Privacy and Cookie Notice

Version 1.0 · Draft for adoption · September 28, 2026

This notice tells clients and website visitors what information the studio collects, why, who receives it and how to make a request; it is linked from the website and the booking pages.

Effective date: to be set when the owner adopts this notice.

October 13, 2026: Until the business EIN arrives (about mid-November 2026), no card is stored at booking, payment is by cash at the visit and the Monthly Membership and the package are not offered. The lines below about the stored card, the Monthly Membership and packages apply once they return.

1. Who is responsible

Rejuvenate Body & Soul Spa Wellness LLC ("Rejuvenate" or "the studio") is responsible for the information handling described here. This notice covers the website rejuvenatebodyandsoul.com, bookings through GlossGenius, the studio's Instagram account (rejuvenatebodysoul.htx) and its linked Facebook Page, email, text messages, phone calls and visits to the studio.

ContactDetails
Privacy contactliliaadam@rejuvenatebodyandsoul.com
Second request routeBusiness phone, (832) 303-1492

This notice explains the studio's practices. It is not permission to use your information for every purpose. Where a separate consent or authorization is needed, the studio asks for it separately. The studio's services are not directed to children under 13. If you believe a child's information has been sent to the studio, contact the studio.

2. What the studio collects, and why

InformationWhy the studio uses it
Questions and contact details: your name, how to reply and what you tell the studioTo answer your question and handle your request. Please leave health histories, card details, identity documents and treatment photographs out of a general inquiry.
Bookings and payments: appointment details, services chosen, purchase and payment records, Monthly Membership and package records, and related messagesTo arrange visits, manage purchases, the stored card, the Monthly Membership and packages, and handle changes or concerns. Cards are stored in GlossGenius at booking or when you join the Monthly Membership. The studio never writes down or keeps a full card number. Until the business EIN arrives (about mid-November 2026), no card is stored and the Monthly Membership is not offered.
Service records: the intake form, suitability information, consent, service notes and aftercare recordsTo give the service you chose safely. The intake form is completed with your esthetician on the studio iPad at your visit. If the iPad is not available, a paper form is used; its answers are entered into your GlossGenius record the same day, and the paper is shredded, except the aftercare pages you take home. The studio asks only for what the service needs.
Photographs and preferencesA service photograph, where you allow one, is kept in your private record. Using any photograph publicly needs a separate, specific permission, and any further authorization the law requires. Your message preferences and any withdrawal are recorded so that they are respected.
Website and device informationThe website does not use cookies, analytics or advertising tools, and it has no forms. Its host, Cloudflare, handles the technical information needed to deliver the pages.

3. Who receives it

The studio shares information with the providers it uses, only for the purposes in this notice and under the arrangements that apply to each provider:

ProviderWhat it does for the studio
GlossGeniusBooking, payments, Monthly Membership and package records, client records and appointment texts
Google WorkspaceEmail; the business phone's calls, texts and voicemail (Google Voice); and a folder only the owner can open for incident and access records
CloudflareWebsite hosting
Google FontsThe website's typefaces, loaded by the visitor's browser when the page opens
Instagram and FacebookMessages sent to the studio's accounts, held by Meta under its own terms

Some providers handle information only on the studio's instructions. Others, such as a payment provider, may also have their own responsibilities, set out in their own notices.

The studio may also share information in three cases: when a valid legal duty requires it; to respond to a properly assessed safety or security incident; and to establish or protect lawful rights. It limits the information and who receives it to what the purpose and the law allow. A general mention of service providers never replaces an authorization the law requires before health information is shared.

The studio does not sell personal information, does not use it for targeted advertising and does not use it for profiling with legal or similarly significant effects.

The studio never uses identifiable treatment information or photographs for a new promotional purpose just because it already holds them. Permission to receive marketing messages is never permission to make health information public.

4. Cookies and similar tools

The website does not use cookies, analytics or advertising tools, and it runs no third-party scripts. The website loads its typefaces from Google Fonts, so a visitor's browser sends its IP address to Google when the page opens.

The studio adds no advertising pixels or session-replay tools to its booking pages, and never builds advertising audiences from treatment information. The booking pages are run by GlossGenius, which may use its own cookies as its own privacy notice explains.

If this changes, this notice is updated before the change goes live, with the tools used, their purpose and how to control them.

5. Your requests and choices

You may ask to see the personal information the studio holds about you, correct it, delete it or receive a copy you can take elsewhere. Use either request route above. You never need to create an account to make a request.

The studio may ask for what it reasonably needs to confirm who you are and what you are asking for, and it never asks for sensitive documents it does not need. If the law limits a request, the studio explains the limit rather than promising that every record can always be deleted. The studio accepts a request made by someone you have authorized, once it confirms their authority. It never treats you differently for making a request.

These are the studio's own practices:

  • The studio answers a privacy request within 45 days, or sooner where the law sets a shorter time. If it needs more time, it tells you why within those 45 days and takes no more than 45 extra days.
  • Every privacy request is answered with no fee.
  • If the studio declines a request, it explains why and how to ask it to look again. Send that request to liliaadam@rejuvenatebodyandsoul.com. The studio answers in writing within 60 days.
  • You may also contact the Texas Attorney General through its consumer complaint process at any time.

Marketing is always optional. To stop promotional emails, use the unsubscribe link in any of them or contact the studio. To stop promotional texts, reply STOP, or tell the studio clearly in another reasonable way. The studio honors every opt-out and every withdrawal of consent the law requires. Stopping marketing does not cancel a booking; tell the studio separately if you also want to change an appointment.

A request for your health records, or a privacy complaint, may follow rules of its own, separate from a request about website information. The Accessibility, Records and Complaints Notices explain them. A request is handled under the right rules, and never delayed because it used the wrong heading or form.

6. Keeping and protecting information

The studio keeps information for the purposes in this notice, and for as long as legal, contract and record-keeping duties require. Each type of record has its own retention period, set in the studio's records policy. Ask the studio for the period that applies to your records.

When there is no longer a reason to keep information, the studio deletes it or removes what identifies you, subject to legitimate holds and backup arrangements.

The studio uses safeguards that suit the information and the systems it actually uses. No system is perfectly secure, and the studio does not claim that one is. That never limits the studio's duty to take reasonable steps to protect information, or to give the notices the law requires after a qualifying incident.

Information is processed and stored with the providers named above.

7. Changes to this notice

A revised notice shows its effective date. Where the law requires it, the studio gives further notice or asks for consent before a significant change. A revised notice never makes acceptable an earlier use that was not permitted at the time. Send questions to liliaadam@rejuvenatebodyandsoul.com.

8. Legal basis

AuthoritySectionWhat it supports here
Texas Medical Records PrivacyTex. Health & Safety Code §§181.001, .004, .101–.105 and .152–.154Health information shared only with the authorization the law requires; no marketing use without permission
Texas Electronic Health RecordsTex. Health & Safety Code §§183.001–.012Where electronic records are stored
Texas sensitive information and breach noticeTex. Bus. & Com. Code §§521.002, .052 and .053Reasonable safeguards; notice after a qualifying incident
Texas Data Privacy and Security ActTex. Bus. & Com. Code §§541.002–.003, .051–.055 and .101–.107The model for the studio's own request practice. This notice does not claim the Act applies to the studio.
U.S. Department of Health and Human Services"Covered Entities and Business Associates"Which federal privacy rules apply depends on the business and its transactions
Texas Office of the Attorney General"Patient Privacy," including the standard Authorization to Disclose Protected Health InformationSeparate authorization before health information is shared
Federal Trade Commission"CAN-SPAM Act: A Compliance Guide for Business"Unsubscribe from promotional email
Telephone and text-message rules47 C.F.R. §64.1200, subsections (a), (c), (d) and (f)Consent for texts; STOP honored