Privacy Policy

This Privacy Policy explains how Between the Lines Injections ("we," "us," or "our") collects, uses, discloses, and protects information about clients, prospective clients, and visitors to our website located at btl-injections.com (the "Site") and our med spa location at 4411 S 2950 E, Holladay, UT 84124 (the "Practice"). By providing your information to us, visiting the Site, or receiving services from us, you agree to the practices described in this Policy.

1. Information We Collect

We collect the following categories of information:

a. Information You Provide to Us

• Contact information: name, mailing address, email address, phone number, date of birth.
• Health and medical information: medical history, allergies, current medications, prior aesthetic treatments, skin conditions, pregnancy/nursing status, and other information you disclose on intake forms or during consultations, used to assess candidacy and safety for treatments such as neuromodulators (e.g., Botox/Dysport), dermal fillers, and other injectable or aesthetic services.
• Photographs and video: before-and-after images and video taken in connection with your treatment, for your medical record and, only with your separate written consent, for marketing or educational use.
• Payment information: billing address and payment card details, processed through our third-party payment processor (see Section 4).
• Appointment and communication data: booking details, appointment history, messages, texts, and emails you send us.

b. Information Collected Automatically

• Device and usage data: your IP address, browser type and version, device identifiers, the pages you view, and the date, time, and duration of your visit.
• Cookies and similar tracking technologies (see Section 5 for details on the types we use and how to control them).

c. Information from Third Parties

• Information from online booking platforms, payment processors, review platforms, and, where applicable, insurance or financing providers.

2. How We Use Your Information

We use the information described above to:

• Evaluate candidacy for and safely provide treatments, and maintain accurate medical records;
• Schedule, confirm, and remind you of appointments;
• Process payments and manage billing;
• Communicate with you about your care, including follow-up instructions;
• With your consent, send marketing communications, promotions, and use before-and-after photos for marketing or educational purposes;
• Comply with legal, licensing, and recordkeeping obligations applicable to aesthetic medical practices in Utah;
• Monitor and analyze use of our Site and improve our services and client experience.

3. Health Information and HIPAA

Between the Lines Injections is a HIPAA-covered entity. We maintain a separate HIPAA Notice of Privacy Practices ("NPP"), provided to you at your first visit and available at the Practice and on our website at [btl-injections.com/notice-of-privacy-practices]. Our NPP describes in detail how we may use and disclose your protected health information (PHI) and explains your rights, including the right to:

• Request access to, and copies of, your PHI;
• Request corrections/amendments to your PHI;
• Request restrictions on certain uses and disclosures of your PHI;
• Request confidential communications by an alternative means or at an alternative location;
• Receive an accounting of certain disclosures of your PHI;
• Obtain a paper copy of our NPP upon request;
• File a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights, if you believe your privacy rights have been violated, without fear of retaliation.

You will be asked to review and sign an acknowledgment of receipt of our NPP at your first appointment. In the event of any conflict between this Privacy Policy and our HIPAA Notice of Privacy Practices regarding your PHI, the NPP governs.

We limit access to your health information to staff and providers involved in your care, and we do not sell your health information.

4. How We Share Your Information

We do not sell your personal information. We may share information with:

• Service providers who support our operations, such as our electronic health record/charting system, online scheduling platform, payment processor, email/text communication platform, analytics providers, and website host;
• Other licensed providers or staff directly involved in your treatment;
• Professional advisors (e.g., accountants, attorneys) as needed;
• Government or regulatory authorities where required by law, subpoena, or to protect health and safety;
• A successor entity in the event of a merger, acquisition, financing, or sale of some or all of our business assets --- we will provide notice before your information becomes subject to a different privacy policy;
• Any affiliated companies or business partners we work with to offer you products, services, or promotions --- we require them to honor this Policy.

We only use or share before-and-after photos, video, or testimonials for marketing purposes if you have signed a separate photo/media release, which you may revoke at any time by contacting us in writing (revocation will not affect materials already published before your request, which we will make reasonable efforts to remove upon request).

5. Cookies, Analytics, and Online Tracking

We use cookies and similar tracking technologies on our Site. "Session" cookies expire when you close your browser; "persistent" cookies remain on your device until they expire or you delete them. We use these categories:

• Necessary/essential cookies --- required for the Site to function properly.
• Functionality cookies --- remember your preferences to personalize your experience.
• Analytics and performance cookies --- help us understand how visitors use the Site. We may use third-party analytics providers such as Google Analytics for this purpose; you can opt out using that provider's browser add-on or your browser's cookie settings.
• Advertising cookies --- used only where you have consented, to help us and our advertising partners understand ad performance.

You can instruct your browser to refuse cookies, though some parts of the Site may not function properly without them. Our Site does not currently respond to browser "Do Not Track" signals.

6. Email and Text (SMS) Communications

If you opt in, we may contact you by email or text message with appointment reminders, promotions, or other marketing communications. You can opt out at any time by following the unsubscribe/STOP instructions included in those messages or by contacting us directly. We do not share your phone number or SMS opt-in data with third parties for their own marketing purposes.

7. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect your information, including secure storage of intake forms and limited staff access to medical records. Payment card details are handled by our third-party, PCI-DSS-compliant payment processor --- we do not store your full card information. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

8. Data Retention

We retain medical records for the period required by Utah law and professional licensing standards (generally a minimum of [X years, e.g., 7 years from the date of last treatment, or longer for minors]), and other personal information for as long as reasonably necessary for the purposes described in this Policy or as required by law.

9. Your Choices and Rights

You may:

• Request access to, or a copy of, your medical and personal records;
• Request corrections to inaccurate information;
• Withdraw consent for marketing communications or use of your photos/video at any time;
• Opt out of marketing emails and texts using the unsubscribe/opt-out instructions provided;
• Request deletion of certain personal information, subject to our legal and recordkeeping obligations.

Utah residents: You may have additional rights under the Utah Consumer Privacy Act (UCPA) if we meet the Act's applicability thresholds, including the right to confirm whether we process your personal data and to request deletion.

California residents: If applicable to our Practice, you may have rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and why, the right to request deletion, and the right to be free from discrimination for exercising these rights. To exercise any of these rights, contact us using the information in Section 13.

Do Not Sell My Personal Information

We do not sell your personal information, and we do not use technology on our Site that sells personal information as defined under the CCPA.

Where Your Information Is Processed

Your information is processed and stored within the United States. If we ever engage a service provider that stores or processes data outside the United States, we will take reasonable steps to ensure your information continues to receive an appropriate level of protection.

10. Children's Privacy

Our services are intended for adults. We do not knowingly collect personal information from children under 18 through our Site. Minors may only receive treatment where permitted by law and with documented parent/guardian consent, in accordance with our Terms of Service.

11. Links to Other Websites

Our Site may contain links to third-party websites that are not operated by us, such as booking platforms or social media pages. We are not responsible for the content or privacy practices of those third-party sites, and we encourage you to review their privacy policies before providing any information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "Effective Date" above reflects the most recent revision. Material changes will be posted on our Site or communicated to you directly.

13. Contact Us

Questions about this Privacy Policy or requests regarding your information can be directed to:

Between the Lines Injections
4411 S 2950 E, Holladay, UT 84124
385-313-8707
hello@btl-injections.com

---

Please also review our Terms of Service, including our mobile messaging (SMS) terms.