Privacy Policy

1. Introduction

FACE.by.Sarina, also referred to as FBS Medspa (“FBS Medspa,” “we,” “us,” or “our”), is committed to protecting the privacy, confidentiality, and security of the personal information of our website visitors, prospective clients, clients, and patients.

This Privacy Policy explains how we collect, use, maintain, protect, and disclose personal information when you visit our website, contact us, schedule appointments, purchase services or products, receive aesthetic or wellness services, communicate with us, or otherwise interact with our business.

Our services may include aesthetic treatments, injectables, dermal fillers, skin and laser treatments, body aesthetics, hair restoration, wellness and weight management services, and other medical spa or wellness services offered by FBS Medspa.

This Policy applies to information collected through our website, online booking systems, forms, telephone calls, text messages, email, social media, marketing campaigns, and other business interactions, as applicable.

Please read this Policy carefully. By using our website or interacting with our business, you acknowledge that you have had the opportunity to review this Policy. Where applicable law requires consent for a particular use of information, we will seek that consent separately. This Policy does not replace any separate consent, authorization, treatment agreement, or notice required by law.

2. Information We Collect

Depending on how you interact with FBS Medspa, we may collect the following categories of information.

A. Personal and Contact Information

This may include your name, email address, telephone number, mailing address, date of birth, and other information you voluntarily provide when requesting information, completing a form, scheduling an appointment, or communicating with us.

B. Appointment and Service Information

We may collect appointment dates and times, services requested or received, booking history, cancellation and rescheduling information, consultation details, treatment preferences, and related administrative records.

C. Health and Treatment Information

When relevant to services provided by FBS Medspa or its appropriately authorized healthcare professionals, we may collect information such as medical history, allergies, medications, health conditions, treatment records, photographs, treatment plans, consent forms, and information relevant to assessing suitability for a procedure.

Health information will be handled in accordance with applicable laws and the privacy obligations applicable to the entity or healthcare professional maintaining it.

Please do not submit sensitive medical information through ordinary email, social media direct messages, or unsecured online forms unless we have specifically instructed you to use that method.

D. Payment and Transaction Information

We may collect billing details, payment status, transaction history, invoices, refunds, deposits, and information relating to purchases or memberships.

Payments may be processed through third-party payment providers. We do not intend to collect or store complete payment card information beyond what is necessary for authorized business purposes and the capabilities of our payment systems.

E. Photographs, Videos, and Testimonials

With appropriate authorization where required, we may collect photographs or videos for clinical documentation, treatment planning, progress monitoring, education, or promotional purposes.

Clinical photographs and promotional images are treated differently. We will not use identifiable patient photographs, videos, testimonials, or treatment information in advertising or public-facing materials without any separate authorization required by applicable law.

F. Website and Technical Information

When you visit our website, we may automatically collect technical information, including your IP address, browser type, device information, operating system, pages viewed, referring website, approximate location derived from technical information, and website usage data.

G. Communications and Marketing Information

We may collect the contents of inquiries, customer service communications, appointment requests, survey responses, marketing preferences, and records of your consent to receive promotional communications.

3. How We Collect Information

We may collect information:

• Directly from you through consultations, appointments, registration forms, intake forms, surveys, and other interactions.
• Through our website, online booking platforms, payment processors, and customer communication systems.
• Through telephone calls, text messages, email, and social media communications.
• Automatically through cookies, analytics tools, pixels, and similar technologies, where used.
• From authorized healthcare professionals, service providers, or other sources when permitted by law and appropriate for our business or treatment operations.

We seek to collect information that is reasonably necessary for the relevant business, administrative, marketing, or healthcare purpose.

4. How We Use Your Information

FBS Medspa may use personal information for the following purposes:

• Providing services: To respond to inquiries, schedule appointments, conduct consultations, coordinate services, and manage client relationships.
• Treatment and safety: To support appropriate clinical assessment, treatment planning, documentation, follow-up care, and patient safety, where applicable.
• Payments and administration: To process payments, deposits, refunds, memberships, invoices, and other transactions.
• Communication: To send appointment confirmations, reminders, rescheduling notices, service updates, and responses to your inquiries.
• Marketing: To send promotional offers, newsletters, service announcements, and information about treatments or events when permitted by law and consistent with your communication preferences.
• Website improvement: To evaluate website performance, troubleshoot technical issues, understand website usage, and improve our services.
• Security and fraud prevention: To protect our clients, staff, systems, property, and business against fraud, misuse, unauthorized access, and security incidents.
• Legal and regulatory compliance: To comply with applicable laws, licensing requirements, recordkeeping obligations, lawful requests, and professional obligations.
• Business operations: To manage staffing, authorized service providers, business planning, and other legitimate operational needs.

We will not use health information for unrelated marketing purposes in a manner prohibited by applicable law.

5. SMS Text Messages and Mobile Communications

FBS Medspa may offer text message communications for appointment reminders, scheduling updates, customer service, and promotional messages.

A. Consent to Receive Text Messages

You may be asked to provide your mobile telephone number and separately consent to receive text messages from FBS Medspa.

Where required, marketing text messages will be sent only after obtaining the appropriate consent. Consent to receive promotional text messages is not a condition of purchasing services.

B. Message Frequency and Charges

Message frequency may vary depending on your appointments, communication preferences, and the messaging program you join. Message and data rates may apply depending on your wireless carrier and service plan.

C. Opting Out

You may opt out of marketing text messages at any time by replying STOP. After processing your request, we will stop sending the applicable promotional messages, except for any messages permitted or required by law.

You may reply HELP for assistance or contact us using the contact information provided in this Policy.

Opting out of promotional messages does not necessarily stop essential service-related communications, where those communications are permitted by law and remain necessary. You may contact us to discuss available communication options.

D. Mobile Information Privacy

We do not sell mobile telephone information, and we do not share mobile information, SMS consent, or text messaging opt-in data with third parties or affiliates for their own marketing or promotional purposes.

We may disclose mobile information to vendors that provide messaging, customer service, scheduling, or related operational services on our behalf, subject to applicable confidentiality, security, and legal requirements.

Your SMS consent and opt-in records will be handled in accordance with applicable law.

6. Cookies, Analytics, and Online Advertising

Our website may use cookies, pixels, tags, analytics tools, and similar technologies to operate the website, remember preferences, measure website traffic, evaluate advertising performance, and support marketing activities.

These technologies may collect information about your device, browser, interactions with our website, and the advertisements or pages you view.

Depending on the tools actually in use, third-party services may include website analytics providers, social media platforms, online booking providers, and advertising platforms such as Meta.

Where applicable, these providers may process information according to their own privacy policies and the arrangements governing their services.

You may be able to manage cookies through your browser settings and any cookie preference tools we provide. Blocking certain cookies may affect website functionality.

We will configure applicable privacy controls and tracking technologies in accordance with relevant legal requirements. We will not represent that a particular tracking technology is disabled or that an opt-out is effective unless our actual website configuration supports that representation.

Because FBS Medspa may provide healthcare-related services, tracking technologies must be assessed carefully to avoid unauthorized disclosure of sensitive health or treatment information.

7. How We Share Information

FBS Medspa does not sell personal information in the ordinary course of business. We may disclose information in the following circumstances, as permitted by law.

A. Service Providers

We may share relevant information with trusted service providers that help us operate our business, including:

• Online booking and practice management platforms.
• Payment processors and billing providers.
• Website hosting, maintenance, and analytics providers.
• Email, telephone, and SMS communication platforms.
• Customer support and administrative service providers.
• Authorized IT, cybersecurity, legal, accounting, and compliance professionals.

These providers may access information only as reasonably necessary to perform their authorized functions, subject to applicable contractual and legal obligations.

B. Healthcare Professionals and Treatment Providers

Where appropriate and legally permitted, relevant information may be shared with authorized healthcare professionals or other providers involved in your care, treatment coordination, or clinical administration.

C. Legal and Regulatory Obligations

We may disclose information when required by law, court order, lawful governmental request, applicable professional obligations, or to establish, exercise, or defend legal claims.

D. Protection of Rights and Safety

We may disclose relevant information when reasonably necessary to investigate suspected fraud, protect the safety of individuals, enforce lawful agreements, or protect our legal rights and business operations, subject to applicable law.

E. Business Transfers

If FBS Medspa undergoes a merger, restructuring, financing, sale of assets, or other business transaction, relevant information may be transferred as part of that transaction, subject to applicable legal requirements and protections.

F. No Unauthorized Marketing Sales

We do not authorize third parties to use client contact information or mobile opt-in data for their own independent marketing merely because they provide services to us. Any disclosure must have an appropriate legal basis and be consistent with applicable consent and privacy requirements.

8. Health Information and HIPAA

Certain information collected in connection with aesthetic or wellness services may be sensitive health information.

The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) applies to healthcare providers and other organizations that meet the applicable legal definitions of covered entities or business associates. Whether HIPAA applies to a particular FBS Medspa entity, professional, record, or activity depends on the applicable legal requirements.

If FBS Medspa or an applicable healthcare provider is subject to HIPAA, protected health information will be handled in accordance with applicable HIPAA requirements and any separate Notice of Privacy Practices that must be provided.

Where required, separate notices, authorizations, or agreements may govern the use and disclosure of protected health information.

This Privacy Policy is not intended to replace a HIPAA Notice of Privacy Practices, a patient authorization, or any other legally required healthcare privacy document.

9. Photographs, Before-and-After Images, and Testimonials

FBS Medspa understands that aesthetic treatment photographs and testimonials may reveal personal or sensitive information.

Photographs and videos may be maintained for clinical documentation, treatment planning, and progress tracking as permitted by law.

Before-and-after images, testimonials, names, videos, or other identifiable client materials will not be used for public marketing, social media, advertising, or promotional purposes without appropriate authorization where required.

A clinical consent form does not automatically constitute permission to use a person's image for advertising.

You may contact us to ask questions about an image authorization you have provided. Any withdrawal of authorization will be handled in accordance with applicable law and the terms of the authorization, including any limitations concerning materials already published or actions already taken.

10. Data Security and Confidentiality

FBS Medspa takes reasonable steps to protect personal information against unauthorized access, use, alteration, loss, disclosure, and destruction.

Depending on the nature of the information and our operations, safeguards may include:

• Access restrictions and role-based permissions.
• Password protection and account security measures.
• Secure systems for storing and transmitting information.
• Staff confidentiality procedures and training.
• Reasonable vendor screening and contractual safeguards.
• Secure disposal of information when it is no longer required.
• Procedures for identifying, investigating, and responding to security incidents.

We seek to maintain safeguards appropriate to the nature and sensitivity of the information we collect and the size and complexity of our business.

However, no website, electronic transmission, or storage system can be guaranteed to be completely secure. We cannot promise absolute security, and you should exercise appropriate care when transmitting sensitive information electronically.

Nothing in this section limits any security or breach-notification obligations imposed on us by applicable law.

11. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Policy, including providing services, maintaining business and financial records, complying with healthcare recordkeeping requirements, resolving disputes, enforcing agreements, and meeting legal or regulatory obligations.

Healthcare records may be subject to specific retention periods under applicable law and professional requirements.

When information is no longer needed, we will take reasonable steps to securely delete, destroy, or de-identify it, subject to legal retention requirements, legitimate recordkeeping needs, and technical limitations.

12. Your Privacy Rights and Choices

Depending on applicable law and the nature of the information, you may request to:

• Obtain information about personal data we maintain about you.
• Request correction of inaccurate contact or account information.
• Request deletion of certain personal information.
• Obtain a copy of certain information, where applicable.
• Withdraw consent for communications or particular uses of information where consent is the legal basis.
• Opt out of promotional emails or SMS messages.
• Ask questions about how your information is collected, used, or disclosed.

To submit a request, contact us using the information in Section 19.

We may need to verify your identity before processing certain requests. Some requests may be limited or denied where permitted or required by law, including when information must be retained for healthcare, legal, security, billing, or regulatory purposes.

Requests involving protected health information may be subject to separate procedures and rights under applicable healthcare privacy laws.

13. Email and Promotional Communications

If you receive promotional emails from us, you may unsubscribe using the instructions included in the message or contact us directly.

Unsubscribing from promotional communications does not necessarily stop transactional or service-related communications, such as appointment confirmations, billing notices, or information necessary to provide a service.

We will process communication preferences in accordance with applicable law.

14. Third-Party Websites and Platforms

Our website or communications may contain links to third-party websites, online booking systems, social media platforms, payment services, or other external services.

Those third parties may have their own privacy policies, terms, and security practices. FBS Medspa does not control every aspect of third-party systems and is not responsible for their independent privacy practices, except to the extent responsibility cannot legally be excluded or is otherwise imposed by applicable law.

We encourage you to review the relevant privacy notices before submitting information through third-party platforms.

15. Children and Minors

Our website is not directed to children under 13, and we do not knowingly collect personal information online from children under 13 without an appropriate legal basis.

Some services offered by a medical spa may have age restrictions or require parental or guardian involvement, depending on the service and applicable law.

We will handle information relating to minors in accordance with applicable consent, confidentiality, and healthcare requirements.

If you believe a child has provided personal information to us improperly, please contact us so that we can review the matter and take appropriate action.

16. Artificial Intelligence and Automated Tools

FBS Medspa may use automated tools or artificial intelligence (“AI”) technologies for limited business purposes, such as responding to general inquiries, organizing administrative information, assisting with customer service, or analyzing website performance, where such tools are used.

The information processed will depend on the specific tools and their configuration.

We will not intentionally enter identifiable patient health information into a general-purpose AI tool unless the use is appropriately authorized and permitted by applicable law and our privacy and security obligations.

AI tools are not a substitute for professional medical judgment. Any use involving sensitive information must be evaluated for appropriate privacy, security, and compliance safeguards.

17. New York Privacy and Data Security

FBS Medspa seeks to handle personal information in accordance with applicable federal, New York State, and other relevant privacy and data security laws.

Where applicable, this includes the New York SHIELD Act and relevant data breach notification requirements.

If a security incident triggers a legal notification obligation, we will provide notices to affected individuals and appropriate authorities as required by applicable law.

Nothing in this Policy is intended to waive, restrict, or eliminate any consumer or patient right that cannot legally be waived.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business practices, services, technologies, vendors, or legal requirements.

Any updated version will be posted on our website with a revised “Last Updated” date.

Where required by law, we will provide additional notice or obtain consent for material changes. We encourage you to review this Policy periodically.

19. Contact Us

If you have questions about this Privacy Policy, wish to exercise an applicable privacy right, or have concerns about how your information is handled, please contact:

Please do not include sensitive medical information, passwords, payment card details, or other confidential information in an ordinary email or general website inquiry.