Effective Date: 11/5/25
Last Updated: 10/12/26

Please read carefully.

Introduction

The Things We Do, PC ("TWD," "Company," "we," "us," or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our online booking or contact forms, or communicate with us via SMS text messages or other electronic means. This Policy is provided in accordance with applicable federal and state privacy, consumer protection, and healthcare laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Health Insurance Portability and Accountability Act (HIPAA), and the Telephone Consumer Protection Act (TCPA). This Policy applies to users located in the United States, including California residents. Use of our website and services is also governed by our Terms of Service.

Notice at Collection: We collect personal information as described below. We do not sell or share personal information for cross-context behavioral advertising without your consent. To exercise your rights, please see the "Your Rights Under California Law" section below.

Information We Collect

We collect the following categories of information:

Personal Information:

• Name, date of birth, phone number, email address, mailing address
• Medical or treatment information you voluntarily provide (e.g., skin type, allergies, medical history relevant to your care) and photos or videos used for medical documentation or treatment progress
• Sensitive personal information (as defined under the CPRA), such as health information, biometric identifiers, or precise geolocation data, when required for treatment or regulatory compliance

Commercial and Financial Information:

• Payment card details and billing information (processed securely through compliant vendors)
• Records of services purchased or inquired about

Technical Information:

• IP address, browser type, operating system, referring URLs, time and date of visits, interactions with our site, and usage data collected automatically through cookies, analytics tools, and similar technologies

Communications Information:

• Information you provide when contacting us via web forms, chat, email, or SMS

We collect only the information necessary to fulfill the purposes described in this Policy and retain it only as long as required by law or business necessity.

SMS Text Messaging and Communications

By checking the box or otherwise signing up for one or more text messaging programs, you provide express prior written consent (as required under the Telephone Consumer Protection Act, 47 U.S.C. §227) to receive SMS text messages from TWD related to informational messages and promotional messages.

• Message & Data Rates May Apply.
• You may opt out of SMS communications at any time by replying "STOP."
• You may request help by replying "HELP."
• We do not sell or share your phone number with third parties for marketing purposes.
• SMS communications are transmitted through secure third-party messaging platforms compliant with applicable privacy laws.

When you opt in to receive SMS messages from TWD, we may collect certain personal information such as your phone number, your carrier's name, and the date, time, and content of your messages. We use this information to provide you with the SMS services you have requested and to operate and improve our services.

Your consent remains valid until revoked. We maintain records of SMS consent and opt-out requests as required by applicable regulations. All messaging vendors are contractually bound to maintain confidentiality and comply with TCPA and HIPAA standards.

For more information, please see our SMS Terms and Conditions.

How We Use Your Information

We use collected information to:

• Schedule and confirm appointments
• Provide requested treatments or services
• Send confirmations, reminders, and follow-up communications (including via SMS with opt-out options)
• Send promotional materials, newsletters, or special offers (including via SMS with opt-out options)
• Improve our website and services
• Process payments and maintain records
• Respond to inquiries and provide customer support
• Comply with relevant legal, regulatory, and safety obligations (including HIPAA, where applicable)

We collect and process personal information only as necessary to provide our services or as otherwise permitted by law.

Use and Disclosure of Medical and Health Information

If you receive medical or aesthetic treatments that generate Protected Health Information (PHI), such information is handled under HIPAA standards.

• PHI is used and disclosed only for treatment, payment, and healthcare operations, unless you authorize otherwise in writing.
• We implement administrative, technical, and physical safeguards to protect PHI.
• You have rights under HIPAA, including the right to access, amend, and request an accounting of disclosures of your PHI.

For more information, please see our Notice of Privacy Practices. In the event of any conflict between this Policy and our Notice of Privacy Practices, the Notice of Privacy Practices shall control with respect to PHI.

Disclosure of Information

We do not sell personal information and do not share personal or mobile data with third parties for cross-context behavioral advertising or independent marketing purposes. We may disclose personal information only to service providers and contractors who assist us in operating our business and are contractually restricted from retaining, using, or disclosing the information for any purpose other than providing services on our behalf.

Business Operations: We may share your information with third-party service providers who assist us in essential operational functions, including but not limited to:

• Appointment scheduling and customer service
• Payment and billing processing (compliant processors)
• Secure data hosting and website maintenance
• IT and cybersecurity support
• Email or SMS delivery platforms used solely to send communications authorized by you

Marketing and Communications: We may use your contact information (such as your email address or phone number) to send you promotional offers, newsletters, or product and service recommendations directly from TWD. We may engage trusted vendors to help us deliver these communications on our behalf. These vendors do not have the right to use your information for their own marketing purposes. We will only share your information for marketing with your explicit opt-in consent, collected through a clear and affirmative action (for example, checking an opt-in box on a web form). You may withdraw consent or opt out at any time by clicking "unsubscribe" or replying "STOP."

Compliance with Legal Requirements: We may disclose your information if required to do so by law or in the good-faith belief that such action is necessary to:

• Comply with legal obligations, court orders, or regulatory requests;
• Protect and defend our rights or property;
• Prevent or investigate possible wrongdoing or fraud; or
• Protect the personal safety of our staff, clients, or the public.

Sale, Merger, or Corporate Transfer: In the event of a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred to the acquiring entity. We will ensure that your information continues to be protected in accordance with this Privacy Policy, and you will be notified of any material changes in how your data is handled.

Cookies, Analytics, and Online Tracking

When you visit or log in to our website, we and our third-party analytics or advertising partners may use cookies, pixels, analytic technologies (e.g., Google Analytics), and similar technologies to collect data about your activity, understand user behavior, and improve our services.

This information may be linked to other identifiers (such as an email or home address) to deliver more relevant advertising from TWD. You may opt out of such advertising and data sharing by visiting Your Privacy Choices or by contacting us using the details below.

You will have the opportunity to accept or decline cookies. You can also manage cookie preferences through your browser settings. You may disable cookies via your browser, though certain features may not function properly.

Retention of Information

We retain information for as long as necessary to provide services, comply with legal obligations, resolve disputes, and maintain business records. Retention periods vary depending on the category of information and are determined based on statutory requirements, business needs, and data minimization principles. Medical and billing records are retained according to California Health & Safety Code §123145 and applicable federal requirements.

Your Rights Under California Law

California residents have the following rights under the CCPA/CPRA:

• Right to Know: Request disclosure of the categories and specific pieces of personal information collected.
• Right to Delete: Request deletion of personal information, subject to legal exceptions.
• Right to Correct: Request correction of inaccurate data.
• Right to Opt-Out of Sale/Sharing: We do not sell personal information, but you may opt out of any sharing for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information: You may request that we limit the use of health-related or biometric information.
• Right to Non-Discrimination: You will not be penalized or denied services for exercising your rights.

To exercise your rights, contact us at:

Email: info@thethingswedo.co
Phone: (213) 278-0358

We will verify your identity before fulfilling any request, as required by law.

Email

• If you provide your email, you may receive updates, offers, or newsletters.
• You may unsubscribe at any time by clicking the "unsubscribe" link in the email or emailing us directly.
• Emails regarding treatment, billing, or compliance are not considered marketing and cannot be opted out of if necessary for service delivery.
• All marketing emails comply with the CAN-SPAM Act (15 U.S.C. §7701 et seq.) and include our valid business contact information.

Children's Privacy

Our services are intended for individuals 18 years and older. We do not knowingly collect or solicit personal information from minors. If we learn that we have inadvertently collected such data, we will promptly delete it.

Security

We maintain administrative, technical, and physical safeguards designed to protect personal and health information against unauthorized access, disclosure, alteration, or destruction. We comply with the HIPAA Security Rule (45 C.F.R. §164.300 et seq.) and maintain appropriate safeguards. If a data breach occurs involving your personal information, we will notify you and applicable authorities as required by law. However, no transmission over the internet or mobile network can be guaranteed to be completely secure.

Do Not Track

Some internet browsers may transmit "do-not-track" signals to websites with which the browser communicates. Our website does not currently respond to these "do-not-track" signals.

Third-Party Links

Our website and services may contain links to other websites or applications ("Linked Sites") that are not owned by TWD. We do not control the collection or use of any information, including personal information, which occurs while you visit Linked Sites, and TWD is not responsible for the privacy practices of those Linked Sites. We encourage you to be aware of when you leave our website and to read the privacy policies of any Linked Sites you visit.

Changes to This Privacy Policy

We may update this Policy periodically. The "Last Updated" date at the top will reflect the latest revision. Material changes will be posted on our website, and we may notify you by email or SMS where legally required and depending on your communication preference.

Contact

If you have questions or need assistance, please contact us at:

The Things We Do, PC
Address: 787 S Alameda St. #100, Los Angeles, CA 90021
Email: info@thethingswedo.co
Phone: (213) 278-0358

If you require this Privacy Policy in an alternative format for accessibility purposes, please contact us at info@thethingswedo.co.