Privacy Policy

10. Do United States Residents Have Specific Privacy Rights?

In Short: If you are a resident of California, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. More information is provided below.

L&P Aesthetics Medical, Inc. complies with the California Online Privacy Protection Act (CalOPPA). We will not distribute your personal information to outside parties without your consent except as necessary to provide our services or as required by law.

Given our annual revenue and the number of consumers whose personal information we process, L&P Aesthetics Medical, Inc. may not be required to comply with all provisions of the California Consumer Privacy Act (CCPA). However, we voluntarily choose to offer many of the rights provided by the CCPA to all our patients and website visitors as a demonstration of our commitment to privacy. Specifically, we voluntarily offer rights related to data access, deletion, and opt-out of certain data uses.

Categories of Personal Information We Collect

We have collected the following categories of personal information in the past twelve (12) months:

Category	Examples	Collected
A. Identifiers	Contact details, such as real name, alias, postal address, telephone or mobile contact number, unique personal identifier, online identifier, Internet Protocol address, email address, and account name	YES

B. Personal information as defined in the California Customer Records statute

Name, contact information, education, employment, employment history, and financial information

YES

C. Protected classification characteristics under state or federal law	Gender, age, date of birth, race and ethnicity, national origin, marital status, and other demographic data	YES
D. Commercial information	Transaction information, purchase history, financial details, and payment information	YES
E. Biometric information	Fingerprints and voiceprints	NO
F. Internet or other similar network activity	Browsing history, search history, online behavior, interest data, and interactions with our and other websites, applications, systems, and advertisements	YES
G. Geolocation data	Device location	NO
H. Audio, electronic, sensory, or similar information	Images and audio, video or call recordings created in connection with our business activities	YES
I. Professional or employment-related information	Business contact details in order to provide you our Services at a business level or job title, work history, and professional qualifications if you apply for a job with us	NO
J. Education Information	Student records and directory information	NO
K. Inferences drawn from collected personal information	Inferences drawn from any of the collected personal information listed above to create a profile or summary about, for example, an individual’s preferences and characteristics	NO
L. Sensitive personal Information	Contents of email or text messages and health data	YES

We only collect sensitive personal information, as defined by applicable privacy laws or the purposes allowed by law or with your consent. Sensitive personal information may be used, or disclosed to a service provider or contractor, for additional, specified purposes. You may have the right to limit the use or disclosure of your sensitive personal information. We do not collect or process sensitive personal information for the purpose of inferring characteristics about you.

We collect the following additional categories of personal information via Meta Pixel:

• Online identifiers
• Internet or other electronic network activity information
• Inferences drawn from other personal information to create a profile about a consumer

We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of:

• Receiving help through our customer support channels;
• Participation in customer surveys or contests; and
• Facilitation in the delivery of our Services and to respond to your inquiries.

We will use and retain the collected personal information as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. The duration of retention for specific categories is as follows:

• Category A (Identifiers): We will retain this information for 7 years from the last point of contact or service provision, whichever is later.
• Category B (Personal information as defined in the California Customer Records statute): We will retain this information for 7 years from the last point of contact or service provision, whichever is later.
• Category C (Protected classification characteristics under state or federal law): We will retain this information for 7 years from the last point of contact or service provision, whichever is later.
• Category D (Commercial information): We will retain this information for 10 years to comply with tax and financial record-keeping requirements and to handle any potential disputes or claims.
• Category F (Internet or other similar network activity): We will retain this information for 5 years from the date of collection.
• Category H (Audio, electronic, visual, and similar information): We will retain this information for 7 years from the date of collection or last service provision, whichever is later.
• Category L (Sensitive personal Information): We will retain health data in accordance with HIPAA requirements and state laws, which is typically 10 years from the last date of service or 3 years after a minor patient reaches the age of majority, whichever is later. Other sensitive personal information will be retained for 7 years from the last point of contact or service provision, whichever is later.

For all categories, we may retain the information for a longer period if:

1. Retention is required or allowed by law;
2. The information is necessary for the establishment, exercise, or defense of legal claims;
3. Retention is necessary for legitimate business purposes, such as long-term patient care, analysis of long-term trends, or historical record-keeping;
4. You have given consent for extended retention.

These retention periods apply whether you become a patient or simply submit a form or make an inquiry. We retain information from all interactions to handle inquiries, improve our services, maintain comprehensive records for returning patients, and comply with legal obligations.

You may request that we delete your personal information at any time, subject to certain exceptions provided by law. Upon receiving a verified request for deletion, we will delete your personal information from our records unless an exception applies.

We review our retention periods for personal information on a regular basis. We are legally required to hold some types of information to fulfill our statutory obligations. We will securely delete or anonymize your personal data when we no longer need it for the purposes we collected it for, or for legal, accounting, or reporting requirements.

Sources of Personal Information

Learn more about the sources of personal information we collect in “WHAT INFORMATION DO WE COLLECT?“

How We Use and Share Personal Information

Learn about how we use your personal information in the section, “HOW DO WE PROCESS YOUR INFORMATION?“

We collect and share your personal information through:

• Targeting cookies/Marketing cookies
• Beacons/Pixels/Tags
• Social media plugins: Instagram Feed by Unlimited Elements. We use social media features, such as a “Like” button, and widgets, such as a “Share” button, in our Services. Such features may process your Internet Protocol (IP) address and track which page you are visiting on our website. We may place a cookie to enable the feature to work correctly. If you are logged in on a certain social media platform and you interact with a widget or button belonging to that social media platform, this information may be recorded to your profile of such social media platform. To avoid this, you should log out from that social media platform before accessing or using the Services. Social media features and widgets may be hosted by a third party or hosted directly on our Services. Your interactions with these features are governed by the privacy notices of the companies that provide them. By clicking on one of these buttons, you agree to the use of this plugin and consequently the transfer of personal information to the corresponding social media service. We have no control over the essence and extent of these transmitted data or their additional processing.
• We use Meta Pixel for analytics and advertising purposes, which involves sharing certain personal information with Meta platforms.

Will your information be shared with anyone else?

We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information to in the section, “WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?“

We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be “selling” of your personal information.

We have disclosed the following categories of personal information to third parties for a business or commercial purpose in the preceding twelve (12) months:

• Category A. Identifiers
• Category B. Personal information as defined in the California Customer Records law
• Category C. Characteristics of protected classifications under state or federal law
• Category D. Commercial information
• Category F. Internet or other electronic network activity information
• Category H. Audio, electronic, visual, and similar information

The categories of third parties to whom we disclosed personal information for a business or commercial purpose can be found under “WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?“

We have sold or shared the following categories of personal information to third parties in the preceding twelve (12) months:

The categories of third parties to whom we sold personal information are:

The categories of third parties to whom we shared personal information with are:

• Advertising, Direct Marketing, and Lead Generation

Facebook Audience Network, Bing Ads, Google AdSense, Google Analytics, Constant Contact, CallRail, Google Tag Manager, GA4, Meta Ads, Instagram Ads, Reddit Ads, Youtube Ads, Yelp Ads, TikTok Ads, Linktree and Linkedin Ads

• Retargeting Platforms

Facebook Remarketing, Facebook Custom Audience, Google Ads Remarketing , Google Analytics Remarketing and LinkedIn Website Retargeting

• Social Media Sharing and Advertising

Facebook advertising, Facebook social plugins, Instagram advertising, LinkedIn advertising, Pinterest advertising, Pinterest social plugins and YouTube social plugins

• Web and Mobile Analytics

Amplitude, Facebook Ads conversion tracking, Facebook Analytics, Google Ads, Google Analytics, Google Tag Manager, Hotjar and WordPress Stats

Your Rights

You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:

• Right to know whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request the deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California’s privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”)

Depending upon the state where you live, you may also have the following rights:

• Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including California’s privacy law)
• Right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including California’s privacy law)

How to Exercise Your Rights

To exercise these rights, you can contact us by submitting a data subject access request, by emailing us at [email protected], or by referring to the contact details at the bottom of this document.

You can opt out from the selling of your personal information, targeted advertising, or profiling by disabling cookies in Cookie Preference Settings.

Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with applicable laws.

Request Verification

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.

If you submit the request through an authorized agent, we may need to collect additional information to verify your identity before processing your request and the agent will need to provide a written and signed permission from you to submit such request on your behalf.

California “Shine The Light” Law

California Civil Code Section 1798.83, also known as the “Shine The Light” law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in the section “HOW CAN YOU CONTACT US ABOUT THIS NOTICE?“

Role of the California Privacy Protection Agency (CPPA): The CPPA is responsible for implementing and enforcing the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). While we may not be directly subject to all CCPA/CPRA requirements due to our size, we respect the CPPA’s role in protecting California residents’ privacy rights. The CPPA provides guidelines that inform our privacy practices, and California residents have the right to file complaints with the CPPA if they believe their privacy rights have been violated.