HIPAA Notice

Important Context

Studio Luna provides non-medical aesthetic services. Because we are not a healthcare provider, health plan, or healthcare clearinghouse, we are not generally classified as a "covered entity" under HIPAA (Health Insurance Portability and Accountability Act).

However, we still collect health-related information during intake to ensure your safety. This notice explains how we treat that information.

HIPAA-Aware, Not HIPAA-Regulated

While not strictly required, we voluntarily apply HIPAA-aligned protections to your health information because it's the right thing to do.

What Health Information We Collect

During your consultation and ongoing care, we may collect:

• Medical history (conditions, surgeries, medications)
• Current medications and supplements
• Allergies (drug, latex, topical)
• Pregnancy or breastfeeding status
• Recent aesthetic procedures (injectables, lasers, peels)
• Treatment-area-specific health details
• Before/after treatment photos (with consent only)
• Treatment notes documenting your sessions

This information is collected only for the purpose of determining treatment eligibility, safety, and providing appropriate care.

How We Protect It

We apply the following protections to your health information:

Access controls

• Access limited to staff with direct treatment responsibilities
• All staff trained on confidentiality requirements
• Computer access requires authentication
• Physical records stored in locked filing systems

Technical safeguards

• SSL/TLS encryption for data in transit
• Encrypted storage of digital health records
• Secure email for any health-related communication
• Regular security reviews and updates

Administrative safeguards

• Confidentiality agreements with all staff
• Limited data retention (see below)
• Annual training refresh on privacy practices
• Incident response procedures for any breaches

How We Use Your Health Information

We use health information for:

• Determining treatment eligibility
• Identifying contraindications
• Customizing your treatment plan
• Tracking progress across sessions
• Coordinating with our Medical Director if questions arise
• Responding to emergencies

How We Share It

We do not share your health information except:

• With your explicit consent (e.g., providing records to a physician at your request)
• To our Medical Director when their oversight requires review
• To emergency responders in a medical emergency
• When required by law (court order, subpoena, etc.)
• For treatment-related communications between authorized staff

Affirm Financing

We do not share health information with Affirm or any other financing provider. Affirm's eligibility determination is based on credit and identity verification, not health data.

Your Rights

Regarding your health information at Studio Luna, you have the right to:

• Access your records (request a copy in writing)
• Request corrections to inaccurate information
• Request restrictions on how we use or share your information
• Receive a list of disclosures we've made (other than for treatment)
• Request confidential communications (e.g., reach you only by phone, not email)
• File a complaint if you believe your privacy rights have been violated

Photographs

We may take photographs to document your progress. Specific rules:

• Photos are part of your protected treatment record
• Photos are never shared publicly without explicit, signed written consent
• You may request photos be deleted at any time
• Gallery and marketing use requires separate, optional written consent
• You may withdraw photo consent at any time, and we will remove photos within 30 days

Retention Period

We retain health records for:

• Active clients: Throughout active client relationship
• Inactive clients: 7 years from last visit (California minimum for liability purposes)
• Photos: Same as treatment records, unless consent withdrawn
• Consent forms: 7 years from last visit

After the retention period, records are securely destroyed.

Breach Notification

In the unlikely event of unauthorized access to your health information, we will:

• Notify you within 60 days of discovery
• Describe what information was involved
• Provide guidance on protecting yourself
• Report to relevant authorities if required by California law

Contact & Complaints

To exercise your rights, ask questions, or file a complaint:

• Email: privacy@spastudiolunabodysculpting.com
• Phone: (415) 347-7149
• Mail: Studio Luna Body Sculpting, Attn: Privacy Officer, 6371 Mission St, Daly City, CA 94014

If you believe we have violated your privacy rights, you may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/ocr. We will not retaliate against you for filing a complaint.