Privacy Policy

Effective Date: July 12, 2026  ·  Last Updated: July 12, 2026

1. Who We Are

Lumae Aesthetics and Wellness ("Lumae," "we," "us," or "our") is a medical aesthetics and wellness practice located on Budde Road in Spring, Texas, operating under the medical direction of Dr. Rahimi, MD. We provide IV hydration therapy, aesthetic injections, ketamine infusion therapy, and statewide telehealth services across Texas.

Questions about this Policy may be directed to us at the contact information provided in Section 11 below.

2. Information We Collect

Information You Provide Directly

• Contact information: Name, email address, phone number, and mailing address when you contact us, submit a booking request, or sign up for our founding member program.
• Appointment information: Service selections, appointment dates and times, and scheduling preferences collected via our booking platform (Vagaro).
• Health intake information: Medical history, current medications, symptoms, and treatment goals submitted through our patient intake forms or telehealth intake process. This information is Protected Health Information (PHI) and is governed by HIPAA — see Section 5 below.
• Communications: Messages, inquiries, and feedback you send us via email, contact forms, or telephone.
• Membership information: Email address and preferences when you register for our founding member or wellness membership program.

Information Collected Automatically

• Log data: IP address, browser type and version, operating system, referring URLs, pages visited, and time spent on pages.
• Device information: Device type, screen resolution, and connection type.
• Cookies and similar technologies: See Section 7 (Cookies) below for full details.

Information from Third Parties

We may receive information about you from third-party booking platforms (Vagaro), payment processors, or analytics providers. We do not purchase or rent personal data from data brokers.

3. How We Use Your Information

We use the information we collect to:

• Schedule, confirm, and manage your appointments;
• Provide, administer, and improve our clinical services;
• Send appointment reminders, follow-up communications, and service updates;
• Process membership enrollments and communicate founding member benefits;
• Respond to your inquiries and provide customer support;
• Maintain the safety and security of our website and operations;
• Comply with applicable laws, regulations, and professional licensing requirements; and
• Analyze website usage to improve user experience (using aggregated, non-identifying data).

We do not sell your personal information to third parties for their own marketing purposes.

4. Legal Basis for Processing (Texas & U.S. Residents)

We process your personal information on the following bases:

• Contract performance: Processing necessary to provide services you have requested or to fulfill a booking;
• Legal obligation: Processing required to comply with Texas and federal healthcare regulations, including HIPAA;
• Legitimate interests: Processing for website security, fraud prevention, and service improvement; and
• Consent: Where you have given explicit consent, such as opting into marketing communications.

5. HIPAA & Protected Health Information

Lumae Aesthetics and Wellness is a healthcare provider subject to the Health Insurance Portability and Accountability Act (HIPAA). Information you provide in connection with clinical consultations, intake forms, telehealth sessions, or treatment records constitutes Protected Health Information (PHI) and is subject to HIPAA's Privacy Rule.

Our handling of PHI is described in detail in our HIPAA Notice of Privacy Practices, which is incorporated by reference into this Privacy Policy. In the event of a conflict between this Privacy Policy and the HIPAA Notice, the HIPAA Notice governs with respect to PHI.

We use HIPAA-compliant platforms for all clinical communications, including Doxy.me for video consultations and DoseSpot/DrFirst for electronic prescriptions.

6. How We Share Your Information

We do not sell your personal information. We may share your information in the following limited circumstances:

• Service providers: We share information with trusted vendors who assist us in operating the Site and delivering services, including our booking platform (Vagaro), electronic health record systems, payment processors, and IT service providers. These parties are contractually required to protect your information and may only use it to provide services on our behalf.
• Healthcare partners: With your consent or as necessary for treatment, we may share clinical information with pharmacies (including Empower Pharmacy, Houston TX), laboratory providers, or referring physicians.
• Legal compliance: We may disclose information when required by law, court order, subpoena, or governmental regulation, or when necessary to protect the rights, property, or safety of Lumae, our patients, or the public.
• Business transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, patient and user data may be transferred as part of that transaction, subject to applicable law.

7. Cookies and Tracking Technologies

What Are Cookies?

Cookies are small text files placed on your device when you visit our Site. We also use similar technologies such as web beacons and local storage. These help us remember your preferences, analyze usage, and improve your experience.

Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Site to function. These cannot be disabled. They include session cookies and security tokens.
• Analytics Cookies: Help us understand how visitors use the Site (pages visited, time on page, referral sources). We may use services such as Google Analytics. Data collected is aggregated and anonymous.
• Functional Cookies: Remember your preferences (such as form fields) to improve your experience on return visits.
• Third-Party Booking Cookies: Our booking platform (Vagaro) may set cookies when you access scheduling features. These are governed by Vagaro's own privacy policy.

Managing Cookies

Most browsers allow you to refuse or delete cookies through their settings. Disabling certain cookies may affect the functionality of the Site. You may also opt out of Google Analytics tracking by installing the Google Analytics opt-out browser add-on.

8. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, including for legal, accounting, and regulatory compliance. Medical and health records are retained in accordance with Texas Health & Safety Code requirements (generally a minimum of 10 years for adult patients). When personal information is no longer needed, we securely delete or anonymize it.

9. Data Security

We implement administrative, technical, and physical safeguards appropriate to the sensitivity of the information we hold. Our clinical systems use HIPAA-compliant encryption, access controls, and audit logging. Our website uses HTTPS encryption for all data in transit.

No method of transmission over the internet is 100% secure. We cannot guarantee the absolute security of information you transmit to us, but we are committed to protecting it to the best of our ability and will notify you of any breach affecting your information as required by law.

10. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

• Right to access: Request a copy of the personal information we hold about you;
• Right to correction: Request that we correct inaccurate or incomplete information;
• Right to deletion: Request deletion of your personal information, subject to applicable legal obligations (note: health records are subject to separate retention requirements under Texas law);
• Right to opt out of marketing: Unsubscribe from marketing emails at any time using the unsubscribe link in any email or by contacting us directly;
• Right to data portability: Request your data in a structured, machine-readable format where technically feasible.

For rights specifically related to your Protected Health Information (PHI), please see our HIPAA Notice of Privacy Practices.

To exercise any of the above rights, contact us using the information in Section 11. We will respond within 30 days.

11. Children's Privacy

Our Site is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us immediately so we can take appropriate steps to delete it.

12. Third-Party Links

Our Site may contain links to third-party websites (such as Vagaro for booking or Doxy.me for telehealth). We are not responsible for the privacy practices of those sites and encourage you to review their respective privacy policies before providing any information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page. We encourage you to review this Policy periodically. Your continued use of the Site after any changes constitutes your acceptance of the updated Policy.

14. Contact Us

If you have questions about this Privacy Policy, wish to exercise your rights, or have a privacy concern, please contact us: