Privacy Policy

To the extent information is protected health information under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and Nexa Med Spa is acting as a HIPAA-covered entity or business associate, our Notice of Privacy Practices and applicable law govern that information. If this Privacy Policy conflicts with our Notice of Privacy Practices regarding protected health information, the Notice of Privacy Practices controls.

1. Information We Collect

Depending on how you interact with Nexa Med Spa, we may collect the following categories of information.

A. Contact and identifying information

This may include:

• Name;
• Mailing address;
• Email address;
• Telephone or mobile phone number;
• Date of birth;
• Account or patient identification information; and
• Other information used to identify or communicate with you.

B. Appointment and service information

This may include:

• Appointment requests, dates, times, and locations;
• Services or treatments in which you express interest;
• Provider or location preferences;
• Consultation requests;
• Appointment status, reminders, confirmations, and cancellations; and
• Communications concerning past or upcoming appointments.

C. Health and treatment-related information

When you voluntarily provide it through a secure form, patient portal, consultation request, or other authorized channel, we may collect information such as:

• Medical history;
• Medications, allergies, symptoms, or health concerns;
• Treatment goals and areas of concern;
• Information about prior aesthetic, wellness, or medical services;
• Photographs, videos, facial images, or scan data submitted for consultation or treatment planning;
• Insurance, prescription, laboratory, or clinical information; and
• Other information relevant to evaluating, scheduling, or providing services.

Please do not submit detailed health information through a general website contact form, social media message, or other channel that is not identified as a secure patient communication method.

D. Payment and transaction information

We or our payment service providers may collect:

• Billing address;
• Payment card or bank account information;
• Transaction details;
• Purchase and refund history;
• Membership or package information; and
• Information needed to prevent fraud or process a payment.

Payment information may be collected directly by a third-party payment processor. Its privacy policy and terms may also apply.

E. Website, device, and usage information

When you use our website, we or our service providers may automatically collect:

• Internet Protocol address;
• Browser and device type;
• Operating system;
• Referring and exit pages;
• Pages viewed and links selected;
• Approximate location derived from an IP address;
• Date, time, and duration of a visit;
• Cookie, pixel, device, or similar identifiers; and
• Information about interactions with our website or digital advertising.

F. Communications and preferences

We may collect:

• Messages submitted through forms, email, SMS, chat, or social media;
• Call or communication records where permitted by law;
• Marketing preferences;
• SMS and email consent records;
• Opt-out requests; and
• Responses to surveys, promotions, or feedback requests.

G. Information received from other sources

We may receive information from:

• Scheduling, patient engagement, or electronic health record platforms;
• Payment processors;
• Referral partners;
• Health care providers involved in your care, when authorized or otherwise permitted by law;
• Advertising, analytics, or social media platforms;
• Publicly available sources; and
• Vendors that help us verify, update, secure, or manage information.

2. How We Use Information

Nexa Med Spa may use personal information to:

• Respond to questions and consultation requests;
• Schedule, confirm, modify, or cancel appointments;
• Send appointment reminders and related service communications;
• Provide and coordinate aesthetic, wellness, or medical services;
• Verify identity and maintain patient or customer records;
• Process payments, memberships, packages, credits, and refunds;
• Communicate pretreatment, aftercare, follow-up, or administrative information;
• Personalize website content and improve the patient experience;
• Operate, evaluate, secure, and improve our website and services;
• Conduct quality assurance, auditing, reporting, and internal business operations;
• Prevent fraud, misuse, security incidents, or unlawful activity;
• Send newsletters, promotions, or information about Nexa Med Spa when permitted by law and consistent with your communication preferences;
• Comply with legal, regulatory, licensing, insurance, recordkeeping, and professional obligations;
• Establish, exercise, or defend legal claims; and
• Carry out another purpose disclosed when the information is collected or authorized by you.

Protected health information is used and disclosed only as described in our Notice of Privacy Practices, a valid authorization, or applicable law.

3. How We Disclose Information

We may disclose personal information in the following circumstances.

A. Nexa Med Spa personnel and clinical providers

Information may be made available to authorized employees, contractors, licensed providers, medical leadership, and other workforce members who need it to perform their responsibilities.

B. Service providers

We may use vendors that provide services such as:

• Website hosting and maintenance;
• Electronic health records and patient portals;
• Appointment scheduling;
• Payment processing;
• Email and text-message delivery;
• Customer support and patient engagement;
• Data storage and document management;
• Cybersecurity, fraud prevention, and information technology support;
• Analytics and website performance measurement;
• Advertising or campaign management, where enabled;
• Accounting, auditing, insurance, and legal services; and
• Other operational support.

These service providers may use information only to provide contracted services or as otherwise permitted by law. When a vendor creates, receives, maintains, or transmits protected health information on our behalf, Nexa Med Spa will use a business associate agreement when HIPAA requires one.

C. Health care and payment activities

Where permitted by applicable law, information may be disclosed to providers, laboratories, pharmacies, insurers, payment platforms, or others involved in treatment, payment, care coordination, or health care operations.

D. Legal, safety, and regulatory purposes

We may disclose information when we reasonably believe disclosure is necessary to:

• Comply with a law, regulation, subpoena, court order, or lawful government request;
• Respond to a health oversight, licensing, or regulatory authority;
• Protect the rights, property, health, or safety of Nexa Med Spa, our patients, or another person;
• Investigate suspected fraud, misuse, security incidents, or unlawful activity; or
• Establish, exercise, or defend legal claims.

Disclosures of protected health information remain subject to HIPAA and other applicable health-information privacy requirements.

E. Business transactions

Information may be disclosed as part of a proposed or completed merger, acquisition, financing, reorganization, sale of assets, or similar business transaction, subject to applicable confidentiality and legal requirements.

F. At your direction

We may disclose information when you request, authorize, or direct us to do so.

4. HIPAA and Protected Health Information

Not every piece of information collected through a public website is protected health information under HIPAA. Information generally becomes protected health information when it is created or received by a HIPAA-regulated entity and relates to an identifiable person’s health, health care, or payment for health care.

When HIPAA applies, Nexa Med Spa may use and disclose protected health information for treatment, payment, health care operations, and other purposes permitted or required by law. Uses and disclosures that require a written authorization will not be made without a valid authorization.

Our Notice of Privacy Practices provides additional information about:

• Accessing or obtaining a copy of a medical record;
• Requesting a correction;
• Requesting confidential communications;
• Requesting restrictions;
• Receiving an accounting of certain disclosures;
• Selecting a personal representative;
• Filing a privacy complaint; and
• Nexa Med Spa’s responsibilities concerning protected health information.

Nexa Med Spa applies administrative, physical, and technical safeguards designed to protect electronic protected health information. Vendors handling protected health information on our behalf must be appropriately evaluated and, when required, enter into business associate agreements.

HIPAA-covered providers that maintain a service website must separately make their Notice of Privacy Practices available on that website; a general website privacy policy does not replace that notice. HHS published revised model notices in February 2026.

5. Text Messaging and SMS

Text messaging. NexaMedSpa may send appointment reminders and related messages by SMS to patients who opt in. Mobile phone numbers collected for text messaging are not shared or sold to third parties, and are not shared with affiliates for marketing purposes. Message frequency varies by appointment activity, typically no more than a few messages per appointment. Message and data rates may apply. Reply STOP to opt out or HELP for help.

NexaMedSpa may use a contracted messaging service provider solely to transmit and manage messages on our behalf. Such a provider may not use mobile phone numbers or SMS consent information for its own marketing or promotional purposes.

By providing a mobile number and opting in, you represent that you are authorized to use that number and agree to receive the messages described above. You may withdraw your consent at any time by replying STOP. After an opt-out request, we may send one final message confirming that the request was processed. For assistance, reply HELP or contact Nexa Med Spa using the information below.

Opting out of SMS messages will not prevent you from receiving services, but you may need to contact us by telephone, patient portal, or another available method to manage appointments.

Standard SMS messages may not be encrypted and may be visible to anyone with access to your device, mobile account, or message notifications. Nexa Med Spa limits the content of appointment messages when appropriate, but cannot guarantee the security of information transmitted through a mobile carrier.

Do not use text messaging to report an emergency or an urgent medical concern. Call 911 or seek immediate medical care when appropriate.

HIPAA generally treats appointment reminders as treatment communications, while electronic patient communications still require reasonable safeguards. FCC rules separately address consent and honoring reasonable revocation requests for covered automated texts.

6. Email and Marketing Communications

Nexa Med Spa may send administrative or service-related emails concerning appointments, accounts, transactions, consultations, or changes affecting our services.

With your consent or as otherwise permitted by law, we may also send newsletters, promotions, event announcements, educational information, or other marketing communications. You may unsubscribe from marketing emails by using the unsubscribe link included in the message or contacting us.

Unsubscribing from marketing communications does not prevent Nexa Med Spa from sending non-promotional messages necessary to manage an appointment, transaction, patient relationship, legal notice, or safety matter.

Protected health information will not be used or disclosed for a purpose that requires HIPAA authorization unless Nexa Med Spa has obtained a valid authorization.

7. Cookies and Similar Technologies

Nexa Med Spa and its service providers may use cookies, pixels, web beacons, tags, local storage, and similar technologies to:

• Keep the website functioning;
• Remember preferences;
• Measure traffic and website performance;
• Understand how visitors interact with content;
• Detect errors, fraud, or security threats; and
• Measure or deliver advertising where such technologies are enabled.

Cookies may be classified as strictly necessary, functional, analytics, or advertising cookies. You may be able to manage certain cookies through a cookie preference tool or browser settings. Disabling cookies may affect website functionality.

We do not intend for advertising or analytics vendors to receive protected health information. Tracking technologies on patient portals, appointment pages, registration forms, symptom tools, or other pages that collect identifiable health information must be configured and managed in accordance with HIPAA when applicable.

Simply describing a tracking technology in a privacy policy or asking a visitor to accept cookies does not, by itself, authorize a disclosure of protected health information under HIPAA. When a tracking vendor receives protected health information on behalf of a regulated provider, a permitted disclosure and an appropriate business associate agreement may be required.

8. Sale, Sharing, and Targeted Advertising

Nexa Med Spa does not sell protected health information or SMS opt-in information.

Nexa Med Spa does not sell personal information in exchange for money. We may disclose limited website or device information to analytics or advertising providers where those tools are enabled. Certain state privacy laws may define some advertising-related disclosures as a “sale,” “sharing,” or use for targeted advertising even when no money is exchanged.

Where applicable law provides such a right, you may request to opt out of the sale or sharing of personal information, targeted advertising, or qualifying profiling by:

• Emailing legal [at] nexamedspa.com

Nexa Med Spa does not use protected health information for targeted advertising unless expressly permitted by law and supported by any authorization that may be required.

9. Data Retention

We retain personal information for as long as reasonably necessary to:

• Provide services;
• Maintain clinical, business, and transaction records;
• Fulfill the purposes described in this Privacy Policy;
• Comply with medical-record, tax, accounting, licensing, insurance, and legal requirements;
• Resolve disputes;
• Enforce agreements; and
• Detect or respond to security incidents.

Retention periods vary based on the type of information, the relationship involved, and applicable legal requirements. When information is no longer reasonably needed, we may securely delete, destroy, anonymize, or de-identify it, subject to applicable law and record-retention obligations.

10. Information Security

Nexa Med Spa uses administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, loss, or disclosure.

Measures may include:

• Access restrictions;
• Authentication controls;
• Encryption where appropriate;
• Secure transmission methods;
• Vendor oversight;
• Workforce privacy and security training;
• Data backup and recovery procedures;
• Security monitoring; and
• Incident-response processes.

No website, storage platform, email system, mobile carrier, or transmission method can be guaranteed to be completely secure. You are responsible for protecting passwords, devices, accounts, and access credentials used to communicate with us.

When required, Nexa Med Spa will provide notices concerning qualifying privacy or security incidents in accordance with HIPAA and other applicable breach-notification laws.

11. Your Privacy Rights and Choices

Depending on your state of residence and the law applicable to Nexa Med Spa, you may have the right to:

• Confirm whether we process your personal information;
• Access personal information;
• Correct inaccuracies;
• Request deletion;
• Obtain a portable copy of certain information;
• Withdraw consent for processing based on consent;
• Opt out of targeted advertising, qualifying profiling, or the sale or sharing of personal information;
• Limit certain uses of sensitive personal information;
• Appeal the denial of a privacy request; and
• Exercise a privacy right without unlawful discrimination.

These rights may be subject to exceptions. For example, Nexa Med Spa may need to retain information to comply with medical-record requirements, complete a transaction, protect safety or security, exercise legal rights, or satisfy another legal obligation.

To submit a non-HIPAA website privacy request, contact:

Email: legal [at] nexamedspa.com

We may request information needed to verify your identity and authority. An authorized agent may submit a request when permitted by law, but we may require verification of the agent’s authority.

To appeal a denied request, send a written request titled “Privacy Request Appeal” to the privacy email address above. We will review and respond within the period required by applicable law.

Requests concerning medical records or other HIPAA rights should be submitted through the process described in our Notice of Privacy Practices.

Indiana’s Consumer Data Protection Act became effective January 1, 2026 and provides qualifying consumers with privacy rights when its applicability thresholds are met, while also containing HIPAA-related exceptions. Nexa should confirm applicability based on its current volume, data practices, and corporate structure.

12. De-Identified and Aggregated Information

We may create or use information that has been aggregated or de-identified so that it is not reasonably linkable to an identifiable individual. We may use such information for analytics, quality improvement, operational planning, education, research, or other lawful purposes.

When protected health information is de-identified under HIPAA, Nexa Med Spa will apply an accepted HIPAA de-identification method.

13. Third-Party Websites and Platforms

Our website may link to patient portals, payment platforms, social media services, product websites, financing providers, or other third-party services.

A third party’s privacy policy and terms govern information it collects for its own purposes. Nexa Med Spa is not responsible for the privacy, security, availability, or content of a third-party website or platform that is not controlled by Nexa Med Spa.

A vendor operating on behalf of Nexa Med Spa remains subject to its contractual obligations and applicable privacy requirements.

14. Children’s Privacy

Our public website is not directed to children under 13, and we do not knowingly collect personal information online directly from children under 13 without legally sufficient parental or guardian authorization.

When Nexa Med Spa provides services to a minor, information will be handled in accordance with applicable consent, privacy, medical-record, and parental-access requirements.

A parent or legal guardian who believes a child submitted personal information through our website may contact us to request review or deletion, subject to applicable recordkeeping obligations.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, technology, vendors, legal obligations, or privacy practices.



The revised policy will be posted with an updated “Last Updated” date. When required, we may provide additional notice through the website, email, patient portal, or another appropriate method.

Changes to the handling of protected health information will also be reflected in our Notice of Privacy Practices when required.

16. Contact Nexa Med Spa

Questions, concerns, or requests regarding this Privacy Policy may be directed to:

Summit Lifestyle LLC d/b/a Nexa Med Spa
Attention: Privacy Officer
Address: 55 E County Line Rd Ste 101, Greenwood, IN 46143
Email: legal [at] nexamedspa.com
Telephone: +1 (317) 669-9896
Website: https://www.nexamedspa.com/

For questions or complaints involving protected health information, use the contact and complaint procedures stated in Nexa Med Spa’s Notice of Privacy Practices.