Notice of Privacy Practices

This Notice of Privacy Practices describes how The Mila MedSpa may use and disclose health and medical information about patients to carry out treatment, payment, and certain healthcare operations. It also describes the rights patients may have to access and control their protected health information and how they may exercise those rights. Finally, it describes The Mila MedSpa’s responsibilities relating to protected health information where applicable.

“Protected Health Information” (PHI) refers to individually identifiable health information that relates to a person’s physical or mental health, the provision of healthcare, or payment for healthcare. This may include information shared during consultations, treatment planning, follow-up communications, and related administrative records.

The Mila MedSpa is a medical aesthetics and medical weight-loss practice. The services described in this Notice are limited to those actually offered by The Mila MedSpa, including facial and skin treatments, injectables, hair and scalp rejuvenation, body sculpting, and medical weight-loss programs.

Our Commitment to Privacy

The Mila MedSpa is committed to protecting the privacy and confidentiality of patient health information. We apply reasonable administrative, technical, and physical safeguards to help protect protected health information from unauthorized use or disclosure, consistent with applicable legal and regulatory requirements.

This Notice does not represent a guarantee of absolute security, and no method of transmitting or storing information is completely secure. Publishing this Notice does not, by itself, establish that The Mila MedSpa is HIPAA certified, HIPAA approved, or automatically HIPAA compliant.

How Health Information May Be Used for Treatment

The Mila MedSpa may use and disclose health information as appropriate to provide, coordinate, or manage care and related services. This may include sharing information with clinicians, staff, or other parties involved in a patient’s care, as permitted by applicable law.

Examples of treatment-related uses that may apply to The Mila MedSpa include:

• Medical aesthetic consultations and evaluations
• Facial and skin treatment consultations
• Injectable treatment consultations and services
• PRP facial treatments and treatment planning
• PRP hair and scalp treatments and planning
• Hair and scalp treatment planning
• Body sculpting consultations and treatments
• Medical weight-loss consultations
• Personalized weight-loss programs
• Semaglutide programs and Tirzepatide programs
• Treatment planning, progress monitoring, and follow-up care

Payment

The Mila MedSpa may use and disclose health and personal information as appropriate for payment-related activities, such as:

• Payment processing and billing
• Invoices and outstanding balances
• Administrative payment matters
• Insurance-related processes, only when applicable and where coverage is involved
• Financing-related administrative processes, only when applicable

This Notice does not state that The Mila MedSpa accepts any particular insurance or financing arrangement. Eligibility, coverage, and payment options are confirmed during consultation.

Healthcare Operations

The Mila MedSpa may use and disclose information for appropriate operational purposes that help the practice function, including:

• Appointment scheduling and confirmations
• Patient and customer support
• Quality assurance and internal reviews
• Staff training and professional review
• Compliance activities and administrative management
• Medical record maintenance and treatment documentation
• Business operations and follow-up coordination

Information That May Be Collected

In connection with the services it offers, The Mila MedSpa may collect reasonable categories of information, which may include:

• Name and personal identification information
• Contact information
• Appointment and consultation information
• Relevant medical history
• Treatment information, plans, and progress
• Weight-loss program information, when applicable, and medication-related information when clinically relevant
• Treatment photographs, when applicable
• Payment and billing information
• Communications submitted through website forms, phone, email, or SMS

Not every category is necessarily collected from every patient. The information collected depends on the services requested and the individual treatment plan developed during consultation.

Photography & Treatment Documentation

Photography and visual documentation are relevant to the aesthetic services provided by The Mila MedSpa. It is important to distinguish between clinical or treatment documentation and marketing, advertising, or social media use.

Clinical / Treatment Documentation

Photographs may be taken, when appropriate, for legitimate clinical purposes such as:

• Clinical documentation and medical record maintenance
• Treatment planning
• Before-and-after comparison for clinical reference
• Treatment progress monitoring

Marketing / Advertising / Social Media Use

Identifiable patient photographs should not be used publicly for marketing, advertising, website galleries, social media, promotional materials, or educational or promotional content without appropriate authorization where required.

Booking an appointment, completing a website form, or receiving treatment does not by itself grant authorization to use identifiable photographs for marketing or promotional purposes. Any marketing or media authorization is separate from consent for treatment or general website inquiries.

Electronic Communications, SMS & Email

The Mila MedSpa may use electronic communications for purposes such as:

• Appointment confirmations and reminders
• Scheduling communications and follow-up
• Treatment-related instructions, where applicable
• Administrative communications and relevant care information

Where SMS text messaging is used, message and data rates may apply. Marketing or promotional communications are sent only subject to applicable consent requirements, and patients may opt out of marketing communications where applicable.

This Notice does not state that ordinary email, SMS, or website forms are automatically HIPAA-secure or encrypted. Patients are advised not to send highly sensitive health information through unsecured communication channels. For sensitive matters, please contact The Mila MedSpa directly by phone during business hours.

Uses and Disclosures Permitted or Required by Law

The Mila MedSpa may use or disclose health information when permitted or required by applicable law, including general categories such as:

• Public health activities
• Health oversight activities
• Legal proceedings, when legally required
• Law enforcement, when legally required
• Compliance with federal or state regulations
• Prevention of serious threats to health or safety
• Workers’ compensation, where applicable
• Other disclosures required or permitted by applicable law

Uses Requiring Authorization

Written authorization may be required for certain uses or disclosures that are not otherwise permitted or required by law. Examples may include:

• Certain marketing communications
• Identifiable before-and-after photographs used publicly
• Identifiable treatment photographs used for promotion
• Certain disclosures outside permitted treatment, payment, or healthcare-operation purposes

An authorization may generally be revoked in writing, subject to applicable limitations and any actions already taken in reliance on it.

Patient Privacy Rights

Under applicable privacy law, patients may have certain rights relating to their protected health information, including the right to:

• Inspect or access their medical records
• Request copies of their records
• Request corrections or amendments to their records
• Request restrictions on certain uses or disclosures
• Request confidential communications
• Receive an accounting of certain disclosures
• Obtain a paper or electronic copy of this Notice
• File a privacy complaint

The Mila MedSpa’s Responsibilities

The Mila MedSpa is responsible for complying with applicable privacy obligations relating to protected health information. This includes:

• Maintaining the privacy of PHI where required
• Following applicable legal and privacy requirements
• Providing this Notice and following the Notice in effect
• Updating the Notice when appropriate or permitted by law
• Responding appropriately to privacy-related requests
• Maintaining reasonable safeguards

Breach Notification

Affected individuals will be notified when notification is required by applicable law following a breach of unsecured protected health information. This Notice does not promise notification where it is not legally required, and it does not make claims about breach prevention or absolute system security.

Privacy Complaints

Patients may contact The Mila MedSpa with privacy-related questions, concerns, or complaints. The Mila MedSpa will not retaliate against a patient solely for filing a privacy complaint.

You may reach us using the general contact information listed in the Contact Information section below.

U.S. Department of Health and Human Services

Individuals may also file a privacy complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. This Notice is not legal advice, and information about filing a complaint with the Office for Civil Rights is available through official HHS resources.

Changes to This Notice

The Mila MedSpa may revise or update this Notice of Privacy Practices when appropriate or permitted by law. The current version may be posted on the website with an updated effective or revision date. This Notice does not claim any unsupported retroactive legal effect.

Contact Information

For privacy questions, concerns, or to exercise any of the rights described in this Notice, please contact The Mila MedSpa using the information below.

Regular Hours:

• Monday: 9:00 AM – 7:00 PM
• Tuesday: 9:00 AM – 7:00 PM
• Wednesday: 9:00 AM – 7:00 PM
• Thursday: 9:00 AM – 7:00 PM
• Friday: 9:00 AM – 7:00 PM
• Saturday: 9:00 AM – 7:00 PM
• Sunday: Closed