PRIVACY POLICY Melapop Aesthetics & Wellness Effective Date: May 2026

We collect the following categories of personal information:

Identifiers: Name, email address, phone number, and billing address
Payment Information: Credit and debit card details processed securely through Square and Stripe. We do not store full payment card numbers on our systems.
Health & Medical Information: Health intake forms, treatment history, contraindications, and other information necessary to provide safe and appropriate services
Photos & Images: Before and after photos collected with your consent for documentation and treatment purposes
Location Data: General location information collected through our website or provided at the time of booking

HOW WE COLLECT YOUR INFORMATION

We collect information directly from you when you:

Book an appointment or complete an intake form
Make a purchase in person or online
Enroll in a membership
Subscribe to our email or SMS communications
Contact us by phone or email

We also collect information automatically through our website via cookies and analytics tools.

HOW WE USE YOUR INFORMATION

We use your personal information to:

Provide, manage, and improve our services
Process payments and manage your account
Send appointment reminders, confirmations, and follow-up communications
Send marketing emails and SMS messages you have opted into
Maintain accurate health and treatment records
Comply with legal and regulatory obligations
Protect the safety of our clients and staff

We do not sell your personal information to third parties.

THIRD-PARTY SERVICE PROVIDERS

We share your information only with trusted third-party service providers who assist us in operating our business. These providers are contractually obligated to protect your information and use it only for the purposes for which it was shared. Our current third-party providers include:

Square — payment processing (squareup.com)
Stripe — payment processing (stripe.com)
Mailchimp — email marketing (mailchimp.com)
Klaviyo — email and SMS marketing (klaviyo.com)
Boulevard — appointment booking and client management (joinblvd.com)
GlossGenius — booking and business management (glossgenius.com)

Each provider maintains its own privacy policy governing their use of your data. We encourage you to review their policies directly.

HEALTH INFORMATION

Health and medical information collected through intake forms and during treatment is used solely for the purpose of providing safe, appropriate, and effective services. This information is maintained in accordance with applicable state and federal privacy standards. Under Georgia law (O.C.G.A. 31-33-1 et seq.) and Texas law (Tex. Health & Safety Code 181.001 et seq., the Texas Medical Records Privacy Act), clients have the right to access and request corrections to their health records. We do not sell, lease, or share your health information with any third party except as required by law or as necessary to provide your care.

PHOTOGRAPHY & IMAGE USE

Before and after photos are collected with your explicit written consent. Photos will not be used for marketing, social media, or any public-facing purpose without a separate signed release. You may withdraw consent for image use at any time by contacting us at hello@melapopaesthetics.com.

MARKETING COMMUNICATIONS

By providing your email address or phone number, you may receive marketing communications from us. You may opt out of email marketing at any time by clicking the unsubscribe link in any email. To opt out of SMS communications, reply STOP to any text message. Opting out of marketing communications does not affect transactional messages related to your appointments or purchases.

All SMS marketing is conducted in compliance with the Telephone Consumer Protection Act (TCPA) and applicable carrier requirements. Message and data rates may apply.

YOUR PRIVACY RIGHTS

Georgia Residents Georgia residents are protected under the Georgia Computer Systems Protection Act (O.C.G.A. 16-9-90 et seq.) and applicable federal privacy law. You have the right to:

Request access to the personal information we hold about you
Request correction of inaccurate information
Request deletion of your information, subject to legal retention requirements
Be notified in the event of a data breach affecting your personal information, in accordance with O.C.G.A. 10-1-910 et seq.

Texas Residents Under the Texas Data Privacy and Security Act (TDPSA), effective July 1, 2024, Texas residents have the right to:

Confirm whether we are processing your personal data
Access your personal data
Correct inaccuracies in your personal data
Delete personal data you have provided or that we have collected about you
Obtain a portable copy of your personal data
Opt out of the processing of your personal data for targeted advertising or profiling
Appeal our response to a privacy request

To submit a privacy request, contact us at hello@melapopaesthetics.com or (469) 359-1824. We will respond within 45 days as required by the TDPSA, with the option to extend by an additional 45 days when reasonably necessary.

California Residents (CCPA) If you are a California resident, you have the right to:

Know what personal information we collect, use, and share
Request deletion of your personal information
Opt out of the sale of your personal information (we do not sell personal data)
Non-discrimination for exercising your privacy rights

EU/UK Residents (GDPR) If you are located in the European Union or United Kingdom, you have additional rights under the General Data Protection Regulation, including the right to data portability and the right to lodge a complaint with your local supervisory authority. Our lawful basis for processing your data is performance of a contract, legitimate business interest, and where applicable, your explicit consent.

To exercise any of your privacy rights, contact us at hello@melapopaesthetics.com or (469) 359-1824.

DATA BREACH NOTIFICATION

In the event of a data breach that affects your personal information, we will notify affected individuals in accordance with:

Georgia law: O.C.G.A. 10-1-910 et seq., requiring notification within a reasonable time
Texas law: Tex. Bus. & Com. Code 521.053, requiring notification as expeditiously as possible and no later than 60 days after discovery of the breach

Notifications will be provided via email or written notice to the address on file.

DATA RETENTION

We retain your personal information for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. Health records are retained in accordance with applicable Georgia and Texas state law. You may request deletion of your data at any time, subject to any legal retention requirements.

DATA SECURITY

We implement reasonable administrative, technical, and physical safeguards to protect your personal information from unauthorized access, disclosure, or misuse. However, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security and are not liable for unauthorized access resulting from circumstances beyond our reasonable control.

Our website may use cookies and similar tracking technologies to improve your browsing experience and analyze site traffic. You may adjust your browser settings to refuse cookies, though doing so may affect the functionality of certain features on our site.

CHANGES TO THIS POLICY

We reserve the right to update this Privacy Policy at any time. Changes will be posted on our website with an updated effective date. Continued use of our services following any changes constitutes your acceptance of the revised policy.

For questions, concerns, or requests related to this Privacy Policy or your privacy rights, please contact us:

Email: hello@melapopaesthetics.com Phone: (469) 359-1824 Georgia Location: 1215 Eagles Landing Pkwy, Stockbridge, GA 30281 Texas Location: Houston, TX

By using our website or services, you acknowledge that you have read and understood this Privacy Policy.

PRIVACY POLICY Melapop Aesthetics & Wellness Effective Date: May 2026

Information we collect