Privacy Policy

Effective date: September 18, 2026

This Privacy Policy explains how Total Body Management, the owner and management company of Total Body Aesthetic (“we,” “us,” or “our”), handles information in connection with www.totalbodyaesthetic.com (the “Website”), online appointment and contact requests, newsletters, text-message signups, and online treatment purchases for Total Body Aesthetic. It does not replace a clinical privacy notice that may apply to medical records or care provided by the practice.

1. Information We Collect

Information you provide

• Contact and appointment information: name, email address, telephone number, treatment interests, preferred appointment windows, and messages or questions you submit.
• Skin Quiz: your answers are used in your browser to show suggested treatment interests. If you request a consultation from the quiz, the request includes your contact details, selected treatment interests, and communication-consent choices, but not your individual quiz answers or recommendation explanations. The quiz is not a clinical intake form or a diagnosis.
• Newsletter and communications information: email address, communication preferences, and, when offered, your express consent to receive marketing or appointment text messages.
• Purchase information: name, email address, telephone number, selected treatments, quantities or units, order source, transaction status, and related purchase records. Payment-card details are entered on a secure checkout provided by Stripe; we do not intend to receive full card numbers through the Website itself.
• Other information: information you choose to send by email, telephone, forms, reviews, or other correspondence. Please do not submit sensitive medical details through general marketing or contact forms.

Information collected automatically

When you use the Website, servers and enabled technologies may process IP address, browser and device type, operating system, referring page, pages viewed, dates and times, approximate location derived from IP address, interactions with Website features, and diagnostic or security data. With optional analytics enabled, the Website's custom events may record general interactions such as cart changes, consultation clicks, and checkout starts using limited information such as item counts and interface location. These custom events exclude treatment selections, individual quiz answers, recommendation explanations, contact details, and free-text messages. Hosting and third-party services may separately process page addresses and request information; see our Cookie Policy for available controls and their limits.

2. How Information Is Used

We may use information to respond to inquiries; process appointment requests; assess, contact you about, and schedule requested services; send newsletters or text messages you requested; create and verify checkout sessions; maintain transaction and business records; provide customer service; secure forms and prevent abuse; understand Website performance and engagement; comply with law; and protect our rights, patients, staff, and systems.

Online payment does not itself establish treatment candidacy or a provider-patient relationship. Clinical suitability is assessed separately.

3. Current Service Providers and Data Flows

The Website sends information to service providers as described below so they can perform Website and business functions:

• Stripe: hosted payment checkout, payment processing, transaction verification, and related fraud prevention.
• Constant Contact: synchronization and management of contact and newsletter subscriber information when the integration is connected.
• SendGrid: delivery of form-submission notifications and operational email.
• GoHighLevel/LeadConnector: Website newsletter signups, contact requests, and online order details are sent through a LeadConnector webhook to the business’s GoHighLevel customer-management system. Depending on what you submit, this includes source, name, email address, phone number, message or order details, communication-consent choices, and submission time. If you permit functional technologies and use the LeadConnector chat assistant, LeadConnector also receives the information you provide in that chat and ordinary device and request information needed to load it.
• Replit and Umami: Website hosting/infrastructure and, when Project Analytics is enabled through the publishing proxy, privacy-oriented Website analytics and interaction events.
• Google: embedded Maps, externally hosted fonts or resources on legacy pages, and links to Google services.
• Cherry and CareCredit: financing information, calculators/widgets, or links. Information entered on their sites is governed by their own privacy notices. A legacy Cherry widget may load Cherry scripts and receive device or usage data.
• Roya CDN and other content hosts: delivery of legacy images or other static Website assets, which may involve ordinary request data such as IP address and browser headers.

We may also disclose information to professional advisers and vendors supporting our operations, to law enforcement or regulators when legally required, or as part of a business transaction. State privacy laws may define some disclosures to analytics or other third-party services as a “sale,” “sharing,” or targeted advertising even when no money is exchanged. Available Website controls are described in the Cookie Policy, and you may contact us to ask about a disclosure or request an applicable opt-out.

4. Cookies and Similar Technologies

The Website and its service providers may use cookies, pixels, scripts, local storage, server logs, and similar technologies for essential operation, security, preferences, analytics, embedded content, and payment or financing functionality. Details and available controls appear in our Cookie Policy. Browser controls can block or delete cookies, but portions of the Website may not work as expected. The Website does not currently promise that it responds to every browser “Do Not Track” signal.

5. Communications Choices

You may unsubscribe from marketing email using the link in an email or by contacting us. If you expressly opt in to text messages, message frequency varies and message and data rates may apply. Consent is not a condition of purchase. Reply STOP to opt out or HELP for help. We may still send non-marketing messages necessary to respond to a request or service a transaction where permitted.

Mobile information and text-message opt-in consent will not be sold or shared with third parties or affiliates for their own marketing or promotional purposes. We use this information to provide the messages selected and may provide it to service providers, including GoHighLevel/LeadConnector and telecommunications providers, only as needed to operate and support the messaging program.

6. Retention and Security

How long information is kept depends on the type of record, why it was collected, operational needs, and legal requirements. You may ask about retention of your information using the process below. We use safeguards intended to protect information, but no Internet transmission or storage system can be guaranteed completely secure.

7. Your Privacy Rights

Depending on where you live and subject to legal exceptions, you may have rights to request access, correction, deletion, or a copy of personal information, or to opt out of certain uses or disclosures. California residents may also have rights to know categories and specific pieces of personal information collected, request correction or deletion, and opt out of sale or sharing, without unlawful discrimination.

To make a request, email info@totalbodyaesthetics.com with the subject “Privacy Request” and describe the right you want to exercise and the information involved. You may also call or write using the contact details below. We will use information you provide to locate relevant records and may ask for additional information reasonably needed to verify your identity or an authorized agent’s authority. We will respond through the contact method associated with the request or record. If we cannot fulfill a request, we will explain the reason, subject to applicable law.

8. Children and External Sites

The Website is not directed to children under 13, and we do not knowingly collect personal information from children under 13 through the Website. Third-party links and embedded services have their own terms and privacy practices; review those notices before providing information.

9. Changes to This Policy

We may update this Privacy Policy as practices, technology, or law changes. The effective date at the top will identify the latest version. Material changes may be communicated by a Website notice or another appropriate method.

10. Contact Us

For privacy questions, communication choices, or privacy-rights requests, contact:

Effective and last updated: September 18, 2026