Privacy Policy

Moonstone Medical Spa
Operated by Allura Medical Spa LLC

Effective Date: October 16, 2026

1. Introduction

Moonstone Medical Spa ("Moonstone," "we," "us," or "our") is operated by Allura Medical Spa LLC, a healthcare practice located in Gold Beach, Oregon.

We are committed to protecting your privacy and safeguarding your personal and medical information. As a healthcare provider subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), we maintain policies and safeguards designed to protect your protected health information (PHI).

This Privacy Policy explains how we collect, use, store, and protect information obtained through our website, online booking services, electronic communications, and related activities.

Our handling of protected health information is additionally governed by our HIPAA Notice of Privacy Practices.

2. Information We Collect

We may collect the following types of information:

Personal Information

Name, email address, telephone number, and contact information
Appointment requests and scheduling information
Information voluntarily submitted through website forms
Communication preferences
Billing and payment-related information

Medical and Health Information

When you schedule an appointment or receive services, we may collect information including:

Medical history and current health conditions
Medications, allergies, and relevant health information
Treatment goals and preferences
Consultation notes and treatment records
Clinical photographs and treatment documentation
Information necessary to provide medical aesthetics and wellness services

Medical information is collected, maintained, and managed through our designated patient management systems, including Aesthetic Record.

Website Usage Information

Our website may automatically collect certain technical information, including:

IP address
Browser and device type
Website pages visited
General geographic location derived from technical information
Website traffic and interaction data
Cookies and similar tracking technologies

3. How We Use Your Information

We use collected information to:

Schedule and manage appointments
Provide medical aesthetics and wellness services
Maintain accurate patient records
Respond to inquiries and communicate with patients
Send appointment confirmations and reminders
Process payments and maintain financial records
Improve website functionality and visitor experience
Analyze general website traffic
Provide promotional communications when permitted by law
Comply with applicable healthcare regulations and legal requirements

Protected health information is used and disclosed only as permitted or required by HIPAA and other applicable laws.

4. HIPAA and Protected Health Information

Allura Medical Spa LLC is a HIPAA-covered healthcare entity.

We are required by law to maintain the privacy and security of protected health information, provide notice of our privacy practices, and notify affected individuals following breaches of unsecured PHI when required by law.

Protected health information may be used or disclosed for treatment, payment, healthcare operations, and other purposes permitted or required by HIPAA.

Patients have certain rights under HIPAA, including rights to access medical records, request amendments, request certain restrictions, receive confidential communications, and obtain an accounting of certain disclosures.

Additional information regarding these rights and our responsibilities is provided in our separate HIPAA Notice of Privacy Practices, available upon request and through our website.

5. Online Scheduling and Patient Management — Aesthetic Record

Moonstone Medical Spa uses Aesthetic Record, a third-party electronic medical record (EMR) and practice management platform, for appointment scheduling and patient management.

Aesthetic Record may be used to facilitate:

Online appointment booking and scheduling
Patient registration and intake forms
Electronic medical records and clinical documentation
Treatment consent forms
Clinical photography and treatment history
Appointment confirmations and reminders
Payment processing and transaction management, where applicable
Secure patient communications and related practice operations

When you schedule an appointment or submit information through Aesthetic Record, your information is processed through its platform.

Aesthetic Record acts as a service provider to our practice and handles protected health information on our behalf subject to applicable HIPAA requirements and contractual safeguards, including a Business Associate Agreement.

We encourage patients to review Aesthetic Record's Privacy Policy:

https://www.aestheticrecord.com/privacy-policy/

We encourage patients to review Aesthetic Record's Terms of Service:

https://www.aestheticrecord.com/terms-of-service/

Patients should use our designated secure patient management systems when submitting sensitive medical information.

6. Google Analytics and Website Tracking

Our website uses Google Analytics, a website analytics service provided by Google, to help us understand how visitors interact with our website.

Google Analytics may collect information such as:

Pages visited and time spent on the website
Browser and device information
General geographic information
Website traffic sources
User interactions with website content

This information helps us evaluate website performance, identify technical issues, and improve the experience for visitors.

We do not authorize Google Analytics to collect protected health information, medical records, patient intake responses, or identifiable treatment information.

As a HIPAA-covered entity, we limit the use of analytics technologies to website activities where their use is legally appropriate and configure them to avoid transmitting protected health information.

Google Analytics uses cookies and similar technologies. Visitors may control cookies through their browser settings or use Google's available analytics opt-out tools.

For more information, visit:

https://policies.google.com/privacy

7. Cookies

Our website may use cookies and similar technologies to:

Support website functionality
Understand visitor preferences
Measure website performance
Analyze general website traffic

You may manage or disable cookies through your browser settings. Certain website features may not function as intended when cookies are disabled.

We do not intentionally use advertising or analytics tracking technologies to disclose protected health information to third parties.

8. Email, Telephone, and Text Messaging

Moonstone Medical Spa may communicate with patients and prospective patients by telephone, email, or text message regarding:

Appointment scheduling and confirmations
Appointment reminders
Responses to inquiries
Treatment-related follow-up communications
Practice updates
Promotional offers when appropriate consent has been obtained

Standard email and SMS text messages may not be encrypted and should not be used to transmit sensitive medical information unless appropriate safeguards are in place.

Patients are encouraged to use designated secure communication methods for sensitive medical information.

Text Messaging Privacy

Mobile phone numbers and SMS consent information collected by Moonstone Medical Spa will not be sold or shared with third parties or affiliates for their independent marketing or promotional purposes.

We may share information with service providers when necessary to deliver authorized communications.

Patients may opt out of promotional text messages by following applicable opt-out instructions or contacting our office.

Message and data rates may apply.

9. Information Sharing and Disclosure

We do not sell patient medical information or protected health information.

We may share personal information with authorized service providers when necessary to operate our practice, including:

Aesthetic Record for appointment scheduling and patient management
Website hosting and technical service providers
Payment processing providers
Communication and messaging service providers
Other vendors supporting lawful business operations

Protected health information is disclosed only as permitted or required by HIPAA and applicable law.

When a third-party service provider handles PHI on our behalf as a business associate, we require an appropriate Business Associate Agreement.

We may also disclose information when legally required, when appropriately authorized by the patient, or in other circumstances permitted by applicable law.

10. Data Security

We maintain reasonable administrative, physical, and technical safeguards designed to protect personal information and electronic protected health information.

These safeguards include appropriate access restrictions, confidentiality practices, and the use of systems designed to support secure healthcare information management.

Although we take privacy and security seriously, no electronic system or internet transmission can be guaranteed to be completely secure.

We respond to suspected or confirmed information security incidents in accordance with applicable legal requirements.

11. Data Retention

We retain personal information and medical records for periods consistent with applicable Oregon and federal laws, professional obligations, and legitimate business needs.

Medical records are maintained in accordance with applicable healthcare record retention requirements.

Information that is no longer required may be securely deleted, destroyed, or otherwise disposed of in accordance with applicable law and our retention procedures.

12. Patient Privacy Rights

Under HIPAA, patients have rights regarding their protected health information, including the right to:

Request access to and copies of medical records
Request corrections or amendments to medical records
Request restrictions on certain uses or disclosures
Request confidential communications
Receive an accounting of certain disclosures
Obtain a copy of our HIPAA Notice of Privacy Practices
File a privacy complaint without retaliation

Certain rights are subject to applicable legal requirements and limitations.

Patients may contact our practice to exercise their privacy rights or request additional information.

Patients may also submit complaints to the U.S. Department of Health and Human Services Office for Civil Rights.

13. Clinical Photography, Testimonials, and Social Media

Moonstone Medical Spa may document treatments using clinical photography when appropriate for patient care.

Clinical photographs maintained as part of a patient's medical record are treated as protected health information when applicable.

We will obtain appropriate written patient authorization before using identifiable patient photographs, testimonials containing protected health information, or treatment results for marketing, advertising, or social media purposes.

Providing marketing authorization is voluntary and is not a condition of receiving treatment.

Patients may revoke applicable authorizations in writing, subject to legal limitations and disclosures already made in reliance on the authorization.

14. Children's Privacy

Our website is not directed toward children under 18 years of age.

We do not knowingly collect personal information directly from children under 18 through our general website without appropriate parental consent.

Medical information relating to minor patients, when applicable, is handled according to HIPAA, Oregon law, and other applicable privacy requirements.

15. Third-Party Websites

Our website may contain links to third-party websites or services, including external booking and patient management platforms.

These websites may maintain separate privacy policies and information practices.

We encourage visitors to review the privacy policies of third-party services before submitting information.

16. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our services, technology, privacy practices, or legal obligations.

Updates will be posted on our website with a revised effective date.

Material changes to our HIPAA privacy practices will be addressed through our HIPAA Notice of Privacy Practices as required by law.

17. Contact Information

For questions about this Privacy Policy, requests regarding personal information, or concerns about our privacy practices, please contact:

Moonstone Medical Spa
Allura Medical Spa LLC
DBA Moonstone Medical Spa

Physical Address:
29975 Harbor Way, Suite A, Rms 1, 2, & 3
Gold Beach, OR 97444

Mailing Address:
PO Box 8
Wedderburn, OR 97491

Text: 541-313-5226

For requests involving protected health information, we may require identity verification before providing access to records or responding to certain requests.