Privacy Policy

Who We Are and What This Policy Covers

This Privacy Policy explains how Bellamarque Beauty & Lash Co ("we," "us," or "our") handles information when you visit beautylashco.com, contact us, or book and receive services at our studio. Our legal entity is [TODO: confirm registered legal entity name], operating a licensed medical spa at 12843 S Redwood Rd, Unit B, Riverton, UT 84065.

This policy applies to our public marketing website and the forms on it. It does not change the separate notices, consents, and records that govern your clinical care, which are handled inside our booking and records system as described below. If anything here conflicts with a consent you sign in the studio for your treatment, the signed treatment document controls for that care.

Effective date: [TODO: date].

Information You Provide to Us

When you fill out a contact form, request a consult, book an appointment, join a waitlist, or sign up for texts or emails, you may give us information such as your name, phone number, email address, the services you are interested in, and any details you choose to include in a message.

When you book or pay, you also provide the information our booking system needs to schedule and check you in. Payment card details are entered directly into our payment processor's secure vault and are described in the booking and payment section below.

Information We Collect Automatically

When you use our website, we and our analytics providers may automatically collect standard technical and usage information, such as your device type, browser, operating system, IP address, the pages you view, the links you click, and how you arrived at our site.

We collect this information using cookies and similar technologies, described in the next section. We keep marketing and analytics data at the service-category level (for example, an interest in "lashes" or "skin") and do not use these tools to track clinical or patient-level details.

Cookies and Tracking Technologies

We use cookies and similar technologies to run the site, understand how it is used, and measure our marketing. Some are essential for the site to work. Others are optional and are only used when you allow them.

For marketing and analytics we use the Meta Pixel (which runs in your browser) together with the Meta Conversions API (which sends comparable event information from our server, deduplicated against the browser event using a shared event identifier so the same action is not double counted). We also use Google Analytics 4 to understand site traffic and performance.

We use a Consent Mode v2 cookie-consent banner to manage these tools. When you decline, non-essential tracking is suppressed and consent signals are passed to Meta and Google accordingly. You can change your choice at any time through the banner or your cookie settings. You can also block or delete cookies in your browser, although some parts of the site may not work as intended if you do.

Consistent with Meta's health-data rules, we do not share sensitive health information with these advertising tools, and we keep tracking parameters limited to general service categories rather than any clinical or patient-level data.

How We Use Your Information

We use the information we collect to respond to your questions, schedule and manage appointments, provide and improve our services, process payments, send you the communications you have asked for, and keep records we are required to keep.

We also use information to operate, secure, and improve our website, to understand which services and content are useful, and to measure and improve our marketing. We use it to comply with our legal obligations and to protect our rights, our staff, and our clients.

Text Messages and Email Consent

If you opt in to receive text messages from us, you consent to receive appointment, marketing, and informational messages at the number you provide. Message frequency varies. Message and data rates may apply.

You can opt out of texts at any time by replying STOP, and you can reply HELP for help. Consent to receive marketing texts is not a condition of purchasing any service. You can unsubscribe from marketing emails using the link in any email. We use a communications platform to send and manage these messages, as described in the sharing section below.

Booking and Payment Information

We use Boulevard as our booking system and system of record for scheduling and client records. Information you enter to book or check in is stored in Boulevard.

When you pay, your card information is entered directly into Boulevard's PCI-compliant payment vault. Our website's servers never see or store your full card number. We receive only an opaque payment token that lets us reference the transaction without handling card data. Gift cards and memberships are also purchased and managed through Boulevard.

Retail Purchases

Our website may feature retail products through a small storefront powered by Shopify. When you buy a retail product, checkout takes place on Shopify, and your purchase and payment information for that order is handled by Shopify under its own terms and privacy practices.

How We Share Information

We do not sell your personal information for money. We share information with service providers who help us run our business, and only for that purpose. These include, by category: our booking and records platform (Boulevard); our advertising and analytics providers (Meta and Google); our email and text message platform (Omnisend); our retail platform (Shopify); and our website hosting provider (Vercel).

We may also share information when required by law, to respond to lawful requests, to protect the safety and rights of our clients, staff, or business, or in connection with a business transaction such as a merger or sale. Where a data privacy law treats sharing for cross-context behavioral advertising as a "sale" or "share," you can exercise the opt-out choices described below, including our cookie banner and recognized browser signals.

Health Information

As a medical spa, we handle some health information in the course of care. That clinical and health information lives in our booking and records system (Boulevard), not on our marketing website. We intend to operate consistent with applicable health privacy laws, including HIPAA where it applies to us.

We do not run analytics tools or advertising pixels on any authenticated client-portal pages. Information you share with your provider for your care is governed by the consents and notices you receive in connection with that care, not by this website policy.

Data Retention

We keep personal information for as long as we need it for the purposes described in this policy, including to provide services, maintain records, meet legal and professional requirements, resolve disputes, and enforce our agreements.

Retention periods vary by the type of information and the reason we hold it. Clinical records are retained according to the requirements that apply to licensed providers. [TODO: confirm specific retention periods]. When we no longer need information, we take steps to delete or de-identify it.

How We Protect Your Information

We use reasonable administrative, technical, and physical safeguards designed to protect the information we hold, including using established platforms with their own security controls and keeping card data out of our own servers.

No method of transmission or storage is completely secure, so we cannot promise absolute security. If we become aware of a breach that affects your information and the law requires it, we will notify you as required.

Your Choices and Privacy Rights

You can update your contact details, unsubscribe from marketing emails, reply STOP to texts, and adjust your cookie choices through our consent banner at any time. You can also ask us to access, correct, or delete personal information we hold about you, subject to our legal and recordkeeping obligations.

We honor recognized browser privacy signals, including the Global Privacy Control (GPC), as an opt-out of non-essential tracking where required. Because there is no common standard for "Do Not Track" browser signals, we respond to GPC and our cookie banner rather than to other DNT signals.

Depending on where you live, you may have additional rights under laws such as the Utah Consumer Privacy Act or the California Consumer Privacy Act, including the right to know what we collect, to request deletion, to opt out of targeted advertising or the sale or sharing of personal information, and not to be discriminated against for exercising your rights. To make a request, contact us using the details below. We will verify your request before acting on it, and you may use an authorized agent where the law allows.

Children's Privacy

Our website and services are intended for adults. The site is not directed to children under 13, and our services are not intended for anyone under 18 without appropriate consent and provider involvement. We do not knowingly collect personal information from children under 13. If you believe a child has given us information, please contact us and we will take appropriate steps to remove it.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version here and change the effective date at the top. If the changes are significant, we will take reasonable steps to let you know. Your continued use of the site after an update means you accept the revised policy.

Contact Us

If you have questions about this policy or your information, contact us at Bellamarque Beauty & Lash Co, 12843 S Redwood Rd, Unit B, Riverton, UT 84065, by phone at (801) 414-5274, or by email at greg@jedari.com.