Website Privacy Policy

Effective Date: July 28, 2026
Last Updated: July 28, 2026

CMA Medicine, also known as the Center for Modern Aesthetic Medicine (“CMA,” “we,” “us,” or “our”), respects your privacy and is committed to handling personal information responsibly.

This Website Privacy Policy explains how we collect, use, disclose, and protect information when you:

Visit cmamedicine.com.
Submit an inquiry or appointment request.
Request a virtual consultation.
Communicate with CMA electronically.
Register for an event, promotion, membership, or patient program.
Interact with website cookies, analytics, or advertising technologies.
Follow links from the Site to scheduling, payment, financing, retail, or other services.

By using the Site, you acknowledge the practices described in this Policy.

1. Important Notice About Health Information

This Website Privacy Policy applies primarily to personal information collected through CMA’s public-facing website and related online interactions.

It is separate from CMA’s HIPAA Notice of Privacy Practices, which describes how CMA may use and disclose Protected Health Information as a healthcare provider and explains patient rights under the Health Insurance Portability and Accountability Act and other applicable laws.

Information may become Protected Health Information when it is created, received, maintained, or transmitted by CMA in connection with providing healthcare services to an identifiable patient.

When information is governed by the HIPAA Notice of Privacy Practices, that notice and applicable healthcare privacy law will control if they conflict with this Website Privacy Policy.

A copy of CMA’s HIPAA Notice of Privacy Practices should be available on the Site, at CMA locations, and upon request.

2. Scope of This Policy

This Policy applies to information CMA collects through the Site and CMA-controlled electronic communications that link to this Policy.

It does not govern the independent privacy practices of third-party websites or services, including external:

Appointment and patient-management platforms.
Payment processors and financing providers.
Product manufacturers and retailers.
Shopify stores.
Social-media platforms.
Mapping, video, review, or advertising services.
Laboratories, pharmacies, or other healthcare businesses.

Those organizations maintain their own privacy policies and terms. You should review their policies before submitting information.

3. Personal Information We May Collect

The information collected depends on how you interact with CMA.

A. Contact and Identification Information

We may collect:

Name.
Email address.
Telephone or mobile number.
Mailing address.
Date of birth or age where relevant.
Preferred CMA location.
Preferred contact method.
Account or patient identifiers.
Parent, guardian, caregiver, or authorized representative information.

B. Appointment and Inquiry Information

When you request an appointment or consultation, we may collect:

Requested service or treatment.
Appointment dates and scheduling preferences.
Provider or location preference.
Reason for contacting CMA.
Referral source.
Prior-patient status.
Information needed to confirm, reschedule, or cancel an appointment.

C. Health-Related Information You Provide

You may voluntarily provide information about:

Medical history.
Skin conditions or treatment concerns.
Symptoms.
Medications or allergies.
Previous procedures.
Pregnancy or nursing status.
Treatment goals.
Photographs of a treatment area.
Other health or wellness information.

Once CMA receives health-related information in connection with patient care, it may be governed by CMA’s HIPAA Notice of Privacy Practices.

Please do not submit sensitive medical information through ordinary email, social media, or a general website form unless CMA has directed you to use that method. Use a secure patient platform when one is made available.

D. Transaction and Financial Information

When you purchase a service, package, gift card, membership, product, or event registration, CMA or an authorized payment provider may collect:

Billing name and address.
Payment-card information.
Transaction history.
Purchase or membership details.
Deposit and refund information.
Financing application or account information.

CMA may receive transaction confirmation and limited payment details while a payment processor retains the complete payment-card information.

E. Communications

We may maintain records of communications sent through:

Website forms.
Email.
Telephone or voicemail.
Text message.
Secure patient systems.
Surveys.
Reviews.
Social-media messages.
Customer-service or appointment communications.

Telephone or video communications will be recorded only when permitted by law and after any required notice or consent.

F. Photographs, Videos, Reviews, and Testimonials

We may collect photographs, videos, treatment images, reviews, survey responses, or testimonials that you voluntarily provide.

CMA will obtain any authorization required before publicly using identifiable patient photographs, videos, treatment information, or testimonials.

G. Device and Website-Usage Information

When you use the Site, CMA and its technology providers may automatically collect:

Internet Protocol address.
Browser and device type.
Operating system.
Approximate geographic region derived from an IP address.
Date and time of access.
Pages viewed.
Links selected.
Referring and exit pages.
Search terms entered on the Site.
Session duration.
Cookie identifiers.
Advertising or analytics identifiers.
Information about interactions with forms, videos, advertisements, and website features.

We may use Google Tag Manager and similar tools to manage analytics, functionality, and advertising technologies deployed on the Site.

4. Cookies and Similar Technologies

CMA and its service providers may use cookies, pixels, tags, software-development tools, local storage, and similar technologies.

These technologies may be used for the following purposes:

Essential Technologies

Essential technologies help the Site operate, secure forms, balance network traffic, maintain user preferences, and prevent fraud or abuse.

Functional Technologies

Functional technologies remember preferences and support website features such as maps, videos, embedded content, appointment tools, and chat or contact functions.

Analytics Technologies

Analytics technologies help us understand how visitors find and use the Site, which pages receive traffic, and how the Site can be improved.

Advertising Technologies

Advertising technologies may help CMA measure campaigns, limit repetitive advertisements, understand whether an advertisement led to a Site visit, and provide content or advertising that may be more relevant.

Information collected through tracking technologies should not be placed on patient-authenticated pages or configured to disclose Protected Health Information to an unauthorized third party.

5. Your Cookie Choices

Depending on the Site configuration, you may be able to manage nonessential cookies through a cookie-preference banner or settings tool.

You may also block or delete cookies through your browser. Blocking cookies may affect the availability or operation of certain Site functions.

Some browsers and devices offer “Do Not Track” or universal opt-out signals. CMA will recognize legally required opt-out signals when applicable and technically supported.

You may also contact CMA regarding available privacy choices.

6. How We Use Personal Information

CMA may use personal information to:

Operate, maintain, secure, and improve the Site.
Respond to questions and inquiries.
Process appointment and consultation requests.
Confirm, remind, reschedule, or cancel appointments.
Determine which CMA location or provider may be appropriate.
Provide requested healthcare and aesthetic services.
Maintain patient and business records.
Process payments, memberships, packages, deposits, and refunds.
Provide customer and patient support.
Send requested information about treatments, events, services, or products.
Deliver administrative and transactional communications.
Send marketing communications when permitted by law and consistent with your preferences.
Personalize Site content and measure engagement.
Analyze website traffic and advertising performance.
Detect, investigate, and prevent security incidents, fraud, or misuse.
Protect the safety, rights, and property of CMA, its patients, and others.
Comply with legal, professional, licensing, tax, accounting, and regulatory obligations.
Establish, exercise, or defend legal claims.
Carry out another purpose disclosed when information is collected or authorized by you.

7. How We Disclose Personal Information

CMA may disclose personal information in the following circumstances.

A. Healthcare Professionals and CMA Personnel

Information may be made available to authorized CMA physicians, clinicians, aestheticians, nurses, administrative personnel, billing personnel, and other workforce members who require it for their responsibilities.

Access to Protected Health Information is governed by CMA’s HIPAA policies and Notice of Privacy Practices.

B. Service Providers

CMA may engage vendors that provide:

Website hosting and maintenance.
Cybersecurity and technical support.
Appointment scheduling.
Patient-management and electronic-record systems.
Email, telephone, and text communications.
Payment processing and financing.
Customer-relationship management.
Marketing and advertising.
Analytics and website-performance measurement.
Cloud storage.
Professional consulting.
Billing, accounting, legal, or compliance services.

Vendors that handle Protected Health Information on CMA’s behalf will be required to enter into a Business Associate Agreement when required by HIPAA.

C. Services You Request

When you choose to interact with an external appointment platform, payment provider, financing company, retailer, laboratory, pharmacy, social-media service, or other third party, information may be disclosed to that party as necessary to complete your request.

D. Legal and Regulatory Requirements

CMA may disclose information when reasonably necessary to:

Comply with a law, regulation, court order, subpoena, or lawful process.
Respond to an authorized regulatory, licensing, public-health, or law-enforcement request.
Report suspected abuse, neglect, or threats to health or safety where permitted or required.
Protect CMA’s legal rights.
Investigate fraud, security incidents, unlawful activity, or violations of CMA policies.

Disclosures of Protected Health Information will be made only as permitted or required by applicable healthcare privacy law.

E. Business Transactions

Information may be evaluated, transferred, or disclosed in connection with a merger, acquisition, financing, reorganization, sale of assets, or transfer of all or part of CMA’s operations.

Any successor will be required to handle Protected Health Information in accordance with applicable law.

F. With Your Direction or Authorization

CMA may disclose information when you request, direct, authorize, or consent to the disclosure.

G. Aggregated or De-Identified Information

CMA may use or disclose information that has been aggregated or de-identified so that it does not reasonably identify an individual.

8. Sale and Targeted Advertising

CMA does not sell Protected Health Information.

CMA does not use or disclose Protected Health Information for third-party marketing or targeted advertising unless permitted by law and any required authorization has been obtained.

CMA does not sell personal information in exchange for money.

Certain disclosures involving analytics or advertising cookies may be defined as a “sale,” “sharing,” or use for targeted advertising under the privacy laws of some states, even when no money is exchanged. Where such laws apply, eligible individuals may use CMA’s cookie controls or contact CMA to exercise an available opt-out right.

9. Email Communications

CMA may send email messages relating to:

Appointment requests and confirmations.
Patient-service and administrative matters.
Purchases, memberships, or transactions.
Events and programs.
Treatments, services, educational content, and promotions.

You may unsubscribe from promotional email by using the unsubscribe link contained in the message.

Unsubscribing from promotional email will not prevent CMA from sending nonmarketing communications concerning a requested appointment, patient-care matter, transaction, security issue, or other existing relationship.

Ordinary email may not be encrypted. You should avoid sending highly sensitive health, financial, or identification information by standard email.

10. Text Messages

When you provide your mobile number and separately consent to text communications, CMA and its authorized vendors may send messages regarding appointments, requested services, transactions, treatment instructions, patient support, or promotional offers.

Consent to receive marketing texts is not a condition of treatment or purchase. Message frequency varies, and message and data rates may apply.

You may reply STOP to opt out of nonessential messages or HELP for assistance.

CMA may retain records of your consent, opt-in method, message activity, and opt-out request to document compliance and honor your preferences.

11. Protected Health Information and Patient Rights

Patients have rights concerning their Protected Health Information, which may include rights to:

Request access to or a copy of medical records.
Request correction of certain information.
Request confidential communications.
Request certain restrictions.
Obtain an accounting of certain disclosures.
Receive a paper copy of CMA’s Notice of Privacy Practices.
Designate an authorized personal representative.
File a privacy complaint without retaliation.

The applicable procedures, limitations, and contact information must be provided in CMA’s HIPAA Notice of Privacy Practices.

Requests involving medical records or Protected Health Information should be directed through CMA’s designated Privacy Officer or approved patient-record request process, rather than through a general marketing opt-out request.

12. Rights Concerning Website Personal Information

Depending on where you reside and whether an applicable privacy law covers CMA’s activities, you may have the right to request that CMA:

Confirm whether it processes your personal information.
Provide access to certain personal information.
Correct inaccurate information.
Delete eligible information.
Provide a portable copy of eligible information.
Restrict or object to certain processing.
Opt you out of eligible targeted advertising, sale, or sharing.
Withdraw consent for future processing.
Review an appeal of a denied privacy request.

These rights may be limited by exceptions relating to healthcare records, legal compliance, fraud prevention, security, transaction completion, professional obligations, record-retention requirements, or the establishment and defense of legal claims.

A request concerning Protected Health Information will be handled under CMA’s HIPAA Notice of Privacy Practices rather than the general website process.

13. Submitting a Privacy Request

To submit a request concerning website personal information, contact:

Email: info@cmamedicine.com
Telephone: 904-772-5828

Please state that your message concerns a “Website Privacy Request.”

CMA may need to verify your identity and authority before completing a request. Verification information will be used only for processing and documenting the request.

An authorized agent may submit a request where permitted by law, but CMA may require proof of authorization and may verify the request directly with the individual.

14. Data Retention

CMA retains information for as long as reasonably necessary to:

Provide requested services.
Maintain patient, business, financial, and transaction records.
Fulfill the purposes described in this Policy.
Comply with healthcare, licensing, tax, accounting, insurance, and legal requirements.
Document consent and communication preferences.
Resolve disputes.
Protect legal rights.
Prevent fraud or security incidents.

Retention periods vary based on the information, the relationship involved, and applicable law.

Medical records and Protected Health Information are retained in accordance with applicable healthcare record-retention requirements and CMA policies.

15. Information Security

CMA uses reasonable administrative, technical, and physical safeguards designed to protect personal information.

Measures may include:

Access controls and authentication.
Workforce privacy and security procedures.
Encryption where appropriate.
Secure hosting and transmission methods.
Vendor oversight.
Backup and incident-response measures.
Monitoring and security updates.
Business Associate Agreements where required.

No website, database, email service, or transmission method can be guaranteed to be completely secure. You provide information electronically at your own risk.

If CMA determines that a legally reportable breach has occurred, CMA will provide notice as required by applicable federal and Florida law.

16. Online Tracking and Healthcare Privacy

Tracking technologies on healthcare websites require careful review because information about a person’s interaction with treatment pages, appointment tools, authenticated portals, or health-related forms may be sensitive.

CMA will evaluate tracking technologies and vendors based on factors that may include:

The pages on which the technology operates.
The information transmitted.
Whether the data can identify an individual.
Whether the information relates to treatment or payment.
The vendor’s permitted uses.
Whether a Business Associate Agreement is required.
Whether consent or another legal basis is required.

CMA should not intentionally disclose Protected Health Information to advertising or analytics vendors that are not legally authorized to receive it.

17. Children’s Privacy

The public Site is not directed to children under 13, and CMA does not knowingly collect personal information directly from a child under 13 through the Site without appropriate parental or legal authorization.

A parent or legal guardian should contact CMA on behalf of a minor.

Privacy rights relating to a minor patient’s medical information are governed by applicable healthcare law and CMA’s Notice of Privacy Practices.

If you believe a child has submitted information improperly, contact CMA so the matter can be reviewed.

18. Third-Party Links and Embedded Content

The Site may contain links to or embedded content from third-party services, including:

Appointment platforms.
Financing and payment services.
Shopify and product retailers.
Skincare and wellness brands.
Google Maps and analytics services.
Video providers.
Social-media platforms.
Review websites.

These third parties may collect information directly from your browser or device and are governed by their own privacy policies.

CMA does not control their independent data practices.

19. Social Media

Information you post publicly or send through a social-media platform may be visible to the platform, CMA, and other users.

Social-media messages are not a secure method for communicating confidential medical information. Do not use public comments or direct messages to discuss an emergency or submit detailed health information.

Your interaction with a social-media platform is also governed by that platform’s privacy policy.

20. International Visitors

CMA is based in Florida and primarily provides services within the United States.

If you access the Site from outside the United States, your information may be processed and stored in the United States, where privacy laws may differ from those in your country.

Using the Site constitutes an acknowledgment of that processing, subject to any rights that cannot lawfully be waived.

21. Changes to This Policy

CMA may update this Website Privacy Policy to reflect changes in its services, technologies, vendors, practices, or legal obligations.

The revised Policy will be posted with an updated “Last Updated” date. CMA may provide additional notice when a material change requires it.

Changes apply prospectively from the stated effective date.

22. Contact CMA Medicine

Questions about this Website Privacy Policy may be directed to:

CMA Medicine / Center for Modern Aesthetic Medicine
Email: info@cmamedicine.com

CMA San Marco
1478 Riverplace Boulevard, Suite 110
Jacksonville, Florida 32207
Telephone: 904-772-5828

CMA Jacksonville Beach
465 3rd Street North
Jacksonville Beach, Florida 32250
Telephone: 904-222-7546

For requests involving medical records, patient privacy rights, or Protected Health Information, contact CMA’s designated Privacy Officer using the contact information provided in CMA’s HIPAA Notice of Privacy Practices.