Privacy Policy

Who we are

Virtue & Bloom Med Spa ("Virtue & Bloom," "we," "us") operates this website and the medical spa located at 6655 Travis St. STE 840, Houston, Texas 77030. Questions about this policy can be directed to virtuexbloom@gmail.com or 832-380-4754.

Two kinds of information

This policy covers two categories that are treated differently under the law.

Website information is what we collect when you browse this site, submit the contact form, or book online - your name, email, phone number, the pages you visit, and general device information.

Protected health information (PHI) is what you share in the course of care - medical history, treatment records, photographs, and anything else recorded during a consultation or treatment. PHI is governed by HIPAA and by our Notice of Privacy Practices, which you receive at your first visit and which controls in the event of any conflict with this policy.

What we collect from the website

• Contact details you enter into a form: name, email, phone, and the message you write.
• Appointment preferences you submit, including the treatment you are interested in and your preferred times.
• Technical information collected automatically: IP address, browser type, device type, referring page, and pages visited.
• Cookie and analytics data, described in the section below.

How we use it

• To respond to your enquiry and schedule your consultation.
• To send appointment confirmations, reminders, and aftercare instructions.
• To send marketing emails or texts - only if you have opted in, and every message includes a way to opt out.
• To operate, secure, and improve the website.
• To meet our legal, medical-records, and regulatory obligations.

What we do not do

We do not sell your personal information. We do not sell, rent, or trade PHI under any circumstances. We do not use patient photographs in marketing without separate, specific, written consent that is not a condition of treatment - and that consent can be withdrawn.

No mobile information, including your phone number and text-message opt-in, will be shared with third parties or affiliates for marketing or promotional purposes.

Text messages

If you opt in to texts, we send appointment reminders and, only with your separate consent, occasional offers. Message frequency may vary. Message and data rates may apply. Reply STOP to opt out at any time, or HELP for help.

Who we share it with

We share information only with service providers who help us operate the practice - our booking platform, electronic records system, payment processor, email provider, and website host. Providers who handle PHI do so under a Business Associate Agreement as HIPAA requires.

We may also disclose information where the law requires it, to protect someone’s safety, or in connection with a sale or reorganisation of the practice.

Prayer requests

Prayer requests submitted through this website are handled separately from everything else here. They are optional, they are never a condition of treatment, and they are not part of your medical record.

A request may contain health information even though it is not a medical form, so requests are stored with restricted access and are seen only by the people you select - the two founders, or the practice’s prayer list if you choose that. Requests are never published, never used in marketing, and never added to an email or text list. You can ask us to delete a request at any time by contacting virtuexbloom@gmail.com.

[CONFIRM: name where prayer requests are actually stored and who can access them, and confirm that system is access-controlled rather than a shared inbox.]

Cookies and analytics

This site uses cookies that are necessary for it to function, and analytics cookies that help us understand how the site is used. You can decline non-essential cookies through the banner shown on your first visit, and you can clear or block cookies in your browser at any time.

[CONFIRM: name the specific analytics and advertising tools in use - Google Analytics, Meta Pixel, or similar - and disclose each, since advertising pixels on a healthcare site carry particular scrutiny.]

How long we keep it

Website enquiries are retained for [RETENTION PERIOD]. Medical records are retained for the period Texas law requires - generally seven years from the date of last treatment, and longer for patients who were minors.

Your choices and rights

• Unsubscribe from marketing at any time using the link in any email or by replying STOP to a text.
• Request access to, or a copy of, your medical record.
• Request a correction to your record.
• Request an accounting of certain disclosures of your PHI.
• Ask us to communicate with you by a particular method or at a particular address.
• Withdraw photo or testimonial consent, which stops future use.

Security

We use administrative, physical, and technical safeguards to protect your information, including encrypted transmission of data submitted through this site and access controls on our records systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Children

This website is not directed to children under 13 and we do not knowingly collect their information through it. Patients under 18 are treated only with the consent of a parent or legal guardian.

Changes

We will post any changes to this policy on this page and update the effective date above. Material changes affecting how we handle PHI will be communicated as HIPAA requires.