NOTICE OF PRIVACY PRACTICES 

NOTICE OF PRIVACY PRACTICES 

Embrace Beauty Med Spa Effective Date: October 25, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

OUR COMMITMENT TO YOUR PRIVACY

Embrace Beauty Med Spa is committed to protecting the privacy of your health and personal information. We are required by federal law — specifically the Health Insurance Portability and Accountability Act of 1996 (HIPAA) — and by California's Confidential Medical Information Act (CMIA) to maintain the privacy of your protected health information (PHI), to provide you with this Notice of our legal duties and privacy practices, and to follow the terms of this Notice currently in effect.

"Protected Health Information" (PHI) means information about you — including demographic, medical, and financial information — that may identify you and that relates to your past, present, or future physical or mental health, the provision of healthcare services to you, or payment for those services.

SECTION 1 — HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION

The following describes the ways we may use and disclose your protected health information. Not every use or disclosure in a category will be listed, but all of the ways we are permitted to use and disclose information will fall within one of the following categories.

Treatment We may use your PHI to provide, coordinate, or manage your aesthetic treatments and related services. For example, your provider may share information about your treatment history with another licensed provider involved in your care.

Payment We may use or disclose your PHI to obtain payment for services we provide to you. For example, we may provide information to your financing company (such as CareCredit, Cherry, or Affirm) or payment processor to verify and process your transaction.

Healthcare Operations We may use and disclose your PHI for our internal business operations, including:

  • Quality assessment and improvement activities

  • Staff training and performance evaluation

  • Scheduling and appointment management

  • Compliance with legal and regulatory requirements

  • Business planning and management

Appointment Reminders We may use your contact information to remind you of scheduled appointments via phone call, text message, or email. You may request that reminders be sent through a specific channel.

Treatment Alternatives and Services We may use your PHI to tell you about or recommend possible treatment alternatives or other health-related services that may be of interest to you.

As Required by Law We will disclose your PHI when required to do so by applicable federal, state, or local law, including in response to a court order, subpoena, or lawful government request.

Public Health Activities We may disclose your PHI to authorized public health authorities for activities such as reporting communicable diseases, reporting adverse events related to medications or products, or notifying individuals of recalls.

Health Oversight Activities We may disclose your PHI to government oversight agencies for activities authorized by law, such as audits, investigations, inspections, and licensure purposes. For example, disclosures to the California Department of Public Health or the California Board of Registered Nursing.

Law Enforcement Under certain circumstances, we may disclose your PHI to law enforcement officials in response to a court order, warrant, subpoena, or summons, or as otherwise authorized or required by law.

Serious Threats to Health or Safety We may use or disclose your PHI when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, consistent with applicable law.

Workers' Compensation We may release your PHI as authorized by and to the extent necessary to comply with California Workers' Compensation law.

Business Associates We may share your PHI with our business associates — third-party vendors who perform services on our behalf, such as electronic medical records systems, scheduling platforms, and billing services — provided those parties agree in writing to safeguard your PHI in accordance with HIPAA.

SECTION 2 — USES AND DISCLOSURES REQUIRING YOUR WRITTEN AUTHORIZATION

All other uses and disclosures of your PHI not described in Section 1 will be made only with your written authorization. This includes:

  • Marketing communications — We will not use your PHI to send you marketing materials without your prior written authorization

  • Sale of PHI — We will never sell your protected health information

  • Psychotherapy notes — Any use or disclosure of psychotherapy notes requires your separate written authorization

  • Most uses of PHI for research — Requires your authorization unless specific exceptions apply

You may revoke any authorization you have given us at any time by submitting a written request to our Privacy Officer. Revocation will not apply to information we have already used or disclosed in reliance on your authorization.

SECTION 3 — YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION

You have the following rights with respect to your protected health information. To exercise any of these rights, please submit a written request to our Privacy Officer using the contact information at the end of this Notice.

Right to Inspect and Copy You have the right to inspect and obtain a copy of your PHI that is contained in a designated record set, including your medical records and billing records. We may charge a reasonable fee for copies. We will respond to your request within 30 days.

Right to Request Amendment If you believe that health information we have about you is incorrect or incomplete, you may request that we amend it. We may deny your request if the information was not created by us, is not part of our records, or is accurate and complete. If we deny your request, we will notify you in writing with the reason for the denial.

Right to an Accounting of Disclosures You have the right to request a list of certain disclosures we have made of your PHI during the previous six years. This accounting will not include disclosures made for treatment, payment, or healthcare operations, or disclosures made with your authorization.

Right to Request Restrictions You have the right to request restrictions on how we use or disclose your PHI for treatment, payment, or healthcare operations. You also have the right to request a restriction on disclosure to a health plan for a service you paid for out of pocket in full. We are not required to agree to other requested restrictions; however, if we do agree, we will comply with your request except in emergency situations.

Right to Request Confidential Communications You have the right to request that we communicate with you about your PHI in a certain way or at a certain location. For example, you may ask that we contact you only by text message or only at a specific phone number. We will accommodate reasonable requests.

Right to a Paper Copy of This Notice You have the right to receive a paper copy of this Notice at any time, even if you have agreed to receive it electronically. To obtain a paper copy, contact us using the information below.

Right to Be Notified of a Breach You have the right to be notified in the event of a breach of your unsecured PHI in accordance with applicable federal and California law.

Right to File a Complaint If you believe your privacy rights have been violated, you have the right to file a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights (OCR). Filing a complaint will not result in any retaliation against you.

To file a complaint with HHS: U.S. Department of Health and Human Services Office for Civil Rights

200 Independence Avenue, SW Washington, D.C. 20201

📞 1-800-368-1019 TDD: 1-800-537-7697

🌐 www.hhs.gov/ocr/privacy/hipaa/complaints

SECTION 4 — OUR DUTIES

Embrace Beauty Med Spa is required by law to:

  • Maintain the privacy and security of your protected health information

  • Provide you with this Notice of our legal duties and privacy practices

  • Follow the terms of this Notice currently in effect

  • Notify you promptly in the event of a breach of your unsecured PHI

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have about you as well as any PHI we receive in the future. We will post the current Notice on our website and make it available at our office. You may request a copy of the current Notice at any time.

SECTION 5 — CALIFORNIA-SPECIFIC RIGHTS

As a California resident, you have additional rights under the California Confidential Medical Information Act (CMIA), Civil Code §56 et seq., and the California Consumer Privacy Act (CCPA), Civil Code §1798.100 et seq., including:

  • The right to know what personal information we collect about you

  • The right to request deletion of your personal information, subject to certain exceptions

  • The right to opt out of the sale of personal information (we do not sell your information)

  • The right to non-discrimination for exercising your privacy rights

For more information about your California rights, please see our Privacy Policy at https://embracebeautymedspa.com/ or contact our Privacy Officer directly.

SECTION 6 — CONTACT OUR PRIVACY OFFICER

If you have any questions about this Notice or wish to exercise any of your rights, please contact our Privacy Officer:

Privacy Officer 

Embrace Beauty Med Spa 2140 W Chapman Ave, Suite 200 Orange, CA 92868 

📞 714-627-4338

 📧 embracebeautymedspa@gmail.com 

🌐 https://embracebeautymedspa.com/

We will respond to all written requests within 30 days of receipt.


This Notice of Privacy Practices is effective as of October 25, 2026. A copy of this Notice is available at our front desk and at https://embracebeautymedspa.com/.

Embrace Beauty Med Spa | 2140 W Chapman Ave, Suite 200 | Orange, CA 92868 

📞 714-627-4338 | 

📧 embracebeautymedspa@gmail.com