Privacy Policy
Last updated: June 2026
Notice: This privacy policy is provided for informational purposes and is designed to meet general US privacy compliance standards, including HIPAA, CCPA/CPRA (California), VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), and UCPA (Utah). We recommend periodic review by a licensed attorney to ensure ongoing compliance with evolving state and federal regulations.
1. Introduction
Renova Wellness (“we,” “us,” or “our”) operates the website renovawellnessutah.com and provides medical spa, aesthetic, and wellness services at our Lindon, Utah location. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you visit our website, use our services, or interact with us.
By accessing or using our website and services, you agree to this Privacy Policy. If you do not agree, please discontinue use of our site and services.
2. Information We Collect
2.1 Information You Provide Directly
- Contact information: Name, email address, phone number, mailing address
- Appointment and service requests: Service preferences, scheduling information, consultation details
- Health information: Medical history, current health conditions, treatment preferences (governed by HIPAA)
- Payment information: Billing address, insurance details (we do not store credit card numbers directly)
- Communications: Messages sent through our contact forms, quiz submissions, or emails
- Account information: If you create an account, we collect login credentials
2.2 Information Collected Automatically
- Device information: Browser type, operating system, device identifiers
- Usage data: Pages visited, time spent, referring URLs, click patterns
- IP address and approximate location (country/region level)
- Cookies and similar technologies: See Section 7 (Cookie Policy) for details
2.3 Information from Third Parties
- Referring healthcare providers
- Insurance companies (for billing verification)
- Analytics and advertising partners (aggregate, non-identifiable data)
3. How We Use Your Information
We use collected information for the following purposes:
- To provide, maintain, and improve our medical and aesthetic services
- To schedule appointments and communicate about your care
- To process payments and insurance claims
- To respond to inquiries and provide customer support
- To send appointment reminders and follow-up communications
- To personalize your experience on our website
- To analyze website usage and improve our online services (with your consent)
- To comply with legal obligations and protect our rights
- To detect, prevent, and address security incidents
We do not sell your personal information. We have not sold personal information in the preceding 12 months and have no plans to do so.
4. HIPAA Compliance
As a medical provider, Renova Wellness complies with the Health Insurance Portability and Accountability Act (HIPAA). Your Protected Health Information (PHI) is handled in accordance with our Notice of Privacy Practices, which is provided separately and available at our office.
Key protections include:
- PHI is used only for treatment, payment, and healthcare operations unless you authorize otherwise
- We maintain administrative, technical, and physical safeguards to protect your PHI
- Our staff receives regular HIPAA compliance training
- You have the right to access, amend, and receive an accounting of disclosures of your PHI
- We will notify you promptly in the event of a data breach affecting your PHI
5. Information Sharing and Disclosure
We may share your information only in the following circumstances:
- Service providers: Third parties who assist us in operating our website, conducting business, or servicing you (e.g., appointment scheduling, payment processing)
- Healthcare providers: For treatment coordination, with your consent
- Insurance companies: For billing and claims processing
- Legal compliance: When required by law, subpoena, or other legal process
- Business transfers: In connection with a merger, acquisition, or sale of assets (you will be notified)
- With your consent: When you have given explicit permission
We do not share personal information for cross-context behavioral advertising without your opt-in consent.
6. Your Privacy Rights by State
California (CCPA/CPRA)
California residents have the right to:
- Know what personal information we collect, use, disclose, and sell
- Delete personal information we hold about you
- Opt out of the sale or sharing of personal information
- Correct inaccurate personal information
- Limit the use and disclosure of sensitive personal information
- Non-discrimination for exercising your privacy rights
To exercise these rights, visit our Privacy Rights Request page or call (801) 383-0773.
Virginia (VCDPA)
Virginia residents have the right to access, correct, delete, and obtain a copy of personal data; opt out of targeted advertising, sale of personal data, and profiling.
Colorado (CPA)
Colorado residents have the right to access, correct, delete personal data; opt out of targeted advertising, sale, and profiling; and appeal our decisions regarding privacy requests.
Connecticut (CTDPA)
Connecticut residents have similar rights to access, correct, delete, and port personal data; opt out of sale, targeted advertising, and profiling.
Utah (UCPA)
Utah residents have the right to access and delete personal data, and opt out of the sale of personal data and targeted advertising.
Other States
We honor privacy rights requests from residents of all US states with comprehensive privacy laws (including Montana, Oregon, Texas, Delaware, Iowa, Tennessee, Indiana, and others that may come into effect). Submit a request through our Privacy Rights Request page.
7. Cookie Policy
Our website uses cookies and similar tracking technologies. We categorize them as follows:
Essential Cookies (Always Active)
Required for basic site functionality: session management, security features, cookie consent preferences. These cannot be disabled.
Analytics Cookies (Opt-In)
Help us understand how visitors use our site (e.g., Google Analytics). Only activated with your consent.
Marketing Cookies (Opt-In)
Used for advertising campaigns and measuring ad effectiveness (e.g., Meta Pixel, Google Ads). Only activated with your consent.
You can manage your cookie preferences at any time by clicking “Cookie Preferences” in our website footer. You can also control cookies through your browser settings.
8. Do Not Track & Global Privacy Control
We honor the Global Privacy Control (GPC) signal. When we detect a GPC signal from your browser, we treat it as a valid opt-out request for the sale or sharing of personal information, as required by applicable state laws.
For more information about GPC, visit globalprivacycontrol.org.
9. Data Security
We implement industry-standard security measures to protect your information, including:
- SSL/TLS encryption for all data transmission
- Encrypted password storage using bcrypt hashing
- Account lockout protection against brute-force attacks
- Login audit trails and monitoring
- Bot and attack detection (SQL injection, XSS, path traversal)
- Regular security reviews and updates
- Role-based access controls for staff
While we strive to protect your information, no method of electronic transmission or storage is 100% secure. If you believe your account has been compromised, please contact us immediately.
10. Data Retention
We retain personal information for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required by law. Specifically:
- Medical records: Retained per Utah state medical record retention requirements (minimum 7 years for adults)
- Website analytics data: Aggregated after 26 months
- Contact form submissions: Retained for 3 years unless you request deletion
- Cookie consent records: Retained for 1 year from the date of consent
11. Children's Privacy
Our website and services are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors without parental consent. If you believe we have inadvertently collected such information, please contact us and we will promptly delete it.
12. Third-Party Links
Our website may contain links to third-party websites or services not operated by us (e.g., appointment scheduling platforms, social media pages). We are not responsible for the privacy practices of these external sites and encourage you to review their privacy policies.
13. Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices or applicable laws. Material changes will be posted on this page with an updated “Last updated” date. We encourage you to review this policy regularly.
14. Contact Us
If you have questions about this Privacy Policy, wish to exercise your privacy rights, or need to report a concern, please contact us: