  • Encrypted electronic medical records (EMR)
  • Secure scheduling systems
  • HIPAA-compliant messaging portals
  • Password-protected devices and accounts
  • Limited access controls for staff
  • Encryption of stored and transmitted PHI
  • Regular staff training on HIPAA and privacy practices


5. Sharing Your Information

We do not sell or rent your information.


We may share information only with:

  • Healthcare providers involved in your care
  • Billing or reimbursement partners (at your request)
  • HIPAA-compliant service providers (e.g., EMR, CRM, texting platforms)
  • Laboratories or pharmacies (if applicable)
  • Legal authorities where required by law


All third-party partners with access to PHI sign legally required Business Associate Agreements (BAAs).


6. Patient Rights Under HIPAA

You have the right to:

  • Access your medical records
  • Request a copy of your PHI
  • Request corrections to your records
  • Request confidential communications
  • Request restrictions on how your PHI is used
  • Obtain an accounting of disclosures
  • File a complaint if you believe your privacy rights were violated


7. Website Cookies & Tracking

Our website may use cookies or analytics tools to improve user experience. Cookies do not access your medical records or PHI.


You may disable cookies in your browser settings at any time.


8. Online Forms & Communication

Any information submitted through our website forms, booking links, or contact pages is transmitted through secure, HIPAA-compliant systems when available.


However, standard email is not guaranteed to be encrypted. By choosing to contact us via email, you acknowledge these limitations.


9. Photo/Video Policy

We may request photos or videos for medical documentation or treatment planning.


These are stored securely and considered PHI unless you sign a separate release allowing their use for educational or marketing purposes.


10. Minors

We do not knowingly collect information from minors without parental or guardian consent. Parents and guardians may request access to a minor’s records as allowed by law.


11. Changes to This Policy

We may update this Privacy Policy periodically. Updated versions will be posted on our website with a revised effective date.


12. Contact Us

If you have questions about this Privacy Policy or your rights, please contact us.