Your privacy is important to us at Call of Beauty Med Spa (collectively, "Call of Beauty" or "we" or "us" or "our"). This privacy policy ("Policy") describes how Call of Beauty collects, protects, and uses the personally identifiable information ("Personal Information") you ("User", "you" or "your") may provide on the callofbeautymedspa.com website, any other sites we own and operate, and any of our products or services (collectively, "Website" or "Services").

This Policy also describes the choices available to you regarding our use of your Personal Information and how you can access and update this information. This Policy does not apply to the practices of companies that we do not own or control, or to individuals that we do not employ or manage.

This Privacy Policy does not apply to information (a) by any other websites or platforms operated by us, unless the website or platform is listed above or links to this Privacy Policy; (b) collected by any third party website that we may provide a link to or that is accessible from our website; or (c) covered in part or in whole by a separate privacy policy provided by us (e.g., relating specifically to health information (e.g., a Notice of Privacy Practices under HIPAA), financial information, other special information, etc.).

Summary of Key Points

You can browse this Website without telling us who you are. We only receive your name and contact details when you type them into a form, such as the online booking request.
We use analytics and advertising tools from Google and Meta. None of them load until you choose "Accept" in the consent banner. If you decline, or your browser sends a Global Privacy Control signal, nothing is sent to those companies.
We never send treatment names, health conditions, or anything about your medical care to advertising platforms.
You can change your choice at any time with the link in the footer of every page.

Changes to This Policy

We may change this Privacy Policy from time to time. If we make any changes, we will revise the date at the top of this Privacy Policy. If there are material changes, we may notify you more directly by email. We encourage you to periodically review our Privacy Policy to stay informed about our data protection practices and the ways you can help protect your privacy.

Automatic Collection of Information

When you visit the Website, the servers that host it (operated for us by Vercel, Inc.) automatically record standard technical information that every browser sends: your device's IP address, browser type and version, operating system, language preference, the page you requested, and the time of the request. This information is used to deliver the pages you ask for, keep the Website secure, detect abuse, and produce aggregate statistics about how the Website is used. It is not combined with your name or contact details.

Separately, and only with your consent, we use the analytics and advertising tools described under Cookies, Analytics, and Advertising Technologies below.

Collection of Personal Information

You can visit the Website without telling us who you are or revealing any information by which someone could identify you as a specific, identifiable individual. If, however, you wish to use some of the Website's features, you will be asked to provide certain Personal Information (for example, your name and email address). We receive and store any information you knowingly provide to us when you fill any online forms on the Website. When required, this information may include the following:

Personal details such as your name
Contact information such as your email address and phone number
Appointment details you choose to share when booking, such as the treatment you are interested in, your preferred date and time, and any message you add

You can choose not to provide us with your Personal Information, but then you may not be able to take advantage of some of the Website's features. Users who are uncertain about what information is mandatory are welcome to contact us.

Health Information

This public Website is informational. Reading about a treatment does not create a patient relationship and does not give us any health information about you. If you request an appointment, the treatment you select and any message you write are used only to schedule and prepare for your visit. They are stored in our practice-management system (Zenoti) and are not shared with advertising or analytics providers.

Medical records created when you become a patient are protected health information and are governed by our Notice of Privacy Practices, which you receive at your first visit, not by this Policy.

Storing Personal Information

We will retain and use your Personal Information for the period necessary to comply with our legal obligations, resolve disputes, and enforce our agreements unless a longer retention period is required or permitted by law. We may use any aggregated data derived from or incorporating your Personal Information after you update or delete it, but not in a manner that would identify you personally. Once the retention period expires, Personal Information will be deleted. Therefore, the right to access, the right to erasure, the right to rectification and the right to data portability cannot be enforced after the expiration of the retention period.

Use and Processing of Information

In order to make our Website and Services available to you, or to meet a legal obligation, we need to collect and use certain Personal Information. If you do not provide the information that we request, we may not be able to provide you with the requested products or services. Some of the information we collect is directly from you via our Website. However, we may also collect Personal Information about you from other sources. Any of the information we collect from you may be used for the following purposes, including to:

Schedule, confirm, and remind you about appointments
Respond to inquiries and offer support
Send administrative information
Improve products, services, and user experience
Post customer testimonials, with your permission
Advertise or market our products and services, including special promotions
Measure whether our advertising led to an appointment request, when you have consented to advertising cookies
Billing, transactional, payment processing (e.g., credit card and debit card payments) and order fulfillment purposes
Enforce terms and conditions and policies
Protect from abuse and malicious users
Respond to legal requests and prevent harm
Comply with applicable law, regulation, legal process, or enforceable governmental request
Run and operate our Website and Services

Processing your Personal Information depends on how you interact with our Website, where you are located in the world and if one of the following applies: (i) You have given your consent for one or more specific purposes; (ii) Provision of information is necessary for the performance of an agreement with you and/or for any pre-contractual obligations thereof; (iii) Processing is necessary for compliance with a legal obligation to which you are subject; (iv) Processing is related to a task that is carried out in the public interest or in the exercise of official authority vested in us; (v) Processing is necessary for the purposes of the legitimate interests pursued by us or by a third party.

Sharing and Disclosure of Information

We will not share Personal Information about you with any third parties, unless you allow it, as described in this Policy, or in connection with providing you the Website and Services. The service providers that process information on our behalf are:

Zenoti (practice-management and online booking). Receives the name, email, phone number, and appointment details you submit through the booking form so we can create and manage your appointment. When you book online, the card you add to hold your appointment is entered on Zenoti's secure payment page and stored by Zenoti Payments and its card processor; it never passes through our website.
Vercel (website hosting and cookieless, aggregated web analytics that set no cookies and do not identify individual visitors).
Resend (email delivery). Sends booking confirmations to our team.
Cloudinary (image delivery). Serves the images on the Website; like any content delivery network it receives your IP address and browser type when it delivers a file.
Google and Meta (analytics and advertising), only with your consent, as described in the next section.

We may also share information when necessary to protect the security and safety of our users or when required by law or a legal process, such as to comply with a subpoena, or similar legal process, and when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request. In the event we go through a business transition, such as a merger or acquisition by another company, or sale of all or a portion of its assets, your Personal Information will likely be among the assets transferred.

Cookies, Analytics, and Advertising Technologies

A cookie is a small text file that a website stores in your browser. We use two kinds. Essential cookies make the Website work and remember your privacy choice; they do not track you and cannot be switched off. Analytics and advertising cookies and similar technologies (pixels, tags, and server-side event reporting) are provided by Google and Meta and are described below. They are off by default and are only enabled if you choose "Accept" in the consent banner.

Google Analytics

Provided by Google LLC. Helps us understand how visitors use the Website: which pages are viewed, how long visitors stay, how far they scroll, which step of the booking form they reach, the type of device and browser used, and an approximate location derived from your IP address. Google Analytics sets cookies (such as _ga) that assign a random identifier to your browser. To learn how Google uses this information, see How Google uses information from sites or apps that use our services. You can also install the Google Analytics opt-out browser add-on.

Google Ads

Provided by Google LLC. We advertise on Google Search. The Google Ads tag lets us measure whether a click on one of our ads led to an appointment request, and may be used to show our ads to people who have visited the Website. It sets cookies such as _gcl_au and shares the pages you viewed with Google. Learn more at How Google uses cookies in advertising, and manage personalized advertising from Google at Google Ads Settings.

Meta Pixel and Conversions API

Provided by Meta Platforms, Inc. (Facebook and Instagram). We advertise on Facebook and Instagram. With your consent, the Meta Pixel sets cookies (_fbp and _fbc) and reports standard events to Meta: a page view, a view of one of our advertising landing pages, opening the booking form, submitting your contact details, and completing a booking. If you submit the booking form, your name, email address, and phone number are converted to a one-way hash in your browser and on our server before being sent to Meta, so that Meta can match the appointment request to the ad you clicked. The server-side copy of each event (the Conversions API) is sent only when you have consented in the banner and carries the same information as the browser event.

We do not send Meta the name of any treatment, any health condition, or any other health information. Every event is labelled only as a "consultation". Learn how Meta uses this data in the Meta Privacy Policy, and manage advertising preferences at Meta Ad Preferences.

Embedded Content

Videos on the Website are embedded from YouTube in privacy-enhanced mode, which does not set tracking cookies until you play a video. The Google Maps panel in the footer loads only after you accept analytics and advertising cookies; before that, a static link to directions is shown instead.

Your Choices

Consent banner. On your first visit we ask whether you accept analytics and advertising cookies. No Google or Meta tag loads before you answer, and if you choose Decline, none loads at all. Your choice is stored in an essential cookie for one year.
Change your mind. Click in the footer of any page to reopen the banner. If you withdraw consent, we stop sending data to Google and Meta and delete the cookies they set.
Global Privacy Control. If your browser or an extension sends the Global Privacy Control signal, we treat it as a decline and the banner is not shown. You can still opt in through Your Privacy Choices.
Browser settings. Most browsers let you block or delete cookies. If you block essential cookies, the Website will ask for your consent choice on every visit.
Platform opt-outs. Use the Google and Meta links above to limit personalized advertising across all websites, not just ours.

Do Not Track and Global Privacy Control

We honor the Global Privacy Control signal as described above. The older "Do Not Track" browser setting has no agreed technical standard, so we do not respond to it directly; use the consent banner or Global Privacy Control instead.

Rights of Users

You may exercise certain rights regarding your information processed by us. In particular, you have the right to do the following: (i) you have the right to withdraw consent where you have previously given your consent to the processing of your information; (ii) you have the right to object to the processing of your information if the processing is carried out on a legal basis other than consent; (iii) you have the right to learn if information is being processed by us, obtain disclosure regarding certain aspects of the processing and obtain a copy of the information undergoing processing; (iv) you have the right to verify the accuracy of your information and ask for it to be updated or corrected; (v) you have the right, under certain circumstances, to restrict the processing of your information, in which case, we will not process your information for any purpose other than storing it; (vi) you have the right, under certain circumstances, to obtain the erasure of your Personal Information from us; (vii) you have the right to receive your information in a structured, commonly used and machine readable format and, if technically feasible, to have it transmitted to another controller without any hindrance.

How to Exercise Rights

Any requests to exercise User rights can be directed to us through the contact details provided in this document. These requests can be exercised free of charge and will be addressed as early as possible, and in any case within 30 days. We may need to verify your identity before acting on a request.

California Privacy Rights

California residents have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), to the extent the CCPA applies to us. These include the right to know what Personal Information we collect, use, and disclose; the right to delete it; the right to correct inaccurate Personal Information; the right to opt out of the "sale" or "sharing" of Personal Information; the right to limit the use of sensitive Personal Information; and the right not to be discriminated against for exercising these rights.

Notice at collection. On this Website we collect the categories of Personal Information described under "Collection of Personal Information" (identifiers and contact details you type into forms) and "Automatic Collection of Information" and "Cookies, Analytics, and Advertising Technologies" (internet activity and device information), for the purposes listed under "Use and Processing of Information", and we retain them as described under "Storing Personal Information".

Do Not Sell or Share My Personal Information. We do not sell Personal Information for money. Sending browsing information to Google Ads and Meta for advertising measurement and targeting may be considered "sharing" for cross-context behavioral advertising under the CCPA. We only do so with your consent, and you can opt out at any time by clicking or by enabling Global Privacy Control in your browser. We do not knowingly sell or share the Personal Information of anyone under 16.

California residents who provide Personal Information to obtain Services for personal, family, or household use may also request, once a calendar year, information about the Personal Information we shared, if any, with other businesses for their own direct marketing uses. To make any California privacy request, contact us using the details at the end of this Policy.

Users Outside of the US (International)

Our Website and Services are not intended for use by and are not directed to residents outside of the United States. The personal information we collect is stored and/or processed where we or our partners, affiliates, and third-party providers maintain facilities. By using and accessing our site, users who reside or are located in countries outside of the United States agree and consent to the transfer to and processing of personal information on servers located outside of the country where they reside.

Please be aware that the locations to which we store, process, or transfer your personal information may not have the same data protection laws as the country in which you initially provided the information. If we transfer your personal information to third parties in other countries: (i) we will perform those transfers in accordance with the requirements of applicable law; and (ii) we will protect the transferred personal information in accordance with this Policy.

Our Policy Towards Children

We do not knowingly collect any Personal Information from children under the age of 13. If you are under the age of 13, please do not submit any Personal Information through our Website or Service. We encourage parents and legal guardians to monitor their children's Internet usage and to help enforce this Policy by instructing their children never to provide Personal Information through our Website or Service without their permission. If you have reason to believe that a child under the age of 13 has provided Personal Information to us through our Website or Service, please contact us.

Links to Third-Party Sites

Our Website contains links to other websites that are not owned or controlled by us, including our online booking portal hosted by Zenoti and our social media pages. Please be aware that we are not responsible for the privacy practices of such other websites or third-parties. We encourage you to be aware when you leave our Website and to read the privacy statements of each and every website that may collect Personal Information.

Information Security

We secure information you provide on computer servers in a controlled, secure environment, protected from unauthorized access, use, or disclosure. We maintain reasonable administrative, technical, and physical safeguards in an effort to protect against unauthorized access, use, modification, and disclosure of Personal Information in our control. However, no data transmission over the Internet or wireless network can be guaranteed. Therefore, while we strive to protect your Personal Information, you acknowledge that (i) there are security and privacy limitations of the Internet which are beyond our control; (ii) the security, integrity, and privacy of any and all information and data exchanged between you and our Website cannot be guaranteed; and (iii) any such information and data may be viewed or tampered with in transit by a third-party, despite best efforts.

Data Breach

In the event we become aware that the security of the Website has been compromised or users Personal Information has been disclosed to unrelated third parties as a result of external activity, including, but not limited to, security attacks or fraud, we reserve the right to take reasonably appropriate measures, including, but not limited to, investigation and reporting, as well as notification to and cooperation with law enforcement authorities. In the event of a data breach, we will make reasonable efforts to notify affected individuals if we believe that there is a reasonable risk of harm to the user as a result of the breach or if notice is otherwise required by law. When we do, we will post a notice on the Website.

Acceptance of This Policy

You acknowledge that you have read this Policy and agree to all its terms and conditions. By using the Website or its Services you agree to be bound by this Policy. If you do not agree to abide by the terms of this Policy, you are not authorized to use or access the Website and our Services.

Contacting Us

Please contact us at info@callofbeautymedspa.com, by phone at (760) 230-2211, or by mail at Call of Beauty Med Spa, 90 N Coast Hwy 101, Suite 207, Encinitas, CA 92024 if you: (i) have questions about this Policy; (ii) wish to exercise any of the rights described above; (iii) wish to make a complaint or have a concern about our handling of your Personal Information; or (iv) want to report a possible breach of privacy laws.

Call of Beauty will respond to your inquiry within 30 days.