Privacy Policy
Effective: October 01, 2026
At The Concierge Clinic, your privacy is part of the care we provide. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you visit our website at www.theconciergeclinic.com (the “Site”), communicate with us, or receive care at our practice. It applies to information collected through the Site, our scheduling and communication platforms, and in-office interactions.
By using the Site, you agree to the practices described in this Policy. If you do not agree with any part of it, please discontinue use of the Site.
As a medical aesthetic practice, The Concierge Clinic is subject to the Health Insurance Portability and Accountability Act (HIPAA) and applicable state privacy laws. This Privacy Policy supplements — and does not replace — our HIPAA Notice of Privacy Practices, which governs the use and disclosure of your Protected Health Information (PHI) in connection with your clinical care.
1. Information We Collect
INFORMATION YOU PROVIDE DIRECTLY
Contact information, including your name, email address, phone number, and mailing address
Scheduling information submitted through our scheduling platform
Health and medical history provided through intake forms, consultation questionnaires, and in-office paperwork
Payment information, processed through our third-party payment processor (we do not store full card numbers)
Messages you send us by contact form, email, or text message
Photographs taken in connection with your treatment for clinical documentation
INFORMATION COLLECTED AUTOMATICALLY
When you visit the Site, certain information is collected automatically through cookies and analytics tools, including:
IP address and general geographic location
Browser, device type, and operating system
Pages visited, time spent on the Site, and referring websites
INFORMATION FROM THIRD PARTIES
We may receive limited information from scheduling, payment, or communication platforms you use in connection with our services, such as appointment confirmations, payment status, and communication preferences.
2. How We Use Your Information
CARE AND PRACTICE OPERATIONS
Scheduling, confirming, and managing your appointments
Providing treatment and coordinating your care
Maintaining accurate medical records as required by law and licensing standards
Sharing pre- and post-treatment instructions
Processing payments and managing billing
COMMUNICATIONS
Responding to your questions and requests
Sending appointment reminders and follow-up communications
Sharing information about services, events, and offers you have chosen to receive
Sending our newsletter and practice updates, with your consent
SITE OPERATIONS
Understanding how the Site is used so we can improve it
Protecting the Site against security threats and unauthorized access
Meeting our legal and professional licensing obligations
3. HIPAA and Protected Health Information
As a licensed healthcare provider, The Concierge Clinic is a HIPAA covered entity. Protected Health Information includes information such as your name combined with your health history, treatment records, clinical photographs, or payment information related to your care. PHI is governed by HIPAA and our Notice of Privacy Practices.
HIPAA permits us to use and disclose PHI for treatment, payment, and healthcare operations. All other uses and disclosures require your written authorization, except where the law requires or permits them, such as mandatory reporting, public health activities, or legal proceedings.
With respect to your PHI, you have the right to:
Access and receive a copy of your medical records
Request an amendment to records you believe are inaccurate
Receive an accounting of certain disclosures of your PHI
Request restrictions on certain uses and disclosures
Request confidential communications
Receive a paper copy of our Notice of Privacy Practices
To exercise any of these rights, please contact us in writing using the information in Section 15. We will respond within the timeframe required by law.
4. How We Share Your Information
We do not sell, rent, or trade your personal information. We share information only in the limited circumstances described below.
SERVICE PROVIDERS AND BUSINESS ASSOCIATES
We work with carefully selected vendors who help us operate our practice and the Site, including:
Scheduling and electronic health record platforms
Payment processors
Email and text messaging platforms
Website hosting
Accounting and business management software
Any vendor who may access PHI must sign a Business Associate Agreement, as required by HIPAA, before doing so.
COORDINATION OF CARE
With your consent, we may share relevant clinical information with physicians or other healthcare providers involved in your care.
LEGAL REQUIREMENTS
We may disclose information when required by law, court order, subpoena, or government authority, or to protect the rights, safety, or property of our practice, our patients, or the public.
BUSINESS TRANSFERS
If our practice is involved in a merger, acquisition, sale of assets, or practice transition, patient records and personal information may be transferred to a successor entity as permitted by law. You will be notified as required by HIPAA and applicable law.
TEXT MESSAGING INFORMATION
Text messaging opt-in data and consent are excluded from every category of sharing described in this section. Please see Section 7 for details.
5. Cookies and Tracking Technologies
The Site uses cookies and similar technologies provided by our website platform and analytics tools. Cookies are small files stored on your device that help us understand how visitors use the Site.
Essential cookies support basic Site function and security
Analytics cookies help us understand Site traffic and usage patterns
Preference cookies remember your settings and choices
You can disable cookies in your browser settings, though some Site features may not work as intended.
6. Clinical Photography
Photographs taken in connection with your treatment are part of your medical record and are protected under HIPAA. We obtain your separate written authorization before using any photograph for marketing, social media, our website, or educational purposes.
You have the right to:
Decline photography at any time without affecting the quality of your care
Revoke a previously granted photo authorization in writing at any time (revocation does not apply to materials already published)
Request removal of your images from our digital platforms, subject to operational limitations
Images we publish are used under signed patient authorization and never include identifying information unless you have explicitly consented.
7. Email and Text Messaging
If you share your email address, we may send appointment reminders and care follow-up. If you opt in, we may also send our newsletter and information about services, events, and offers. You can unsubscribe from marketing email at any time using the link in any message. Unsubscribing from marketing email does not stop appointment or care-related email.
TEXT MESSAGING
If you provide your mobile number and consent to receive text messages, we may send appointment reminders and confirmations, pre- and post-care instructions, and replies to your messages. With your separate consent, we may also send occasional updates about services, events, and offers. Consent to receive text messages is not a condition of receiving care or making a purchase.
Message frequency varies. Message and data rates may apply. Reply STOP to any message to stop all text messages from us, or reply HELP for assistance. You may also call us at 440-792-4011. If you opt out of text messages, we will continue to reach you about your care by phone or email.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All categories of sharing described in this Policy exclude text messaging opt-in data and consent; this information will not be shared with any third parties.
8. Data Security
We use reasonable administrative, technical, and physical safeguards to protect your personal information and PHI from unauthorized access, disclosure, alteration, or destruction. These include:
Encrypted data transmission (SSL/TLS) on the Site
Password-protected, role-based access to patient records
Business Associate Agreements with vendors who handle PHI
Secure, compliant electronic health record systems
Team training on HIPAA and privacy obligations
No method of internet transmission or electronic storage is completely secure. We use commercially reasonable safeguards but cannot guarantee absolute security. If a breach affects your PHI, we will notify you as required by HIPAA and applicable state law.
Please do not send sensitive health information, Social Security numbers, or financial information through our website forms or general email. These channels are not intended for transmitting PHI.
9. Data Retention
We retain medical records for the period required by applicable law and professional licensing standards. Non-clinical information, such as marketing lists and website analytics, is kept only as long as needed for the purpose for which it was collected, then deleted or anonymized.
10. Children’s Privacy
The Site is intended for adults 18 years of age and older. We do not knowingly collect personal information through the Site from anyone under 18 without verifiable parent or guardian consent. Patients under 18 must be accompanied by a parent or legal guardian, who provides written consent before care.
If we learn that we have collected personal information from a minor without appropriate consent, we will promptly delete it.
11. Your Privacy Rights
Depending on your state of residence, you may have privacy rights in addition to those provided by HIPAA, including:
The right to know what personal information we collect and how it is used
The right to request deletion of personal information, subject to legal retention requirements
The right to correct inaccurate personal information
The right to opt out of the sale of personal information (we do not sell personal information)
The right not to be treated differently for exercising your privacy rights
To submit a request, please contact us in writing using the information in Section 15. We will verify your identity before processing any request and respond within the timeframe required by law.
12. Third-Party Links and Embedded Content
The Site may link to or embed content from third parties, such as social media feeds or scheduling tools. This Policy covers only information collected by The Concierge Clinic. Third-party platforms operate under their own privacy policies, and we are not responsible for their practices or content.
13. Website Platform
The Site is hosted on Squarespace, which collects certain technical and analytics data in connection with Site operation, including cookies, usage data, and server logs. Squarespace’s practices are governed by its own privacy policy, available at www.squarespace.com/privacy.
14. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices, legal requirements, or platforms. When we make material changes, we will update the effective date at the top of this page. For changes that materially affect the use of your PHI, we will provide additional notice as required by HIPAA, which may include direct notice to active patients.
15. Contact Us
For questions, concerns, or to exercise your privacy rights, please contact:
The Concierge Clinic
8869 Brecksville Rd, Suite B
Brecksville, OH 44141
Email: privacy@theconciergeclinic.com
Phone: 440-792-4011
Website: www.theconciergeclinic.com
For HIPAA requests, medical record requests, or a copy of our Notice of Privacy Practices, please contact us by phone or in writing, or ask at your next visit. Please do not submit PHI through the website contact form.