Privacy Policy
A medical spa owns its clients’ records. We hold them on the spa’s behalf, encrypted, and we do not sell them or use them for advertising.
Last updated 17 September 2026
Who we are, and what this covers
MD Spa Mentor LLC is a Wyoming limited liability company. We make software that medical spas use to run their business: booking appointments, keeping client records, clinical charting, consent and intake forms, selling packages, taking payment and working out commission.
This policy explains what we do with information. It covers two very different kinds, and the difference matters more than anything else on this page.
| Whose information | Our role |
|---|---|
| A med spa's own information. The business, its staff accounts, its billing with us | We decide how it is handled. This policy governs it directly |
| A med spa's clients' information. Names, contact details, appointments, photographs, consent forms, clinical notes, payments | The spa decides. We hold and process it on the spa's instructions. The spa's own privacy notice governs its relationship with its clients |
If you are a client of a medical spa and you want to know what that spa holds about you, or you want it corrected or deleted, ask the spa. They hold the record and they can act on it. We are the software underneath, and we will help them do it.
Written to: MD Spa Mentor LLC, 30 N Gould St, Sheridan, WY 82801, or [email protected].
What information is in the software
A medical spa decides what to record. In practice the software holds:
- Client name, telephone number, email address and date of birth
- Appointments: when, which treatment, which room, what happened
- Packages bought and sessions remaining
- Payments, invoices, refunds and the method used
- Photographs and files the spa attaches to a client record
- Signed consent and intake forms, including the answers given
- Clinical notes written by the spa's clinicians
- Staff accounts: name, email address, role, and a record of what they did in the system
Some of this is health information
An intake form asks about pregnancy, blood thinners, a pacemaker, allergies and medication. A clinical note records a treatment performed on a person. We do not pretend otherwise, and it is handled accordingly: encrypted, access controlled, access recorded, and never used for anything other than running that spa.
We do not claim HIPAA compliance or certification. There is no certificate to hold, and a spa is not made compliant by the software it buys.
Whether HIPAA reaches a particular spa at all is a narrower question than most people expect. It turns on whether that spa transmits health information electronically in connection with a transaction covered by the federal rules, which in practice means claims, eligibility checks, prior authorization and the like, sent to a health plan. Keeping records in a system, or having a client sign a form on an iPad, is not one of those. That question is for the spa and its own advisers, not for us.
What is not in doubt is that state medical privacy law applies either way. So rather than argue about which federal rules reach whom, we state plainly what we actually do, below, and we are prepared to be held to it.
Why we hold it
To provide the software to the medical spa that asked for it, and for nothing else.
- To show the spa its own calendar, its own clients and its own numbers
- To send the three messages described on the Emails we send page
- To keep backups, so a spa does not lose its records
- To answer a support question the spa has asked us
- To bill the spa for the software
- To keep the service secure and to investigate misuse
What we never do with it
- We do not sell it. Not to anyone, in any form, ever
- We do not use it for advertising, ours or anybody else's
- We do not use one spa's clients to market to another spa
- We do not train anything on it
- We do not read clinical notes except where a spa asks us to look at a specific problem, or where we are legally required to
How it is protected
The specifics are on the Security page. In summary:
- Encrypted in transit. Every connection to the software is over HTTPS
- Encrypted at rest. Backups are encrypted before they leave the server, with a key we hold separately
- Access is controlled. Six roles, and what a person may do depends on theirs
- Access is recorded. Who looked at what, and who changed what
- Approved devices only, with automatic sign out when a screen is left
- A signed clinical note is never edited. A correction is a dated, signed addendum, and what a client signed is frozen exactly as it was signed
No system is perfect and anyone who tells you otherwise is selling something. If information is ever exposed, we will tell the affected spa promptly and plainly, with what we know, what we do not yet know, and what we are doing about it.
How long it is kept
A spa's records are kept for as long as that spa is a customer, because they are the spa's working records and it needs them.
- While you are a customer: everything, until you delete it
- If you leave: tell us, and we export everything for you in a form you can open. Thirty days after that, we delete it, unless you ask us to hold it longer
- Backups roll off on their own schedule, so a deleted record can persist in an encrypted backup for a short period before it is gone
- Billing records we keep for as long as tax and accounting rules require
Clinical records carry their own retention obligations under state law, and those are the spa's to meet. We will not delete a spa's clinical records out from under it, and we will not refuse to hand them over.
Your rights, and the laws that give them
If you are a medical spa using the software
- Ask for everything we hold about your business, and get it
- Correct anything that is wrong
- Export your records at any time, in a form you can open
- Ask us to delete your account and your records
If you are a client of a medical spa
Ask the spa. They hold your record, they decide what happens to it, and they can see it, correct it, export it or delete it themselves. If you cannot reach them, or they will not answer, write to us at [email protected] and we will do what we can to help, which usually means putting you back in touch with the spa.
State privacy laws, wherever your clients are
Medical information is protected by state law as well as federal law, and which state law applies depends on where the client is, not where we are. Several states protect it more strictly than the federal rules do.
- California. The Confidentiality of Medical Information Act applies to providers of health care and to the businesses that hold medical information for them, whether or not anyone bills a health plan. California residents also have rights under the CCPA
- Washington. The My Health My Data Act covers consumer health data and lets a resident bring a claim directly
- Nevada and Connecticut have their own consumer health data laws, enforced by their attorneys general
- Texas defines a covered entity more broadly than the federal rules do
Rather than doing the minimum in each state, we hold to the strictest standard that applies to any of them. The same encryption, the same access controls, the same audit records and the same refusal to sell anything, for every spa on the system.
What you can ask for, wherever you are
To know what is held, to have it corrected, to have it deleted, to get a copy, and not to be treated differently for asking. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of.
To exercise a right over a record a spa holds, contact the spa, because the spa holds it and can act on it. For anything we hold ourselves, write to us.
Changes, and how to reach us
If this policy changes in a way that matters, we will change the date at the top and tell the spas using the software. We will not quietly rewrite it.
Contact
MD Spa Mentor LLC
30 N Gould St, Sheridan, WY 82801
General: [email protected]
Privacy and anything about a record: [email protected]
The return address on every message the software sends: [email protected]
A person reads these. You will get an answer.