Privacy Policy

01 Scope of This Policy and Acceptance

This Privacy Policy applies only to information we collect through our Website and other online services that link to this Privacy Policy, together referred to as the Service. It does not apply to information collected offline, through any other channel, or by any third party, including through any third-party application or website that may link to or be accessible from the Service.

This Privacy Policy is provided for informational purposes to describe our information practices and your choices. It is not a contract and does not create contractual rights or obligations. If you do not agree with this Privacy Policy, please discontinue your use of the Service.

02 Notice Regarding Health Information and HIPAA

VIOSA Aesthetics MD may be a covered entity under the Health Insurance Portability and Accountability Act of 1996, as amended, together with its implementing regulations, collectively referred to as HIPAA. To the extent we collect, create, receive, maintain, or transmit protected health information, referred to as PHI, in connection with providing health care or processing health-care transactions, that PHI is governed by HIPAA and by our separate Notice of Privacy Practices, and not by this Privacy Policy. If there is any conflict between this Privacy Policy and our Notice of Privacy Practices with respect to PHI, the Notice of Privacy Practices controls.

Information you submit through general features of the Website, such as contact forms, appointment requests, or account registration, may not constitute PHI and may be governed by this Privacy Policy. Please do not transmit detailed medical information through the Website unless you are expressly directed to do so through a secure, designated channel.

03 Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

• Account means a unique account created for you to access our Service or parts of our Service.
• Company, referred to as either the Company, We, Us, or Our in this Privacy Policy, refers to VIOSA Aesthetics MD, located at 9301 Tampa Ave., Space 565, Suite 145, Northridge, CA 91324.
• Cookies are small files placed on your computer, mobile device, or any other device by a website, containing details of your browsing history on that website among many other uses.
• Country refers to the State of California, United States.
• Device means any device that can access the Service, such as a computer, a cellphone, or a digital tablet.
• Personal Data is any information that relates to an identified or identifiable individual.
• Service refers to the Website.
• Service Provider means any natural or legal person who processes data on behalf of the Company. It refers to third-party companies or individuals we employ to facilitate the Service, to provide the Service on our behalf, to perform services related to the Service, or to assist us in analyzing how the Service is used.
• Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself, for example the duration of a page visit.
• Website refers to VIOSA Aesthetics MD, accessible from https://www.viosamd.com.
• You means the individual accessing or using the Service, or the company or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.
• Affiliate means an entity that controls, is controlled by, or is under common control with the Company, where control means ownership of 50 percent or more of the shares, equity interest, or other securities entitled to vote for election of directors or other managing authority.
• HIPAA means the Health Insurance Portability and Accountability Act of 1996, as amended, together with its implementing regulations, including the Privacy, Security, and Breach Notification Rules.
• Protected Health Information, or PHI, means individually identifiable health information that is created, received, maintained, or transmitted by or on behalf of the Company and that is protected under HIPAA.
• Sensitive Personal Information means Personal Data that reveals or includes, among other things, health or medical information, precise geolocation, racial or ethnic origin, financial account information, government identifiers, or other categories treated as sensitive under applicable privacy laws, and that is subject to additional protections.
• Consumer Health Data means Personal Data that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status, including information relating to health conditions, treatments, or any health-related services sought or received, as defined under applicable state consumer-health-data laws.
• Sale means, as defined under applicable state privacy laws, the disclosure of Personal Data to a third party in exchange for monetary or other valuable consideration.
• Sharing or Targeted Advertising means, as defined under applicable state privacy laws, the disclosure or use of Personal Data for cross-context behavioral or targeted advertising.

04 Collecting and Using Your Personal Data

Personal Data

While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you. Personally identifiable information may include, but is not limited to:

• Email address
• First name and last name
• Phone number
• Address, state, province, ZIP or postal code, and city
• Usage Data

Usage Data

Usage Data is collected automatically when using the Service. Usage Data may include information such as your device's Internet Protocol address, browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers, and other diagnostic data.

When you access the Service by or through a mobile device, we may collect certain information automatically, including the type of mobile device you use, your mobile device unique ID, the IP address of your mobile device, your mobile operating system, the type of mobile internet browser you use, unique device identifiers, and other diagnostic data. We may also collect information that your browser sends whenever you visit our Service.

05 Tracking Technologies and Cookies

We use cookies and similar tracking technologies to track activity on our Service and store certain information. Tracking technologies used include beacons, tags, and scripts to collect and track information and to improve and analyze our Service. The technologies we use may include:

• Cookies or Browser Cookies. A cookie is a small file placed on your device. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some parts of our Service.
• Flash Cookies. Certain features of our Service may use local stored objects to collect and store information about your preferences or your activity on our Service. Flash cookies are not managed by the same browser settings used for browser cookies.
• Web Beacons. Certain sections of our Service and our emails may contain small electronic files known as web beacons, also referred to as clear gifs, pixel tags, and single-pixel gifs, that permit us, for example, to count users who have visited those pages or opened an email and for other related website statistics.

Cookies can be persistent or session cookies. Persistent cookies remain on your device when you go offline, while session cookies are deleted as soon as you close your web browser. We use both session and persistent cookies for the purposes set out below:

• Necessary and Essential Cookies. Session cookies administered by us. These cookies are essential to provide you with services available through the Website and to enable you to use some of its features. They help authenticate users and prevent fraudulent use of user accounts. Without these cookies, the services you have asked for cannot be provided.
• Notice Acceptance Cookies. Persistent cookies administered by us. These cookies identify whether users have accepted the use of cookies on the Website.
• Functionality Cookies. Persistent cookies administered by us. These cookies allow us to remember choices you make when you use the Website, such as remembering your login details or language preference, so you do not have to re-enter your preferences every time you visit.

For more information about the cookies we use and your choices regarding cookies, please contact us using the information in the Contact Us section below.

06 Use of Your Personal Data

We may use Personal Data for the following purposes:

• To provide and maintain our Service, including to monitor the usage of our Service.
• To manage your Account, meaning to manage your registration as a user of the Service. The Personal Data you provide can give you access to different functionalities of the Service that are available to you as a registered user.
• For the performance of a contract, meaning the development, compliance, and undertaking of the purchase contract for the products, items, or services you have purchased, or of any other contract with us through the Service.
• To contact you by email, telephone calls, SMS, or other equivalent forms of electronic communication regarding updates or informative communications related to the functionalities, products, or contracted services, including security updates, when necessary or reasonable for their implementation.
• To provide you with news, special offers, and general information about other goods, services, and events which we offer that are similar to those you have already purchased or enquired about, unless you have opted not to receive such information.
• To manage your requests, meaning to attend to and manage the requests you make to us.
• For business transfers, meaning we may use your information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data we hold about our Service users is among the assets transferred.
• For other purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns, and evaluating and improving our Service, products, services, marketing, and your experience.

When We Share Your Personal Information

• With Service Providers. We may share your personal information with Service Providers to monitor and analyze the use of our Service and to contact you.
• For business transfers. We may share or transfer your personal information in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of our business to another company.
• With Affiliates. We may share your information with our affiliates, in which case we will require those affiliates to honor this Privacy Policy.
• With business partners. We may share your information with our business partners to offer you certain products, services, or promotions.
• With your consent. We may disclose your personal information for any other purpose with your consent.

07 Retention of Your Personal Data

We will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies.

We will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or improve the functionality of our Service, or where we are legally obligated to retain this data for longer periods.

To the extent any information we collect constitutes a medical or treatment record or other PHI, we retain it for the period required by applicable federal and state law and our records-retention policies, which may require retention for a number of years following the last date of service. For other Personal Data, we determine the appropriate retention period based on the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it, whether we can achieve those purposes through other means, and applicable legal, accounting, or reporting requirements.

08 Transfer and Disclosure of Your Personal Data

Transfer of Your Personal Data

Your information, including Personal Data, is processed at our operating offices and in any other places where the parties involved in the processing are located. This means the information may be transferred to and maintained on computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those in your jurisdiction. Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer.

We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy, and no transfer of your Personal Data will take place to an organization or a country unless there are adequate controls in place, including the security of your data and other personal information.

Business Transactions

If we are involved in a merger, acquisition, or asset sale, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law Enforcement and Other Legal Requirements

Under certain circumstances, we may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities, such as a court or a government agency. We may also disclose your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of the Company
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of users of the Service or the public
• Protect against legal liability

09 Security of Your Personal Data

The security of your Personal Data is important to us, but remember that no method of transmission over the internet, and no method of electronic storage, is 100 percent secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

We maintain administrative, technical, and physical safeguards designed to protect Personal Data against accidental, unlawful, or unauthorized destruction, loss, alteration, access, disclosure, or use. These measures may include encryption of data in transit, access controls, and periodic assessment of our information-security practices, and are appropriate to the nature of the information and the risks involved.

In the event of a breach of security involving Personal Data, we will investigate and will provide notice to affected individuals and to regulators where, and within the time periods, required by applicable law. You are responsible for maintaining the confidentiality of any account credentials and for promptly notifying us of any suspected unauthorized use of your Account.

10 Marketing Communications and Text Messaging

Where required by law, we will obtain your consent before sending you marketing communications. You may opt out of marketing emails at any time by following the unsubscribe instructions in those emails, or by contacting us using the information in the Contact Us section below. Opting out of marketing communications will not affect transactional or service-related messages, such as appointment confirmations or messages necessary to administer your Account.

If you provide us with your telephone number and consent to receive text messages, you agree that we, or parties acting on our behalf, may send you appointment reminders, service-related messages, and, where you have separately consented, marketing messages, including through an automatic telephone dialing system. Consent is not a condition of purchasing any goods or services. Message and data rates may apply, and message frequency varies. You may opt out at any time by replying STOP to any message, and you may reply HELP for assistance. We conduct telephone and text outreach in accordance with the Telephone Consumer Protection Act and other applicable laws.

11 Your Privacy Rights

Depending on where you reside, you may have rights regarding your Personal Data under applicable state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act, collectively referred to as the CCPA, and comprehensive privacy laws enacted in states such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others. This section describes those rights and how to exercise them. Information governed by HIPAA, and certain other information exempt under applicable law, may not be subject to these rights.

Categories of Personal Data We Collect, Disclose, and Sell or Share

In the preceding twelve months, we may have collected the categories of Personal Data described in the sections above, including identifiers, contact information, commercial information, internet and other electronic network activity information, and, where applicable, information that may be treated as sensitive. We collect this information directly from you, automatically through your use of the Service, and from Service Providers, and we disclose it to the categories of recipients and for the business and commercial purposes described in the Use of Your Personal Data section.

Whether we sell or share Personal Data, as those terms are defined under applicable law, depends on the advertising and analytics technologies used on the Website. Where we sell or share Personal Data, you have the right to opt out as described below.

Your Rights

• Right to Know and Access. You may request that we disclose the categories and specific pieces of Personal Data we have collected about you, the categories of sources, the purposes for collecting, using, selling, or sharing it, and the categories of third parties to whom we disclose it.
• Right to Delete. You may request that we delete Personal Data we have collected from you, subject to certain exceptions, including where retention is required by law.
• Right to Correct. You may request that we correct inaccurate Personal Data we maintain about you.
• Right to Data Portability. You may request a copy of certain Personal Data in a portable, readily usable format.
• Right to Opt Out of Sale or Sharing. Where applicable, you may opt out of the sale or sharing of your Personal Data and of its processing for targeted advertising.
• Right to Limit Use of Sensitive Personal Information. Where applicable, you may direct us to limit the use and disclosure of Sensitive Personal Information to that which is necessary to provide the Service.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of these rights.
• Right to Appeal. In certain states, if we decline to act on your request you may appeal by contacting us as described below. If your appeal is denied, you may contact your state attorney general.

How to Exercise Your Rights

You, or an authorized agent acting on your behalf, may submit a request to exercise these rights by contacting us using the information in the Contact Us section below. We will take reasonable steps to verify your identity before responding, which may require you to provide information sufficient to confirm you are the individual about whom we collected Personal Data. We will respond to verifiable requests within the time periods required by applicable law and will not charge a fee unless the request is excessive, repetitive, or manifestly unfounded.

Where required by law, we honor opt-out preference signals, such as the Global Privacy Control, transmitted by your browser or device.

12 Consumer Health Data and California Shine the Light

Certain states, including Washington under the My Health My Data Act and Nevada, regulate consumer health data collected outside of HIPAA. To the extent we collect Consumer Health Data through the Website, we use and disclose it only for the purposes described in this Privacy Policy or as otherwise permitted by law, and we obtain your consent where required. Where applicable law provides, you have the right to access, to withdraw consent to the collection of, and to request deletion of your Consumer Health Data, and the right not to have it sold without your separate, valid authorization.

California Civil Code Section 1798.83 permits California residents to request certain information regarding our disclosure of Personal Data to third parties for their own direct-marketing purposes. To make such a request, please contact us using the information in the Contact Us section below.

13 Children's Privacy

Our Service does not address anyone under the age of 13. We do not knowingly collect personally identifiable information from anyone under the age of 13. If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from anyone under the age of 13 without verification of parental consent, we take steps to remove that information from our servers.

Our Service is intended for a general audience and is not directed to children. Consistent with the Children's Online Privacy Protection Act, we do not knowingly collect Personal Data from children under the age of 13. Our products and services are intended for adults, and we do not knowingly provide services to, or market to, individuals under the age of 18 without the consent of a parent or legal guardian.

If you are under the age of 16, applicable law may require your affirmative authorization, or for those under 13 the authorization of a parent or guardian, before we sell or share your Personal Data, and we do not do so absent such authorization. If you believe we may have collected Personal Data from a child in a manner inconsistent with applicable law, please contact us and we will take appropriate steps to delete that information.

14 Links to Other Websites

Our Service may contain links to other websites that are not operated by us, including our online booking platform. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

15 Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

We will let you know by email or through a prominent notice on our Service prior to the change becoming effective, and we will update the Last updated date at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

16 Contact Us

If you have any questions about this Privacy Policy, or you would like to exercise any of the privacy rights described above, you can reach us at: