Privacy & Data Rights

                                                                  Privacy Policy

                                                 Effective Date: September 19, 2026

                                                  Last Updated: September 19, 2026

Ocean Milk Aesthetics ("Ocean Milk Aesthetics," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website at oceanmilkmedspa.com (the "Site"), communicate with us electronically, schedule appointments, or use our clinical, aesthetic, and wellness services.

Please read this Privacy Policy carefully. By accessing or using our Site and services, you acknowledge that you have read, understood, and agree to be bound by the terms described herein.

1. Medical Information and HIPAA / CMIA Notice

This Privacy Policy applies primarily to information collected through our public website, electronic communications, and general customer interactions.

If you are a patient or client receiving medical aesthetic services (including but not limited to neurotoxin injections, dermal fillers, chemical peels, microneedling, medical weight management, or IV therapy):

Your identifiable health information collected during medical consultations, health intake forms, and clinical treatments is protected under state and federal healthcare privacy laws, including the California Confidentiality of Medical Information Act (CMIA) and, where applicable, the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

Any Protected Health Information (PHI) provided through our secure clinical intake forms, electronic medical records (EMR) system, or patient portal is governed by our separate Notice of Privacy Practices, which is provided to you during clinical onboarding.

If there is any conflict between this website Privacy Policy and our clinical Notice of Privacy Practices regarding your medical records, the Notice of Privacy Practices will govern.

2. Information We Collect

We collect information directly from you, automatically through your use of our Site, and from third-party service providers.

A. Information You Provide Directly

Contact Information: Full name, email address, phone number, and physical or mailing address.

Appointment & Inquiry Details: Preferred services, dates, times, consultation notes, and questions submitted via contact forms, chat widgets, or email inquiries.

Payment Information: Billing address and payment card details. Payment transactions are processed directly by third-party, PCI-compliant payment processors. We do not store full credit card numbers on our servers.

Communications: Records of communications when you call, text, email, or message us.

B. Information Collected Automatically

When you browse our Site, our servers and third-party analytics tools may automatically collect:

Device & Usage Data: IP address, browser type, operating system, referring URLs, pages viewed, time spent on pages, and navigation paths.

Cookies & Tracking Technologies: Small data files stored on your device that help us improve site navigation, analyze site performance, and remember your preferences.

3. How We Use Your Information

We use the information we collect for legitimate operational and clinical purposes, including:

Scheduling, confirming, modifying, and managing your appointments.

Providing medical aesthetic, wellness, and weight management consultations and treatments.

Responding to your inquiries, customer service requests, and feedback.

Sending administrative notifications, service updates, and appointment reminders (via email or SMS).

Operating, troubleshooting, maintaining, and improving our Site.

Sending promotional communications, newsletters, and special offers (where permitted by law and subject to your opt-out preferences).

Complying with legal, regulatory, and licensing obligations applicable to healthcare and aesthetic medical practices in the State of California.

4. Mobile Terms & SMS Messaging (A2P Compliance)

If you provide your mobile telephone number and opt in to receive text messages from Ocean Milk Aesthetics:

We may send you automated SMS messages regarding appointment confirmations, reminders, clinic updates, or customer support.

No Mobile Information Sharing: Mobile information collected through our SMS opt-in programs will not be sold, rented, or shared with third parties or affiliates for their own marketing or promotional purposes.

Opting Out: You may opt out of receiving SMS communications at any time by replying STOP to any text message received. For help, reply HELP or contact us at the details below. Message and data rates may apply.

5. How We Share Your Information

We do not sell, rent, or trade your personal information. We disclose your information only under the following limited circumstances:

Service Providers: We share information with trusted third-party vendors who assist us in operating our business, such as our electronic medical records (EMR) provider, appointment scheduling platform, website hosting provider, IT support, and payment processors. These vendors are bound by contractual confidentiality agreements and are authorized to use your information solely as necessary to provide services to us.

Professional & Medical Collaborations: As required for medical oversight, pharmacy fulfillment (e.g., compounding pharmacies for prescribed weight management programs), or diagnostic lab testing.

Legal and Regulatory Compliance: We may disclose information if required by law, subpoena, court order, or governmental regulation, or if we believe in good faith that such disclosure is necessary to protect our legal rights, your safety, or the safety of others.

Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, client contact records may be transferred as part of the transaction, subject to professional healthcare practice transfer regulations in California.

6. Cookies and Tracking Technologies

We use cookies, web beacons, and standard analytics tools to evaluate traffic patterns and enhance user experience.

You can control cookies through your browser settings. Most browsers allow you to block or delete cookies; however, disabling cookies may impair certain features of our Site. We do not currently respond to automated browser "Do Not Track" (DNT) signals due to the lack of a standardized technical standard.

7. California Privacy Rights (CCPA / CPRA & CalOPPA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you specific rights regarding your personal information.

Note: Medical information governed by HIPAA or the California Confidentiality of Medical Information Act (CMIA) is exempt from CCPA consumer deletion and access requests; however, your rights regarding medical records are protected under California Health and Safety Code provisions.

For non-exempt personal data, California residents have the right to:

Right to Know / Access: Request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, and the business purposes for collecting it.

Right to Delete: Request deletion of personal information collected from you, subject to legal and regulatory retention requirements.

Right to Correct: Request correction of inaccurate personal information we maintain about you.

Right to Non-Discrimination: We will not discriminate against you (in pricing, service quality, or availability) for exercising any of your privacy rights.

Right to Opt-Out of Sale or Sharing: We do not sell your personal information, nor do we share your personal information for cross-context behavioral advertising.

To exercise any of these rights, contact us at info@oceanmilkmedspa.com with the subject line "California Privacy Request."

8. Data Security and Retention

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, loss, misuse, or alteration.

We retain personal information for the period necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by medical record retention laws, tax regulations, or other legal obligations in California (for example, adult medical records in California are generally retained for a minimum of 7 years following treatment).

9. Children's Privacy

Our Site and services are not directed to children under the age of 18. We do not knowingly collect personal information from individuals under 18 through our Site without verified parental or legal guardian consent. If we become aware that we have collected information from a minor without proper consent, we will take steps to delete that data promptly.

10. Third-Party Websites

Our Site may contain links to external websites, such as social media platforms, patient financing partners, or educational resources. We are not responsible for the privacy practices, content, or policies of those third-party sites. We encourage you to review the privacy policy of any external website you visit.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our clinical services, technology, or legal requirements. When updates occur, we will revise the "Last Updated" date at the top of this page. Any changes become effective immediately upon posting. Your continued use of our Site or services after any modifications indicates your acceptance of the updated policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at:

Ocean Milk Aesthetics

Attention: Privacy Officer / Clinical Director

Website: oceanmilkmedspa.com

Email: hello@oceanmilkaesthetics.com

Phone: (949) 357-4788

Location: Orange County, California