Privacy Policy

Please do not put highly sensitive medical information, government identifiers, account passwords, or full payment-card details into a general contact or chat field. If we need clinical information, we will tell you how to provide it through the appropriate channel.

• Provide consultations, bookings, services, packages, gift cards, receipts, and customer support.
• Process payments, refunds, cancellations, and transaction reconciliation.
• Send appointment confirmations, reminders, updates, and communications you request or authorize.
• Personalize language and site preferences and improve navigation, content, and booking flow.
• Measure site and campaign performance, subject to the choices described below.
• Detect fraud, abuse, security incidents, and technical problems.
• Comply with law, keep required business records, and establish or defend legal claims.

We disclose personal information only for the purposes described in this policy, as directed by you, or when permitted or required by law. Recipients may include:

• Account authentication. Clerk provides sign-in, verification, account recovery, and session security for the client portal. See the Clerk Privacy Policy.
• Booking and payments. Square processes bookings, payments, refunds, gift cards, and related transaction support. See the Square Privacy Notice.
• Communications and customer management. HighLevel and LeadConnector help us receive website leads, operate chat, maintain consent records, and send permitted email or SMS communications. See the HighLevel Privacy Policy.
• Hosting, storage, and security. Vercel and database or security providers host the site, store operational records, screen automated abuse, and keep the service available. See the Vercel Privacy Notice.
• Analytics and advertising. Subject to your privacy choices, we use PostHog, Google Analytics, Microsoft Clarity, Vercel Analytics, and Meta to understand use, diagnose problems, and measure campaigns.
• Professional advisers and authorities. We may disclose information to lawyers, accountants, insurers, regulators, courts, or law enforcement when reasonably necessary to comply with law or protect rights, safety, and security.
• Business changes. Information may be reviewed or transferred as part of a financing, reorganization, sale, merger, or similar transaction, subject to appropriate confidentiality and legal requirements.

We do not sell personal information for money. Some privacy laws may define certain advertising disclosures as a “sale” or “sharing” even when no money changes hands. You can opt out of those uses as described in Section 7.

We use analytics to learn whether the site works and where visitors encounter friction. Microsoft Clarity may create session replays and interaction maps. PostHog replay is limited to sessions showing booking or contact intent, and is configured to mask form inputs and designated booking or contact text. We do not configure PostHog to capture network request bodies or headers.

Analytics, advertising pixels, session replay, and the website chat widget are excluded from sign-in, sign-up, and authenticated account routes. Those screens can contain profile, appointment, package, membership, and saved-card metadata.

We restrict Meta browser advertising technology from treatment, service, concern, article, and quiz pages. Conversion events sent from our server are generalized to remove treatment-level detail. Where permitted, contact identifiers sent for conversion matching are normalized and hashed before transmission. Hashing is a security measure, not anonymity, because a provider may match the value to an existing account.

Our Google consent settings deny advertising storage, ad personalization, and ad user-data permissions. Browser analytics and replay do not load, or are shut down, when our opt-out is active. These controls do not prevent essential technologies needed to provide a booking, prevent fraud, or remember your privacy choice.

You can review the providers' own notices at PostHog, Google, Microsoft, and Meta.

Cookies, local storage, pixels, and similar technologies help the site function, remember choices, measure use, and attribute bookings. Current key lifecycles are:

You can use browser settings to block or delete cookies, but doing so may affect chat, checkout, language preferences, or other site features. Our control below is the most direct way to turn off nonessential browser analytics on this device.

Use this control to turn browser-based analytics, session replay, and advertising measurement off or back on for this device. Opting out clears supported identifiers and stores the choice for up to two years.

Global Privacy Control

We treat a recognized Global Privacy Control signal as an opt-out request for this browser. While that signal remains active, it overrides the on-page control. We do not currently respond to older, undefined “Do Not Track” signals.

Requests about your information

Depending on where you live and the law that applies, you may have rights to know, access, correct, delete, or receive a copy of personal information, and to opt out of certain sale, sharing, or targeted advertising. You may also appeal a decision where applicable. We will also consider reasonable access, correction, and deletion requests when a law does not require us to grant them.

Email myskinandself@gmail.com with the subject “Privacy Request” and describe your request. We may verify your identity and authority before acting, and may retain information when required for transactions, safety, legal compliance, or claims. An authorized agent may submit a request where permitted, but we may ask for proof of authorization. We will not discriminate against you for exercising an applicable privacy right.

Marketing communications

Use the unsubscribe link in a marketing email. For text messages, reply STOP or use another reasonable method described in our SMS Terms. Transactional messages needed to complete or service a booking may still be sent where permitted.

Your interest in a service may suggest something about your health, appearance, or wellness goals. We use that information to respond to you and support the service you requested. We do not intentionally send treatment-level page details to Meta for advertising measurement.

This website policy covers online, marketing, booking, and business information. If Skin & Self gives you a separate Notice of Privacy Practices for protected health information or clinical records, that notice controls the information within its scope. Do not use a website form or chat for an emergency. Call 911 or seek immediate medical help.

We keep personal information only as long as reasonably necessary for the purpose for which it was collected, including to provide services, maintain transaction and consent records, meet legal or accounting obligations, resolve disputes, prevent fraud, and enforce agreements. Retention periods vary by record type and legal requirement. We then delete, aggregate, or de-identify the information when reasonably practicable.

We use administrative, technical, and physical safeguards designed for the nature of the information we maintain. Measures include secure transport, access controls, payment tokenization, vendor review, data minimization, and monitoring. No website, storage system, or transmission is completely secure, so we cannot guarantee absolute security.

Online booking and purchasing are intended for adults. The site is not directed to children under 13, and we do not knowingly collect their personal information through the site. A parent or legal guardian may contact us to ask about services for a minor where permitted. If you believe a child submitted information without appropriate permission, contact us so we can review and delete it as required.

Skin & Self is based in New York. We and our providers process information in the United States and potentially other locations where providers operate. If you access the site from outside the United States, privacy protections in those locations may differ from those in your home country.

We may update this policy as our practices, providers, or legal obligations change. We will post the revised policy and update the date above. If a change materially affects how we use information already collected, we will provide additional notice when required by law.

For privacy questions or requests, contact: