Privacy Policy.

Effective Date: May 15, 2026     |     Last Updated: May 15, 2026

Your privacy matters to us. This Policy explains — in plain language — exactly what information we collect, why we collect it, how we protect it, and the rights you have over it as a California resident. If you have any questions at all, please reach out to us directly. We're happy to help.

1.  Scope of This Privacy Policy

This Privacy Policy applies to:

• Our website at www.skinbeamaesthetics.com and any subdomains
• Our online booking portal and patient intake forms
• In-office collection of personal and health information
• Electronic communications (email, text/SMS, social media messaging)
• Our Beauty Bank Membership program and product purchases

This Policy does not apply to third-party websites linked from our site. We encourage you to review the privacy policies of any external sites you visit.

2.  Information We Collect

We collect information in the following categories, depending on how you interact with us:

A. Information You Provide Directly

• Identity & Contact Information — full name, date of birth, email address, phone number, mailing address
• Health & Medical Information — medical history, current medications, allergies, prior aesthetic treatments, treatment photos (before/after)
• Payment Information — credit/debit card numbers, billing address (processed securely through our payment processor; we do not store full card numbers)
• Appointment & Service Records — services received, treatment notes, provider observations, follow-up records
• Communications — emails, texts, voicemails, social media messages, and feedback you send to us
• Consent & Intake Forms — signed consents, health questionnaires, membership agreements

B. Information Collected Automatically (Website)

• Device & Technical Data — IP address, browser type, operating system, device identifiers
• Usage Data — pages visited, links clicked, time on site, referring URL, session duration
• Cookies & Tracking Technologies — see Section 7 (Cookies) for full details
• Location Data — approximate geographic location derived from your IP address

C. Information from Third Parties

• Booking Platforms — appointment data from our online scheduling system
• Payment Processors — transaction confirmation and fraud-prevention signals
• Financing Partners — application status and approval information from payment plan providers
• Social Media — if you interact with us on Instagram, TikTok, or other platforms, we may receive publicly available information and messages you send us

3.  How We Use Your Information

We use your information only for legitimate purposes related to providing you with care and running our business. Specifically, we use it to:

Providing & Improving Care

• Schedule, confirm, and manage your appointments
• Conduct consultations and deliver safe, personalized treatments
• Maintain accurate medical and treatment records
• Send pre- and post-treatment care instructions
• Follow up on your results and address any concerns

Business Operations

• Process payments and manage your account
• Administer the Beauty Bank Membership program
• Communicate with you about your appointments, products, and services
• Manage our internal records, analytics, and quality improvement
• Comply with legal, regulatory, and professional obligations

Marketing & Communications

• Send promotional emails, newsletters, and special offers — only if you have opted in
• Send appointment reminders and transactional notifications. You may opt out of SMS by replying STOP; contact the team to arrange another way to receive appointment information.
• Post social media content, including patient photos — only with your explicit written consent

We do not sell your personal information. We do not use your health information for marketing without your separate written consent.

4.  Legal Basis for Processing

Under California law, we process your information based on one or more of the following:

• Performance of a Contract — to book your appointment, deliver your treatment, and fulfill membership or purchase agreements
• Legal Obligation — to comply with California healthcare regulations, tax laws, professional licensing requirements, and other applicable law
• Legitimate Interests — to operate and improve our business, prevent fraud, and ensure the security of our systems
• Your Consent — for optional activities such as marketing communications, photography, and certain data sharing

Where we rely on your consent, you may withdraw it at any time by contacting us (see Section 12). Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

5.  How We Share Your Information

We share your personal information only as described below. We do not sell your personal information to third parties.

Service Providers (Data Processors)

We share information with trusted vendors who help us operate our business, under written agreements requiring them to protect your data:

• Electronic health records (EHR) and practice management software
• Online booking and scheduling platforms
• Payment processors and point-of-sale systems
• Payment plan / financing partners
• Email and SMS communication platforms
• Website hosting, analytics, and security providers
• Skinbetter Science (for product order fulfillment)

Healthcare & Professional Partners

• Other healthcare providers involved in your care, with your knowledge
• Our supervising medical director or collaborating physicians, as required by California law

Legal & Regulatory Disclosures

We may disclose your information when required by law, including:

• In response to a valid subpoena, court order, or government request
• To comply with California Department of Public Health or Medical Board reporting requirements
• To prevent or investigate fraud, security incidents, or illegal activity
• To protect the rights, safety, or property of Skinbeam Aesthetics, our patients, or the public

Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business, your information may be transferred as part of that transaction. We will notify you of any such change and any new privacy practices.

With Your Consent

We may share your information for any other purpose with your explicit written consent.

6.  Health Information & HIPAA

Skinbeam Aesthetics takes the privacy of your health information seriously. To the extent our services constitute healthcare subject to the Health Insurance Portability and Accountability Act (HIPAA), we comply with HIPAA's Privacy Rule, Security Rule, and Breach Notification Rule.

Your Protected Health Information (PHI) — including medical history, treatment records, and before/after photos — is:

• Accessible only to authorized staff and providers involved in your care
• Stored in secure, encrypted systems with access controls
• Never sold or disclosed for marketing without your specific written authorization
• Retained in accordance with California's medical records retention requirements (minimum 7 years for adult patients; until age 19 for minors)

If we are required to provide you with a HIPAA Notice of Privacy Practices, we will do so at your first visit or upon request. You may request an accounting of disclosures of your PHI at any time.

7.  Cookies & Tracking Technologies

Our website uses cookies and similar technologies to function properly and to help us understand how visitors use our site.

Types of Cookies We Use

• Strictly Necessary Cookies — required for the website to function (e.g., session management, booking portal). These cannot be disabled.
• Analytics Cookies — help us understand traffic patterns and improve our website (e.g., Google Analytics). Analytics may involve device identifiers and usage information; the actual configuration and privacy choices require confirmation before launch.
• Functional Cookies — remember your preferences to improve your experience.
• Marketing/Tracking Cookies — may be placed by third-party platforms (e.g., Instagram pixel, Meta pixel) if you have consented to targeted advertising.

Your Cookie Choices

You may manage or disable non-essential cookies through your browser settings or a cookie consent banner on our website. Note that disabling certain cookies may affect website functionality.

California residents also have the right to opt out of the "sale" or "sharing" of personal information collected through cookies for cross-context behavioral advertising — see Section 9 for how to exercise this right.

Do Not Track

California's Online Privacy Protection Act (CalOPPA) requires us to disclose how we respond to "Do Not Track" (DNT) signals. Our website does not currently respond to DNT browser signals; however, you may use the opt-out mechanisms described in Section 9 to limit tracking.

8.  Data Security

We implement reasonable and appropriate technical, administrative, and physical safeguards to protect your personal information from unauthorized access, disclosure, alteration, or destruction, including:

• Encryption of data in transit (TLS/SSL) and at rest where applicable
• Access controls and role-based permissions for staff
• Secure, password-protected systems and devices
• Staff training on privacy and data security practices
• Regular review of our security practices

No system is 100% secure. If you have reason to believe your information has been compromised, please contact us immediately. If a breach requires notification, we will provide the notices required by applicable law within the applicable deadlines.

9.  Your California Privacy Rights

As a California resident, you have significant rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). Here is what you're entitled to — in plain terms.

Right to Know

You have the right to request that we disclose, for the 12-month period prior to your request:

• The categories and specific pieces of personal information we have collected about you
• The categories of sources from which we collected your information
• The business or commercial purposes for collecting or sharing your information
• The categories of third parties with whom we share your information

Right to Delete

You have the right to request deletion of personal information we have collected about you, subject to certain exceptions (e.g., information we are required to retain by law, or information necessary to complete a transaction you requested).

Right to Correct

You have the right to request that we correct inaccurate personal information we hold about you.

Right to Opt Out of Sale or Sharing

We do not sell personal information for money. However, if we use cookies or advertising pixels that constitute "sharing" personal information for cross-context behavioral advertising, you have the right to opt out. You may do so by:

• Clicking the "Do Not Sell or Share My Personal Information" link on our website (if applicable)
• Adjusting your browser settings or using an opt-out preference signal (such as the Global Privacy Control)
• Contacting us directly at helloskinbeam@gmail.com

Right to Limit Use of Sensitive Personal Information

Under the CPRA, you have the right to limit our use and disclosure of sensitive personal information (which includes precise geolocation, health data, and certain other categories) to only what is necessary to provide the services you requested.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights. This means we will not deny you services, charge you different prices, or provide a different quality of service because you exercised your rights under California law.

How to Submit a Request

To exercise any of the rights above, please contact us using one of the following methods:

• Email: helloskinbeam@gmail.com
• Phone: (619) 853-5781
• In person at our office in Orange, CA

We will verify your identity before processing your request and respond within 45 days. We may extend this period by an additional 45 days when reasonably necessary, with advance notice. We will provide responses without charge as required by applicable law.

Authorized Agents

You may designate an authorized agent to submit requests on your behalf. The agent must provide written proof of authorization, and we may contact you directly to verify the request.

10.  Children's Privacy

Our website and services are not directed to children under 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent.

For patients between 13 and 17 years of age, a parent or legal guardian must be present at all appointments and must provide written consent for any treatment. We will collect parental contact information and include it in the patient record.

If you believe we have inadvertently collected information from a minor without proper consent, please contact us immediately and we will take steps to delete it.

11.  Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law:

• Medical and treatment records: minimum 7 years after the last date of service for adults; until the patient's 19th birthday or 7 years (whichever is longer) for minors — per California Health & Safety Code § 123111
• Financial and payment records: 7 years, as required for tax and accounting purposes
• Marketing communications preferences: until you opt out or request deletion
• Website analytics data: typically 26 months (per our analytics provider's settings)
• Security and fraud-prevention logs: up to 2 years

When your information is no longer needed and no legal obligation requires retention, we securely destroy or anonymize it.

12.  Your Choices & How to Contact Us

Marketing Opt-Out

You may unsubscribe from marketing emails at any time by clicking the "Unsubscribe" link at the bottom of any marketing email, or by contacting us directly. You may opt out of SMS marketing by replying STOP to any marketing text message.

Replying STOP opts you out of the SMS messaging service. Contact the team to arrange another way to receive appointment information.

Updating Your Information

If your contact information or health history changes, please let us know so we can keep your records accurate. You may update your information in person, by phone, or by emailing us.

Contact Us About Privacy

For any privacy-related questions, requests, or concerns, please contact our Privacy Contact:

Skinbeam Aesthetics — Privacy Contact

Email: helloskinbeam@gmail.com

Phone: (619) 853-5781

Address: 665 N Tustin St, Unit A, Suite 126, Orange, CA 92867

Website: www.skinbeamaesthetics.com

13.  Third-Party Links & Social Media

Our website may contain links to third-party websites, including our booking platform, financing partners, product store, and social media profiles (Instagram, TikTok). These sites have their own privacy policies, and we are not responsible for their practices. We encourage you to review their policies before providing any personal information.

When you interact with our social media pages (e.g., liking, commenting, messaging), those interactions are also subject to the platform's privacy policy (Meta, TikTok, etc.).

14.  Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or applicable law. When we make material changes, we will:

• Update the "Last Updated" date at the top of this document
• Post the revised Policy on our website
• Notify active patients by email or in person at their next visit, for significant changes

Your continued use of our website or services after an update constitutes your acknowledgment of the revised Policy. We encourage you to review this page periodically.

15.  Additional California-Specific Disclosures

Shine the Light (California Civil Code § 1798.83)

California residents may request information about personal information we have disclosed to third parties for their direct marketing purposes in the prior calendar year. We do not share personal information with third parties for their own direct marketing purposes without your consent. To make a request, contact us at the address in Section 12.

California Online Privacy Protection Act (CalOPPA)

In compliance with CalOPPA, this Privacy Policy is posted on our homepage and clearly identifies the categories of information we collect and the parties with whom it is shared. California users may request changes to their personal information by contacting us as described in Section 12.

California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA)

Your full CCPA/CPRA rights are described in Section 9. The chart below summarizes the categories of personal information we have collected and disclosed in the last 12 months:

We do not sell personal information. We do not use or disclose sensitive personal information beyond what is necessary to provide our services.

Questions About This Policy?

We are committed to transparency and to protecting your privacy. If anything in this Policy is unclear, or if you would like to exercise any of your rights, please don't hesitate to contact us:

helloskinbeam@gmail.com (619) 853-5781  |  www.skinbeamaesthetics.com

Thank you for trusting Skinbeam Aesthetics with your care. ✨