This policy explains what 559 Flawless collects about you, why, who sees it, how long we keep it, and what you can ask us to do about it. It covers this website, booking an appointment, buying from us, and the records we keep as your cosmetologist.

The short version

We collect what we need to treat you safely, book you, take payment, and stay on the right side of the law.

We also advertise. That means we use analytics and advertising technologies on the public parts of this site, and we may share basic contact details with advertising platforms so that people who might want what we do get to hear about it. Under California law some of that counts as "selling" or "sharing" your information, and you can tell us to stop at any time — see Advertising, and how to opt out below.

What never goes anywhere near advertising: your health. Your intake answers, consent forms, treatment notes, patch tests, clinical photographs, and which specific service you booked are not shared with advertising platforms, not used to build audiences, and not used to target anything at you. That information is seen only by the licensed staff treating you.

Who we are

559 Flawless, a private single-room esthetic studio at 285 W Shaw Ave, Fresno, California. When this policy says "we", "us" or "the studio", it means 559 Flawless. We decide what is collected here and we are responsible for it.

About health information, and about HIPAA

Your intake answers, consent signatures, patch test results, treatment notes and clinical photographs are health information, and we treat them as confidential.

We are not a HIPAA covered entity. HIPAA generally applies to health plans, clearing houses, and providers who bill insurance electronically. A licensed esthetics studio that takes payment directly is normally none of those, so we do not claim HIPAA compliance and you should not assume HIPAA protections apply to your record here. What we do instead is described in this policy, and it is deliberately close to what you would expect from a clinical provider: confidential storage, access limited to the people treating you, no advertising use, and no sale.

What we collect

What you give us

• Who you are. Name, email address, phone number, date of birth, and pronouns if you

give them. Date of birth is used for age verification and for treatment planning.

• Your health and skin. Intake answers — allergies, medications, medical conditions,

pregnancy or breastfeeding, skin type and Fitzpatrick response, prior treatment, and what you want out of your visit. You choose what to tell us, but leaving something out can make a service unsafe.

• Your consent. Which form you signed, the version, the exact wording that was on the

screen, the name you typed or the signature you drew, and the date. We also record the IP address and browser used at signing, because that is what makes a signature evidence of anything later.

• Age confirmation for services that require you to be 18 or older, recorded against

the appointment.

• Treatment records. What was done, what was used, how your skin responded, patch test

results, and the cosmetologist's notes.

• Photographs, where you have consented to them — see below.
• Payment details. Card payments go directly to our payment processor. We see the last

four digits, the card brand, and whether the payment succeeded. We never see or store your full card number.

• What you buy, what you booked, gift cards and prepaid series, and what you told us in

messages or at the front desk.

• Your contact preferences, including whether you agreed to marketing email or texts,

and a record of when you gave or withdrew that agreement — we keep that record precisely so we can prove we only messaged you when allowed.

What we collect automatically

• Site usage, in our own records. Pages viewed, the page you arrived from, campaign tags

on a link you clicked, and where you stopped if you began a booking and did not finish. This is stored in our own database with a random session identifier, and linked to your account if you are signed in.

• Site usage, through analytics and advertising providers. On the public pages of this

site we use Google Analytics, Google Tag Manager, and advertising pixels from platforms such as Meta and Google. These set cookies and similar identifiers and send those providers information about your device, your approximate location from your IP address, the pages you viewed here, and what you clicked.

• Sign-in cookies, which keep you logged in and secure the session. These are essential

and cannot be turned off while you use an account.

Where those advertising technologies do not run. We exclude them from the booking flow, from your account pages, from intake and consent forms, and from service pages for intimate or condition-specific treatments. The point is straightforward: what you are being treated for should not be inferable from a tracking request, and the way to guarantee that is not to send one.

What we get from elsewhere

Our payment processor tells us whether a payment cleared, was disputed, or was refunded. Advertising platforms may tell us, in aggregate, how a campaign performed. We do not buy contact lists and we do not enrich your record with data from brokers.

How we use it

• To treat you safely — which is what the intake, allergy, medication and patch test

information is for, and the main reason we ask.

• To book, confirm, remind, reschedule and follow up on appointments.
• To take payment, issue receipts, handle refunds and disputes, and keep the tax records the

law requires.

• To keep the professional record of what was done, which protects both of us.
• To answer your messages.
• To send marketing only if you asked for it, and to stop when you say stop.
• To advertise the studio, including showing ads to people who have visited this site and

finding new clients who resemble our existing ones.

• To understand which parts of the site work.
• To meet legal obligations and to establish or defend a legal claim.

Advertising, and how to opt out

We advertise on platforms such as Meta (Facebook and Instagram) and Google. Two things happen that you should know about.

Pixels. On the public pages of this site, advertising platforms receive information about your visit through cookies and similar technologies, and may use it to show you our ads elsewhere and to measure whether those ads worked.

Contact lists. We may share basic contact details — usually your email address or phone number, in a scrambled ("hashed") form — with those platforms so they can show ads to you, and so they can find people whose profiles resemble our clients. We only do this with contact details of people who opted into marketing from us, and the list we upload contains contact details only. It is never segmented by service, by treatment, or by anything in your health record.

Under California law, and under similar laws in other states, this counts as "selling" and "sharing" your personal information and as "targeted advertising." You have an absolute right to stop it:

• Use the "Do Not Sell or Share My Personal Information" link at the bottom of this

site.

• Or turn on Global Privacy Control in your browser — we treat that signal as a valid

opt-out on its own, with no form to fill in.

• Or simply call the studio or email us and say so. We will action it and pass the request

on to the platforms.

• Unsubscribing from our marketing also removes you from any contact list we upload.

Opting out does not affect your ability to book, and we will not give you a worse service, a worse price, or a longer wait because you did.

What we never do

• We never send health information to an advertising platform. Not your intake answers,

not your treatment history, not your consent forms, not a photograph, and not which service you booked or viewed where that service would reveal a condition or an intimate treatment.

• We never use your treatment history to decide what to advertise to you.
• We do not sell your health information to anyone, for anything.
• We do not post your photograph, your name, or anything about your treatment publicly

without a separate written release from you.

• We do not buy contact lists.

Who else sees your information

• Our payment processor (Stripe), to take card payments and handle refunds and disputes.
• Our email provider, to deliver appointment confirmations, reminders, receipts and, if

you opted in, newsletters. Text messages, where we send them, go through a messaging provider on the same basis.

• Our hosting and database provider, which stores the site and its data.
• Analytics and advertising platforms, as described above, and limited to what is

described above.

• Calendar sync. Where a cosmetologist connects a work calendar, appointment times and a

short label are written to it so the studio does not double-book. Your intake, consent and clinical notes are never sent to a calendar.

• The Rhonda Allison marketplace, if you buy a product they fulfil. In that case you are

buying from them and giving them your details directly; their privacy policy governs what they do with it.

• Professional advisers, insurers, or authorities, where the law requires it or where we

need to establish or defend a legal claim.

If the studio were ever sold or transferred, client records would transfer with it, and we would tell you before that happened.

Photographs

Clinical photographs are stored in private storage, never in a public folder, and are opened only through short-lived private links generated for a specific member of staff at a specific moment. Each photograph requires your consent, recorded per image.

Using a photograph publicly — on this site, in an advertisement, or on social media — requires a separate photography release, which is always optional and is never a condition of treatment. No photograph of an intimate area is taken at all without its own separate written consent. You can withdraw a release at any time and we will stop using the image going forward, though we cannot recall what has already been printed or already shared onward by someone else.

How long we keep things

• Sales and payment records — at least 4 years, for California sales and use tax, and up

to 7 for federal income tax.

• Treatment records, intake forms and signed consents — at least 7 years. California's

limitation period for a negligence claim runs from the injury, and it pauses for anyone who was a minor at the time, so records involving a minor are kept longer.

• Marketing consent records — for as long as we hold your contact details, because that

record is the proof we only contacted you with permission.

• Site usage data — kept in aggregate; the link to your account is removed when you

close it. Data held by analytics and advertising platforms is kept according to their own retention periods, which we do not control.

Closing your account, and what actually happens

You can close your account from your account settings, or by asking us.

Be aware of what this does, because it is not a simple erase and we would rather tell you plainly. We remove what identifies you and keep what we are obliged to keep. Deleted: your name, email, phone number, date of birth, address, profile photograph, marketing subscriptions, the messages you wrote, your site-usage trail, and your clinical photographs. Retained, with nothing attached that names you: signed consents, intake answers, treatment notes, appointment history, and sales and payment records.

Two reasons. A signed consent with the signatory erased proves nothing, which defeats the point of keeping it — and a treatment note is a contemporaneous professional record, so rewriting it after the fact is falsification, not privacy. And an unattributable sale is a hole in a tax record we are required to be able to produce.

Once the retention periods above have run out, the remaining records are deleted. If you want your record erased sooner than that, ask us — we will tell you honestly what we can remove and what we cannot, and why.

Your rights

Whatever state you live in, you can ask us to:

• Tell you what we hold about you, and give you a copy.
• Correct anything that is wrong. Note that clinical notes are corrected by adding a

dated correction rather than by editing the original — that is how a medical-style record is meant to work.

• Delete your information, subject to the retention rules above.
• Stop selling or sharing your information for advertising, as described above.
• Limit how we use sensitive information. We already limit it further than the law

requires: health information is never used for advertising at all.

• Stop marketing to you, at any time, immediately.
• Withdraw a consent you previously gave, including a photography release.

California residents have these rights under the CCPA, and residents of several other states have equivalents. We honour them regardless of whether the studio meets a given law's size thresholds in a particular year. We will not treat you differently for exercising any of them.

To make a request, use the "Do Not Sell or Share My Personal Information" link at the bottom of this site, call the studio on (559) 477-2999, or use the contact page. We may need to verify who you are before we hand over health information — that protection is for you. If we turn a request down, we will tell you why, and you can ask us to reconsider.

Security

Access to client records is restricted by role: front desk staff can see what they need to book and take payment, and clinical notes, intake answers and photographs are limited to the licensed staff involved in your care. Those limits are enforced by the database itself, not just hidden in the interface. Photographs are kept in private storage reachable only through short-lived links. Card numbers never touch our systems.

No system is perfect, and we will not pretend otherwise. If a breach affects your information, we will notify you as California law requires.

Children

You must be 18 or older to hold an account here. A parent or legal guardian may book for a client under 18, must attend the appointment, and signs the consent forms. Some services are for adults only. We do not knowingly collect information from a child except through their parent or guardian in that context, and we do not knowingly sell or share the personal information of anyone under 16 for advertising — if you believe we have, contact us and we will remove it.

Changes to this policy

We may update this policy. Each version is published with a version number and effective date, both shown at the top of this page, and earlier versions are kept. If a change materially affects how we handle your information, we will tell you rather than relying on you to notice.

Contact us

559 Flawless — 285 W Shaw Ave, Fresno, California. Telephone (559) 477-2999, or use the contact page on this site.