Consumer Health Data Privacy Policy

1. What Is "Consumer Health Data"?

Under Washington law, consumer health data is personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. For an aesthetics studio, this can include your skin concerns, treatment interests, medical history, medications, pregnancy status, and photos of treatment areas.

2. Categories of Consumer Health Data We Collect

Depending on how you interact with us, we may collect:

• Treatment interests – the services you ask about or book. We offer aesthetic and med-spa services such as injectables, laser and skin treatments, and Morpheus8.
• Skin and aesthetic concerns – such as acne, pigmentation, wrinkles, scarring, sensitivity, or other conditions you describe.
• Medical history and contraindications – health conditions, allergies, prior procedures, and other information relevant to treatment safety.
• Pregnancy and breastfeeding status.
• Medications and supplements – including prescription, over-the-counter, and topical products.
• Photos – before/after or consultation photos of treatment areas that you send us or that we take with your consent.
• Treatment records – the services you receive, products used, outcomes, and follow-up notes.
• Financing information – if you choose to apply for financing, information connected to your application, which may reveal the health-related services you are seeking.
• Call recordings and transcripts – the content of phone calls in which you may discuss health information (see Section 3).
• Message content – what you tell us in Instagram or Facebook direct messages, text messages, and email.
• Inferences – information derived from the above (for example, that you may be a candidate for a particular treatment).

We also collect contact information (name, phone, email), appointment details, and payment information, which may be linked to the health data above.

3. Our AI Assistant "Sofia": Calls, Messages, Recording, and Transcription

Sofia is Botanica's AI assistant. Sofia runs on our customer relationship management (CRM) system, Aesthetix CRM, which is built on the HighLevel (LeadConnector) platform and uses its Voice AI and Conversation AI features.

• Phone calls. Sofia answers calls to (206) 558-1058. Calls to our studio line, (425) 543-6060, are forwarded to Sofia after hours or when staff cannot answer.
• Messages. Sofia also responds to Instagram and Facebook direct messages and to text (SMS) messages.

Every call begins with this notice: "Thanks for calling Botanica Beauty Studio. This is Sofia, Botanica's AI assistant. This call is recorded and transcribed. For a medical emergency, hang up and call 911. How can I help?"

Sofia may ask about your treatment interests or concerns to help schedule you or route your request to our staff. Call recordings, transcripts, and message conversations are stored in our CRM and may be reviewed by our staff. When you ask for a callback or need staff follow-up, Sofia sends an alert to our internal Slack workspace and a text message or email to our manager, which may include a summary of your request.

If you do not want your call recorded, you may hang up and contact us by email at info@botanica-beauty.com instead. Sofia is not a medical provider and cannot give medical advice. For a medical emergency, call 911.

4. Categories of Sources

We collect consumer health data from:

• You directly, through:
  • Instagram and Facebook direct messages (including conversations with Sofia);
  • Phone calls to our business lines (including conversations with Sofia);
  • Forms on our website (such as contact, consultation, or intake forms);
  • Online booking through our booking platform;
  • Intake and consent forms and in-person consultations;
  • Email and text messages (including conversations with Sofia).
• Our staff and providers, who create treatment notes and take photos during your visits.
• Financing providers (Cherry, CareCredit), only if you apply for financing, which may tell us whether your application was approved and related details.

5. Why We Collect and Use Consumer Health Data

We collect and use consumer health data only as needed for the following purposes:

• Booking and scheduling appointments and consultations;
• Consultations – understanding your concerns and recommending appropriate treatments;
• Treatment safety – screening for contraindications, allergies, medications, and pregnancy before treatment;
• Providing services and maintaining treatment records;
• Follow-up – aftercare instructions, check-ins, and reminders about appointments or follow-up treatments;
• Financing – helping you apply for financing through Cherry or CareCredit, only if you request it;
• Customer service – responding to your messages and calls, including through Sofia, and alerting staff when you need follow-up;
• Legal and safety obligations – complying with law, maintaining required records, and protecting the safety and security of our clients and business.

We do not use consumer health data for targeted advertising.

6. Categories of Consumer Health Data We Share and With Whom

We share consumer health data only as needed for the purposes above, with your consent where required by law.

Processors act on our behalf and under contract, and may use the data only to provide services to us. When you message us on Instagram or Facebook, Meta also handles that content under its own terms and privacy policy.

We may also disclose consumer health data when required by law, subpoena, or court order, or to protect health and safety.

7. Categories of Third Parties

The categories of third parties with whom we may share consumer health data are:

• Messaging platforms (Meta, for Instagram and Facebook direct messages);
• Patient financing companies (Cherry, CareCredit) – only if you apply for financing;
• Government authorities or legal parties, when required by law.

You may request a list of the specific third parties and affiliates with whom we have shared your consumer health data, along with an active email address or other online contact for each (see Section 9).

8. Your Consent

We will ask for your consent before we collect your consumer health data, except as needed to provide a product or service you have requested. We will ask for a separate consent before we share your consumer health data with anyone, except as needed to provide a service you have requested. Consent to collect is separate from consent to share. You can withdraw your consent at any time (see Section 9).

We do not sell consumer health data. We will never sell or offer to sell your consumer health data without a valid signed authorization from you, as required by RCW 19.373.070, and we do not currently do so in any case.

9. Your Rights

As a consumer under the Washington My Health My Data Act, you have the right to:

1. Confirm and access – Confirm whether we collect, share, or sell your consumer health data, and access that data.
2. List of third parties – Receive a list of all third parties and affiliates with whom we have shared or sold your consumer health data, with an active email address or other online contact for each.
3. Withdraw consent – Withdraw your consent to our collection and sharing of your consumer health data.
4. Delete – Have your consumer health data deleted, including from our archives and backups, and have us notify our processors and third parties who received it so they delete it too. (Data in backups will be deleted within six months of your request, as allowed by law.)
5. Appeal – Appeal our decision if we deny your request.
6. Nondiscrimination – You will not be treated unfairly for exercising any of these rights.

Please note: some records may be subject to other legal retention requirements, such as medical records rules. If any of your information is protected health information under HIPAA or RCW 70.02, that law governs it instead.

How to Exercise Your Rights

• Email: info@botanica-beauty.com
• Phone: (425) 543-6060 (note: calls may be answered by our AI assistant, Sofia, and are recorded and transcribed; you may ask for a staff member to follow up)

Please tell us your name, the contact information you used with us, and which right you want to exercise. We will need to verify your identity before acting on your request, and we may ask for additional information to do so. You may use an authorized agent; we may ask for proof of authorization.

Response Time

We will respond within 45 days of receiving your verified request. If reasonably necessary, we may extend this by an additional 45 days, and we will tell you within the first 45 days. Requests are free of charge up to twice a year; we may charge a reasonable fee or decline requests that are manifestly unfounded, excessive, or repetitive.

Appeals

If we decline your request, you may appeal by emailing info@botanica-beauty.com with the subject line "MHMDA Appeal" within a reasonable time after our decision. We will respond in writing within 45 days of receiving your appeal, explaining any action taken and the reasons. If your appeal is denied, you may contact the Washington State Attorney General at www.atg.wa.gov/file-complaint or 1-800-551-4636.

10. Data Retention

We keep consumer health data only as long as reasonably needed for the purposes described above or as required by law:

• Inquiries and messages that do not lead to a booking (direct messages, text messages, website forms): up to 2 years from last contact.
• Call recordings and transcripts: 12 months.
• Client records, intake/medical history forms, treatment notes, and photos: 7 years after your last treatment, or longer if required by law.
• Slack alerts: 90 days.
• Financing information: only as long as needed for your financing application and as required by law. Cherry and CareCredit retain your application under their own privacy policies.

When data is no longer needed, we delete or de-identify it.

11. How We Protect Your Data

We use reasonable administrative, technical, and physical safeguards to protect consumer health data, including access controls so that only staff who need the data can see it, and contracts with our processors requiring them to protect your data. No system is perfectly secure, but we work to protect your information appropriately for its sensitivity.

12. Geofencing

We do not use geofencing. We do not set up virtual boundaries around our studio or any healthcare facility to identify, track, collect data from, or send notifications or ads to people based on their location.

13. Minors

Our services are for adults 18 and older. We do not knowingly collect consumer health data from anyone under 18. If you believe we have collected a minor's data, contact us and we will delete it.

14. Changes to This Policy

We may update this policy from time to time. We will post the updated version on this page with a new "Last Updated" date. If we make material changes affecting how we collect, use, or share your consumer health data, we will obtain your consent where required by law before applying them.

15. Contact Us

Botanica Beauty PLLC (Botanica Beauty Studio)
12611 Northup Way, Suite 220
Bellevue, WA 98005
Phone: (425) 543-6060
Email: info@botanica-beauty.com