Notice of Privacy Practices (HIPAA)

Effective Date: Jan 10, 2025

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

At Alluring Image Medspa, we are required by federal law to maintain the privacy of your Protected Health Information (PHI) and to provide you with this clear notice of our legal duties and privacy practices.

Permitted Uses and Disclosures of PHI We use and disclose your PHI without your explicit written authorization only for the following essential healthcare activities:

For Treatment: To manage and coordinate your medical spa treatments (e.g., assessing medical history prior to injectables or advanced laser therapies).

For Payment: To process transaction invoices, billing, or third-party financing approvals for services rendered.

For Healthcare Operations: For internal quality assessments, staff training, scheduling software operations, and compliance audits.

Disclosures Requiring Explicit Written Authorization We will never use or disclose your PHI for the following purposes without obtaining your explicit, signed, written consent:

Displaying before-and-after photographs on our website or social media channels.

Publishing patient testimonials that reveal personal health attributes.

Utilizing your clinical information for targeted promotional marketing.

Selling your personal or health data to any external entities.

Your Patient Rights Under HIPAA You hold the following federally protected rights regarding your medical files:

Right of Access: The right to inspect and obtain electronic or paper copies of your medical and billing records.

Right to Amend: The right to request a correction to your records if you believe the information is inaccurate or incomplete.

Right to Restrict: The right to request a restriction on certain disclosures of your PHI to health plans if you pay for the service completely out-of-pocket.

Right to Confidentiality: The right to request that we only contact you via preferred methods (e.g., text vs. email) or at alternate locations.

Breach Notification In the highly unlikely event that a data breach occurs compromising the security or confidentiality of your unsecured PHI, we are legally required to notify you immediately with details of the event and corrective actions taken.

Filing a Complaint If you believe your privacy rights have been violated, you may file a formal complaint with our practice or directly with the Secretary of the U.S. Department of Health and Human Services (HHS). We maintain a strict zero-retaliation policy for filed complaints.