PRIVACY POLICY

Maravella Aesthetics

Effective Date: 08/02/2026

1. Introduction

Maravella Aesthetics ("Maravella," "we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit maravellaaesthetics.com (the "Site"), contact us, book an appointment, or otherwise interact with us.

Important — two different documents: This Privacy Policy governs information collected through our website and general business operations. It is not our Notice of Privacy Practices. As a healthcare provider, protected health information ("PHI") we create or receive in the course of treatment is governed separately by the Health Insurance Portability and Accountability Act ("HIPAA") and by our Notice of Privacy Practices, which is provided to you at your first visit and available upon request. Where this Policy and our Notice of Privacy Practices conflict as to PHI, the Notice of Privacy Practices controls.

By using the Site, you agree to the practices described in this Policy. If you do not agree, please do not use the Site.

2. Information We Collect

2.1 Information You Provide Directly

Contact information: name, email address, phone number, mailing address
Appointment information: requested services, preferred dates and times, provider preference
Health information you choose to submit: treatment interests, concerns, medical history, medications, allergies — whether submitted through intake forms, consultation requests, or messages
Payment information: processed by our third-party payment processor; we do not store full card numbers on our servers
Photographs and images: before-and-after or treatment photos you provide or that we take with your written authorization
Communications: the content of emails, text messages, contact form submissions, and reviews you send us

2.2 Information Collected Automatically

When you visit the Site, we and our service providers may automatically collect:

IP address and approximate geographic location
Browser type, device type, and operating system
Pages viewed, time spent, referring URL, and links clicked
Cookies, pixels, and similar tracking technologies (see Section 6)

2.3 Information from Third Parties

We may receive information about you from scheduling platforms, our electronic medical record system, payment processors, review platforms, and social media services when you interact with our accounts.

3. How We Use Your Information

We use the information we collect to:

Schedule, confirm, reschedule, and follow up on appointments
Provide, personalize, and improve our services
Respond to inquiries, consultation requests, and customer service matters
Process payments and maintain financial records
Send appointment reminders and treatment aftercare instructions
Send promotional communications, newsletters, and special offers, where you have consented
Maintain the security and functionality of the Site
Analyze Site usage and improve user experience
Comply with legal, regulatory, licensing, and professional obligations
Establish, exercise, or defend legal claims

We do not sell your personal information.

4. How We Share Your Information

We may share information in the following circumstances:

Service providers: scheduling software, electronic medical records vendors, payment processors, email and text messaging platforms, website hosts, and analytics providers. These vendors are contractually restricted from using your information for their own purposes, and those handling PHI operate under HIPAA Business Associate Agreements.
Treatment coordination: with other healthcare providers involved in your care, consistent with HIPAA and your authorization where required.
Legal requirements: when required by law, subpoena, court order, regulatory authority, or professional licensing board.
Business transfer: in connection with a merger, acquisition, or sale of assets, subject to applicable law.
With your consent: including any use of your photographs, testimonials, or likeness in marketing, which requires your separate written authorization.

5. Text Message (SMS) Communications

If you provide your mobile number and opt in, we may send appointment reminders, confirmations, aftercare instructions, and — separately and only with your express consent — promotional messages.

Message and data rates may apply.
Message frequency varies.
Opting out of promotional texts does not necessarily opt you out of transactional appointment-related messages, which you may decline by contacting us directly.
We do not share your mobile number or SMS consent with third parties or affiliates for their own marketing purposes.

6. Health Information You Volunteer Through Unsecured Channels

Patients and prospective patients often share health information through channels that are not secure — standard text message, unencrypted email, website contact forms, social media direct messages, and public comments or reviews. This section explains how we handle that.

Risk warning. Standard SMS and unencrypted email are not secure. Messages may be intercepted, misdirected, retained on servers we do not control, or viewed by anyone with access to your device, phone plan, or email account — including a shared family phone plan, a spouse or family member, an employer-issued device, or an employer-administered email system. We cannot guarantee the confidentiality of anything sent to us this way.

Your choice to use these channels. If you contact us through an unsecured channel, or ask us to reach you that way, we will treat that as your request and may respond through the same channel. You may withdraw that request at any time, verbally or in writing, and we will then communicate with you only by telephone, secure patient portal, or postal mail.

Photographs. Please do not send photographs of your face, skin, or a treatment area by text, email, or social media.

Social media, comments, and reviews. Please do not post health information in public comments, direct messages, or online reviews.

Information may become part of your record. Communications containing clinically relevant information may be documented in your medical record. Once documented, that information is retained and protected under HIPAA and our Notice of Privacy Practices, regardless of how it originally reached us.

Not for urgent matters. These channels are not monitored continuously and must never be used for urgent or emergency medical concerns. If you are experiencing a medical emergency, call 911.

7. Cookies and Tracking Technologies

The Site uses cookies and similar technologies for functionality, analytics, and — where applicable — advertising.

Essential cookies enable core Site functions.
Analytics cookies help us understand how visitors use the Site.
Advertising and social media pixels may be used to measure and deliver advertising.

You can disable cookies through your browser settings, though some Site features may not function properly as a result. Some browsers offer a "Do Not Track" signal; we currently do not respond to such signals.

Note regarding health-related tracking: We take care to avoid configuring advertising or analytics technologies in a manner that transmits information tied to your specific treatments or health conditions to third-party advertising platforms.

8. Your Privacy Rights

Depending on your state of residence, you may have the right to:

Request access to the personal information we hold about you
Request correction of inaccurate information
Request deletion of your personal information, subject to legal and medical-record retention requirements
Opt out of marketing communications
Opt out of the sale or sharing of personal information for targeted advertising (note: we do not sell personal information)
Receive a copy of your information in a portable format
Be free from discrimination for exercising these rights

Separately, HIPAA provides you specific rights with respect to your medical records, including the right to access, request amendment of, and receive an accounting of disclosures of your PHI. Those rights are described in our Notice of Privacy Practices.

To exercise any right, contact us using the information in Section 12. We may need to verify your identity before responding.

9. Data Security

We maintain administrative, technical, and physical safeguards designed to protect your information, including encrypted transmission, access controls, and staff training. However, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

Please do not send detailed health information through unsecured email, social media messages, or the Site's general contact form. Use our secure patient portal or discuss it during your appointment.

10. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy and to comply with applicable legal obligations. Medical records are retained in accordance with Arizona law and applicable professional standards.

11. Children's Privacy

The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Our services are provided only to individuals 18 years of age or older, or to minors with the consent and presence of a parent or legal guardian where permitted by law and our practice policies.

12. Third-Party Links

The Site may link to third-party websites, including social media platforms and booking or payment providers. We are not responsible for the privacy practices of those sites. We encourage you to review their privacy policies.

13. Contact Us