Effective Date: January 31, 2026

At Lechell's Beauty Services – MediSpa ("Lechell’s," "we," "our" or "us"), we value the privacy of individuals who visit our website, book appointments, purchase services, communicate with us or otherwise use our services (collectively, the "Services").  This Privacy Notice explains how we collect, use, disclose and protect your personal information.  By using our Services, you agree to the practices described here.

Note: If you receive medical or aesthetic treatments from us, we may collect information related to your health.  In those situations we are a Covered Entity under the Health Insurance Portability and Accountability Act (HIPAA) and we provide a separate HIPAA Notice of Privacy Practices describing how we handle protected health information.  Where there is a conflict between this Privacy Notice and our HIPAA notice, the HIPAA notice will control.
 

"Personal information" means information that identifies or could reasonably identify a specific person.  It does not include de‑identified or aggregated data.  We collect personal information from several sources:

• Registration and account information.  When you create an account, subscribe to our mailing list or book a service, we collect basic details such as your name, telephone number, email address, mailing address and preferred method of contact.  We may also collect demographic details (for example, age, gender or personal interests) if you choose to provide them.
   
• Communications.  If you contact us—whether by email, telephone, social media, chat or by filling out a form—we collect the contents of your message and any associated attachments so we can respond.  We may ask for additional details (such as appointment date, service requested or proof of identity) to verify your identity.
   
• Events and promotions.  If you sign up for an in‑person or virtual event, we collect information such as your name, company affiliation, title and email address along with any information necessary for the event.
   
• User content.  We may allow you to post reviews or comments on our site or social media pages.  User generated content is generally visible to others, so please do not post sensitive or health information in public comments.
   
• Treatment and health information.  To provide MediSpa services (e.g., chemical peels, injectables, micro‑needling), we may collect information about your medical history, allergies, medications or treatment goals.  This information may constitute protected health information under HIPAA.  We handle it in accordance with our HIPAA Notice of Privacy Practices.
   
• Payment information.  When you pay for services, we collect payment card details, billing address and other financial information.  We use third‑party payment processors to handle payments securely and do not retain full credit or debit card numbers on our own systems.  Our processors are contractually obligated to protect this information.
   

When you interact with our Services online, we and our service providers may automatically collect certain information about your device and usage:

• Log and device data.  We collect your device’s IP address, browser type, operating system, referring URL, pages visited, time and date of visit and other standard log data.
   
• Cookies and similar technologies.  We use cookies, pixels and similar technologies to operate our website, remember your preferences, understand how our site is used and show you relevant promotions.  You can control cookies through your browser settings, though disabling cookies may impact your experience.
   
• Analytics.  We use analytics services (such as Google Analytics) to measure and improve the performance of our site.  These services may set cookies or use other tracking technologies to collect usage data on our behalf.
   

• Service providers.  We receive information from companies that help us operate our business, such as payment processors, booking platforms and marketing providers.
   
• Social networks.  If you interact with our content on social media or choose to connect your social account, we may receive information such as your public profile and interactions.
   

We use the personal information described above for the following purposes:

• Provide and improve our services.  To schedule appointments, administer treatments, process transactions, send reminders and improve your experience.
   
• Communications.  To respond to inquiries, provide customer support, send administrative emails (e.g., appointment confirmations, invoices, notices of policy changes) and marketing communications.  You may opt out of marketing emails at any time.
   
• Business operations.  To manage our business, analyze usage, develop new features and services, perform audits and enforce our policies.
   
• Compliance and safety.  To comply with applicable laws and regulations, detect and prevent fraud, protect the health and safety of our clients, and maintain the security of our systems.  For example, the Colorado Privacy Act requires companies to “safeguard personal data” and provide “clear, understandable, and transparent information” about how data are used.
   
• Advertising and analytics.  We may use your information to show you special offers or measure the effectiveness of our marketing campaigns.  You may opt out of targeted advertising as described below.
   

We disclose personal information in the following circumstances:

• Service providers and contractors.  We work with vendors who perform functions on our behalf, such as website hosting, email delivery, customer relationship management, analytics, payment processing, appointment scheduling and technical support.  They are authorized to use your information only as necessary to provide these services.
   
• Professional advisors.  We may share information with lawyers, accountants or insurers as needed for legal, audit or insurance purposes.
   
• Business transfers.  If we are involved in a merger, acquisition, financing or sale of assets, your information may be transferred as part of that transaction.
   
• Legal and safety requirements.  We may disclose information when required by law or government request, or when we believe it is necessary to protect our rights, property or safety, or that of others.
   
• With your consent.  We may share your information for other purposes with your consent or at your direction.
   

We do not sell personal information for money, and we do not share personal information for cross‑context behavioral advertising.  However, certain laws treat some disclosures as a “sale” or “sharing” even when no money changes hands; please see the “Your privacy rights” section for details.

We use cookies and similar technologies to recognize you and track your interaction with our Services.  Some cookies are strictly necessary for the website to function, while others help us improve the site or deliver relevant ads.

You can adjust your cookie settings via your browser.  Your browser may also support the Global Privacy Control (GPC) signal.  Where required by law, we will honor GPC signals as a request to opt out of the sale or sharing of your personal data for targeted advertising.

We retain personal information only as long as necessary to fulfill the purposes outlined in this Privacy Notice, to comply with legal obligations, to resolve disputes, and to enforce our agreements.  The retention period depends on the nature of the information and our obligations—for example, certain medical records must be kept for a specified number of years under state law.  When we no longer need your information, we will securely delete or de‑identify it.

We maintain reasonable physical, technical and administrative safeguards designed to protect personal information from unauthorized access, use, alteration and disclosure.  The U.S. Federal Trade Commission (FTC) recommends that businesses “take stock” of the personal information they collect, keep only what is needed, “lock it” with appropriate protections, “pitch it” when it’s no longer needed and “plan ahead” for security incidents.  We follow these principles and restrict access to personal information to employees and service providers who have a business need to know.

Despite these efforts, no security measures are perfect.  We cannot guarantee absolute security and encourage you to protect your own information as well.

Depending on where you live, you may have certain rights under state privacy laws.  We will honor these rights for all U.S. residents, even if not required by your state law.

Right to access.  You may request confirmation of whether we process your personal data and receive a copy of your information.

Right to correction.  You may request that we correct inaccurate personal information.

Right to deletion.  You may request that we delete personal information we hold about you.  Please note that we may retain information that is required for legal compliance or internal record‑keeping.

Right to data portability.  You may request a copy of your personal information in a portable format.

Right to opt out of certain processing.  You may opt out of the processing of your personal data for targeted advertising, the sale of your personal data or profiling in furtherance of decisions that produce legal or similarly significant effects.  Because we do not engage in these practices, any opt‑out request will be recorded and honored.  You may also withdraw consent you previously provided for certain processing activities.

Right to appeal.  If we deny your request, you have the right to appeal our decision.  We will provide information on how to appeal in our response.

To exercise any of these rights, please contact us using the information in the “Contact us” section below.  We will respond within 45 days (and may extend by another 45 days if necessary).

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you additional rights.  According to the California Attorney General, the CCPA gives consumers the right to know about the personal information a business collects and how it is used and shared; the right to delete personal information (subject to exceptions); the right to opt out of the sale or sharing of personal information; and the right to non‑discrimination for exercising CCPA rights.  The CPRA adds the right to correct inaccurate personal information and the right to limit the use and disclosure of sensitive personal information.  Businesses subject to the CCPA must also provide notices explaining their privacy practices.

We provide these rights to all our customers regardless of residence.  When you submit a request, we will verify your identity and respond as required by law.

The Colorado Privacy Act gives Colorado residents the right to access, correct and delete their personal data and to opt out of the sale of personal data and targeted advertising.  It also requires businesses to provide a “reasonably accessible, clear and meaningful privacy notice” that discloses the categories of personal data collected, the purposes for which it is processed, how consumers may exercise their rights, the categories of personal data shared with third parties and the categories of third parties with whom it is shared.  Our Privacy Notice is intended to meet those requirements.  To exercise your Colorado privacy rights, please contact us as described below.

We do not knowingly collect personal information from children under 13 years of age.  The Children’s Online Privacy Protection Act (COPPA) gives parents control over what information websites can collect from their kids.  The FTC explains that the COPPA Rule imposes additional protections and procedures for companies covered by the rule.  If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us.  We will promptly delete the information and terminate the child’s account.

As a MediSpa offering certain medical services, we are subject to HIPAA when we handle protected health information.  Under the HIPAA Privacy Rule, covered entities must provide a notice of privacy practices that describes how they use and disclose protected health information, states their duties to protect privacy, describes individuals’ rights and provides a point of contact for complaints.  We make our HIPAA Notice of Privacy Practices available at our service location and on our website, and we provide it to clients at or before the first visit.  Please review that notice for more details on how we handle health information.

Our Services may contain links to or integrations with third‑party websites, apps and services that we do not control.  We are not responsible for the privacy practices of those third parties.  We encourage you to read the privacy policies of any third‑party service you visit.

We may update this Privacy Notice from time to time to reflect changes in our practices or legal requirements.  When we make material changes, we will update the effective date at the top of the notice and, if required by law, notify you.  We encourage you to review this Privacy Notice periodically.

If you have any questions, concerns or requests regarding this Privacy Notice or our privacy practices, please contact us:

Lechell’s Beauty Services – MediSpa
10255 E 25th Avenue Unit 7
Aurora, Colorado 80010
Phone: 720‑431‑6944
Email: info@lbeautyservices.com (or use the contact form on our website)

You may also file a privacy complaint with the Colorado Attorney General or, for health‑related matters, with the U.S. Department of Health and Human Services, Office for Civil Rights.