Privacy Policy

Last updated: PENDING COUNSEL — effective date for this v2 — the original page carries no date, and a date cannot be derived from any source; the client must set it at sign-off

Privacy is a fundamental right. We wrote this Privacy Notice to explain how we handle the Personal Information of visitors (“you”) to this website (the “Site”). It sets out the legal basis on which we process your Personal Information, and gives the other information that privacy laws and regulations around the world require us to give you.

Please read it. It explains how we use your Personal Information, what we owe you, and what rights you have.

Consent
Mobile messaging terms and conditions
What is Personal Information?
Your privacy rights at Rejuvv Luxury Spa
Why we collect Personal Information
How we collect Personal Information
Who is your data controller?
Legal basis of processing
What Personal Information we collect
How we share your Personal Information
How we protect your information
Online store
Online account and registration
Exercising your rights of access, portability and erasure
Changes to this Privacy Notice
Data privacy contact

Terms used in this notice

Term	Meaning
the Site	This website, `rejuvvluxuryspa.com`.
Rejuvv Luxury Spa, we, us, our	Rejuvv Luxury Spa — the data controller named in section 7, used here exactly as the original notice used it. This definition deliberately does not equate “we/us/our” with the five legal entities listed in section 1. PENDING COUNSEL — whether “we”, “us” and “our” in this notice bind the single d/b/a alone or all five legal entities named in section 1. The original notice named only the single d/b/a as data controller (§7) and never equated the pronouns with the five entities; answering it here would silently bind every obligation and limitation in this notice to five distinct LLCs/PLLCs at once. This is the counsel question already reserved in privacy-policy-CHANGES.md §E and must be answered by counsel, not editorially.
you, your	A visitor to the Site.
Personal Information	As defined in section 3.
Privacy Notice	This document.
Services	The services provided to you, used here exactly as the original notice used the term. This definition adds nothing: it does not enumerate the services, does not extend them to anything not already offered, and does not settle which entity provides them — that is the same open question flagged against “we/us/our” above.
privacy contact address	The email address given in section 16.

Except where applicable data protection laws require or permit it, we will not collect, use or disclose your Personal Information for any purpose you refuse consent to, or later withdraw consent to.

You may withdraw your consent at any time, with future effect. Withdrawing consent does not make our earlier processing unlawful — processing we carried out while your consent was in force stays lawful.

Your consent is given to the following legal entities, each doing business as Rejuvv Luxury Spa:

myMedSpa LLC
JKM Sedalia Aesthetics LLC
OP Aesthetics LLC
myMedSpa Kansas PLLC
Warrensburg Aesthetics, LLC

If you withdraw consent, you agree that we may still use Personal Information you gave us before the withdrawal:

to the extent we are contractually obliged to do so;
to the extent necessary to enforce any contractual obligations you owe to Rejuvv Luxury Spa; and
for any other legitimate purpose permitted by applicable data protection laws, including fraud prevention.

Withdrawing consent has consequences. If you withdraw your consent to our use and disclosure of your information, we may no longer be able to communicate with you. That includes acting on a request that we provide you with the Services, considering any offer of goods or services from you, and considering your application for employment.

2. Mobile messaging terms and conditions

If you give us your mobile number and opt in, you consent to receive SMS/text messages from Rejuvv Luxury Spa about:

appointment confirmations;
appointment reminders;
service updates;
customer support; and
promotions or marketing, if you opt in to those.

Message frequency may vary. Message and data rates may apply.

You may opt out at any time by replying STOP. For help, reply HELP.

We do not share, sell or transfer your SMS consent or your mobile information with third parties or affiliates for marketing purposes.

Opt-in for marketing communications

If you opt in to marketing messages, you agree to receive occasional:

promotions;
discounts;
event notifications; and
new service announcements.

You can unsubscribe at any time by replying STOP.

3. What is Personal Information?

“Personal Information” is defined broadly. It means any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked — directly or indirectly — with a particular individual.

Personal Information can be simple and direct, like your name. It can also be less obvious, like a record of how a particular individual interacted with a website or an advertisement.

4. Your privacy rights at Rejuvv Luxury Spa

We believe privacy is a fundamental right, and that your rights should not depend on where you live. So whatever your residency, you have all of the following rights over the Personal Information we collect, use or share.

Right	What it means
Right to be informed	To be told about the collection and use of your Personal Information.
Right of access	To be given a copy of the Personal Information we hold about you, including: the categories of Personal Information we collected about you, if any; the categories of sources it came from; our business or commercial purpose for collecting it; the categories of third parties we share it with; the specific pieces of Personal Information we collected; and a list of the categories of Personal Information disclosed for business purposes.
Right to rectification	To require us to correct your Personal Information if it is inaccurate or incomplete.
Right to be forgotten / right to deletion	To require us to delete your Personal Information where there is no compelling reason to continue processing it.
Right to restriction of processing	To require us to stop processing your Personal Information while still allowing us to hold it.
Right to data portability	To receive the Personal Information you gave us in a structured, commonly used, machine-readable format — or, in certain situations, to have it transmitted to a third party.
Right to object	To object to our continued processing of your Personal Information.
Right to no discrimination	Not to be discriminated against for exercising any of your rights.
Right to appeal	To appeal a decision we have made about your Personal Information.
Right to opt out of automated decision-making and profiling	Not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or significantly affects you.
Right to opt out of targeted advertising and sale of data	Not to have your Personal Information used for targeted advertising, and not to have your Personal Information sold.
Right to lodge a complaint with your supervisory authority	To complain about a breach of your rights to a competent data protection authority.

How to exercise your rights

Email us at PENDING COUNSEL — privacy contact mailbox — the client must state which mailbox receives privacy requests; see section 16 for the full conflict and resolve all three occurrences to the same address.

If you live in California, you or your authorised agent can also reach us by telephone on (913) 218-7095 (tel:+19132187095).

PENDING COUNSEL — for counsel, not the client: whether a toll-free intake line must be provided for California consumer requests. The original notice offered California residents a “toll-free number” at [superseded value withheld — see the counsel ledger]; that statement was false — the number is a geographic Kansas line — and it was removed (see privacy-policy-CHANGES.md A1). (913) 218-7095 is likewise a geographic line, so the notice as drafted offers no toll-free route. Removing a false claim is not the same as establishing that no toll-free line is required, and nothing here asserts either answer. Counsel must determine whether the requirement applies to Rejuvv and, if it does, a toll-free number must be provisioned and substituted here. Do not supply a number from any other source.

Contacting a data protection authority

You also have the right to take your request or complaint to the competent data protection authority. If you live in:

Canada — contact the Office of the Privacy Commissioner: Contact the OPC – Office of the Privacy Commissioner of Canada
the United States
- California — contact the California Department of Justice’s Privacy Unit at the State of California – Department of Justice – Office of the Attorney General
- Virginia — contact the Attorney General of Virginia
the European Economic Area (EEA) — a list of local data protection authorities and their contact details is available on this website
the United Kingdom — contact the UK Information Commissioner’s Office: Contact us | ICO

If you are not sure which authority applies to you, or how to contact it, let us know and we will try to help.

5. Why we collect Personal Information

We collect only the Personal Information we need, and we use it only in the ways set out in this Privacy Notice. What we collect depends on how you have interacted with us.

We collect Personal Information:

to respond to you — after you contact us with an enquiry, a comment or a concern, or apply for a job with us;
to provide you with Services — to review, process, maintain and respond to your enquiries, and to provide Services we think you will like based on a request you have made;
to advertise our Services; and
for analytics — to understand how visitors, including you, use the Site, and to improve it.

6. How we collect Personal Information

What we collect varies with the nature of, and reason for, your interaction with us. We collect Personal Information:

when you access the Site, seek information about our Services, ask us to provide services, or enquire about or pursue employment opportunities posted on the Site;
when you make requests, enquiries and complaints — we may use your Personal Information to address them;
when you connect with us through social media; and
when we use or collect cookies, device IDs, location data from the environment, and other tracking technologies.

7. Who is your data controller?

Rejuvv Luxury Spa is the data controller for the processing activities described in this Privacy Notice.

8. Legal basis of processing

We process your Personal Information because the processing is necessary for:

exercising our rights and performing our obligations under any contract we make with you;
complying with our legal obligations; and
the legitimate interests we pursue, which generally means running and managing our business relationship with you efficiently.

9. What Personal Information we collect

(a) Categories of Personal Information collected

In the last twelve months, visitors to the Site have provided us with the following categories of Personal Information:

Identifiers and contact information — your name, address, phone number, email address and similar information.
Device and internet activity information — information about your computer and your browsing activity. This may include IP addresses, unique device identifiers, cookie identifiers, device and browser settings, and internet service provider information. It may also include information about when and how you access and use the Site: the date and time of your visit, how you navigate, what you search for, and the pages and items you view.
Professional or employment-related information — for employment candidates, current or past job history, or performance evaluations.

If you have any questions about the information we collect, please get in touch.

(b) Marketing communications

If you submit a request to be contacted on the Site, or an application for employment, you consent to receive electronic promotional materials or information (“Commercial Electronic Messages”, or CEMs). You may withdraw your consent to receiving CEMs at any time.

(c) Cookies and similar technologies

This section describes what this Site actually loads.

PENDING COUNSEL — whether this Site presents a general-purpose cookie consent banner. The only support in the planning package is plan.md §9, which records “no consent banner needed in most US contexts” as a rationale attached to the cookieless Vercel Web Analytics row — not as a decision about this Site. Whether a banner is needed follows from the Google Analytics 4 / Google Tag Manager and CallRail rows below, both of which are themselves unresolved. The client and counsel must decide, and this paragraph must then state the decision.

The Site is a static website, and it does not itself operate an advertising platform. The technologies listed below are the ones this Site is planned to load that may set cookies, local storage or similar identifiers. Rows marked “if deployed” depend on decisions that have not yet been made; where such a row is deployed, the identifiers it sets may include first-party cookies.

Technology	Where it runs	What it is for	Sets cookies or similar identifiers?
Vercel Web Analytics	Every page	Aggregate visitor and page-view measurement	No — it is cookieless
Vercel Speed Insights	Every page	Real-user page-performance measurement	PENDING COUNSEL — whether Vercel Speed Insights sets cookies or similar identifiers. No source in the planning package states this. plan.md line 556 describes Vercel Web Analytics — a different product — as “cookieless”; line 557 describes Speed Insights only as “Real-user, not lab.” This cell must be confirmed against Vercel’s own documentation before publication and must not be inferred from the Web Analytics row.
Google Maps embed	Location pages	Showing the map for each clinic	Yes — Google may set cookies or storage when the map loads
Cherry financing widget	The financing page	Letting you apply for treatment financing through Cherry	May — the widget is loaded from Cherry, and anything it sets is set by Cherry under Cherry’s own privacy terms. PENDING COUNSEL — confirm with Cherry whether the widget sets cookies or similar identifiers. No source establishes that it does; contact-manifest.md row O2 records only the script URL.
Google Analytics 4 and Google Tag Manager	PENDING COUNSEL — whether GA4 / GTM ship at launch — plan.md §9 lists them as intended but the decision is the client’s; if they do not ship, delete this row	Marketing measurement	Yes, if deployed
CallRail dynamic number insertion	PENDING COUNSEL — whether CallRail DNI ships at launch — plan.md §9 notes the client may already use CallRail; if it does not ship, delete this row	Attributing phone calls to the campaign or channel that produced them	Yes, if deployed

Booking happens on another company’s website. When you click a booking link, you leave this Site for our booking provider, MyAestheticRecord. Anything that happens there — including cookies — is governed by that provider’s own privacy notice, not this one.

You can block or delete cookies through your browser settings. Doing so may stop parts of the Site from working as intended.

(d) Site usage information

Like most websites, this Site gathers traffic patterns, site usage information and other aggregated data so we can evaluate our visitors’ preferences and the effectiveness of the Site. This aggregate usage data does not identify you individually.

We may share anonymous, aggregated statistics about visitors to the Site with others outside our company, and we may allow third parties to collect aggregate data through the Site.

(e) Do Not Track requests

We currently do not respond to Do Not Track (DNT) signals.

We do not sell Personal Information, and we have not done so in the past 12 months.

We will not share your Personal Information, except:

(a) with sub-processors. We share it with third parties performing clearly defined sub-processing functions on our behalf — for example analysing data, providing marketing assistance, providing recruitment assistance, providing search results and links, and verifying data you have provided. Any processing by these sub-processors is protected by an agreement covering privacy and data security.
(b) where the law requires it. We share it where we are required by law to disclose Personal Information, and in connection with any legal proceedings or prospective legal proceedings.
(c) to protect our legal rights. We share it in order to establish, exercise or defend our legal rights.
(d) with a purchaser of the business. We share it with the purchaser, or prospective purchaser, of any business or asset we are selling or contemplating selling. We will require any person or entity we give your Personal Information to, to agree to comply with our then-current Privacy Notice, and we will make reasonable commercial efforts to ensure they do.
(e) on a change of ownership. We share it in the event of a transfer of ownership or assets, or a bankruptcy, of Rejuvv Luxury Spa or any of its affiliates.

11. How we protect your information

We use appropriate physical, technical and organisational security measures to protect your Personal Information against accidental or unlawful destruction, loss, use or alteration, and against unauthorised disclosure or access.

12. Online store

PENDING COUNSEL — does the Site sell anything online? The rebuilt Site has no e-commerce and no Stripe integration (CLAUDE.md scope: “No app surface, no e-commerce, no patient portal”). If nothing is sold on the Site, this entire section must be deleted before publication rather than published as an inaccurate disclosure. Only the client can confirm.

The disclosure below is carried forward from the current published notice, unchanged in substance, pending that decision:

No e-commerce site can function without collecting data from its customers. That is how we provide you with the products and services you purchase.

When you place an order through the Site, we keep your order information on record unless and until you ask us to delete it.

By purchasing a product or service on the Site, you agree to that transaction, and your payment method will be charged accordingly. We use a third-party credit card processor, Stripe, to complete transactions. We do not store any credit card data on our servers.

13. Online account and registration

PENDING COUNSEL — does the Site offer user accounts? The rebuilt Site has no registration, login or patient portal. If accounts are not offered, this entire section must be deleted before publication rather than published as an inaccurate disclosure. Only the client can confirm.

The disclosure below is carried forward from the current published notice, unchanged in substance, pending that decision:

(a) Registration

To complete registration on the Site, you must give Rejuvv Luxury Spa a valid email address, for verification and security. You can change that email address on a limited basis, or as necessary.

(b) Account information

When you create an account on the Site, administrators at Rejuvv Luxury Spa can see the following. This information will never be shared or sold to a third party, and will never be publicly posted without your explicit permission.

Username (“Login Credentials”)
Encrypted password or PIN
Profile information — first and last name, phone number, address, email address, and any other personally identifiable information
Any content you post on the Site
Any service-related communication between you and the Site administrators

14. Exercising your rights of access, portability and erasure

If you make a request to exercise any of these rights, we will honour it within 30 days. If we need more time, we will tell you as soon as we can.

To make a request, email us at PENDING COUNSEL — privacy contact mailbox — same decision as section 4; see section 16.

Verifying your identity

Before we disclose anything, we must be able to identify you. You must give us enough proof of your identity to keep your Personal Information safe and secure. We will not provide, edit or delete your Personal Information if we cannot verify your identity, or your authority to make the request.

You must also describe your request in enough detail for us to understand, evaluate and respond to it. If we deny or partly deny your request, you have the right to be told why it was not fully granted.

(a) Your right of access

Disclosure is free of charge. If your access request is manifestly unfounded or excessive — in particular because it is repetitive — we may charge to cover our administrative expenses.

We reserve the right to decline your request where the information requested:

would disclose Personal Information of another individual, or of a deceased individual;
is subject to legal privilege;
is personal health information that was not given to us directly by the individual requesting access;
is not readily retrievable, and the burden or cost of providing it would be disproportionate to the nature or value of the information;
does not exist, is not held, or cannot be found by us, or could reasonably result in serious emotional harm to the individual or another individual, or serious bodily harm to another individual; or
may harm or interfere with law enforcement activities, or other investigative or regulatory functions of a body authorised by statute to perform them.

We also will not disclose Personal Information where a law of your country, state, province or other subnational entity would bar the disclosure. We will refuse repetitious or vexatious access requests.

(b) Your right to data portability

If we give you access to your Personal Information, we will provide it in a structured, commonly used, machine-readable format. If you made your request electronically, we will provide access electronically unless you ask otherwise; your request may also be delivered by mail. So far as it is technically feasible, the format will be readily usable and will let you transmit the information to another entity without hindrance.

(c) Data retention and the right to be forgotten

We do not hold your data forever. By default we retain your Personal Information:

until it is no longer necessary for the purposes for which it was collected or otherwise processed;
for as long as we need it to comply with legal obligations, such as retention obligations under employment, tax or commercial law; or
until you ask us to delete it.

If you make a deletion request, we will delete your Personal Information from our records, and direct our service providers to delete it — unless we or our service providers must retain it to:

complete the enquiry your Personal Information was collected for, provide a service you requested, take actions reasonably anticipated within our ongoing business relationship with you, or otherwise perform our contract with you;
detect security incidents, protect against malicious, deceptive, fraudulent or illegal activity, or prosecute those responsible for it;
enable solely internal uses reasonably aligned with consumer expectations based on your relationship with us;
comply with any legal obligation; or
make other internal and lawful uses of that information that are compatible with the context in which you provided it.

15. Changes to this Privacy Notice

To maintain or improve the services we provide, we may need to change this Privacy Notice from time to time. We reserve the right to modify it at any time, subject to applicable data protection laws. Please check the Site from time to time for the latest version.

16. Data privacy contact

Contact us if you have questions about this Privacy Notice or about the privacy practices of Rejuvv Luxury Spa or its sub-processors, if you need help withdrawing your consent to our processing of your Personal Information, or if you want to ask us to delete your Personal Information.

By email: PENDING COUNSEL — privacy contact mailbox — the current page publishes info@rejuvvkuxuryspa.com here, which is a misspelling of info@rejuvvluxuryspa.com; the same page uses the correctly spelled info@ address in two other places; ANSWERS-LOG establishes hello@rejuvvluxuryspa.com as the confirmed monitored inbox. The client must state which mailbox receives privacy requests, and the same address must then be used in sections 4, 14 and 16.

By post:

Rejuvv Luxury Spa Attention: Data Protection Officer [superseded value withheld — see the counsel ledger] Overland Park, KS 66223 USA

By telephone: (913) 218-7095 (tel:+19132187095)

Note on the postal address — this is a SITEWIDE NAP decision, not a section 16 decision. PENDING COUNSEL — the postal spelling of the Overland Park street address. sites/ANSWERS-LOG.md conflicts with itself. Its “Addresses & identity (MAR-API)” table gives [superseded value withheld — see the counsel ledger], Overland Park, KS 66223, and that is the value used in the block above. Its “Minor GBP-vs-site formatting deltas” table records the Google Business Profile as 15106 Glenwood — no “Ave” — and directs: “NAP should match the GBP exactly. Standardise on the GBP spelling — it is the record Google is matching against.” Those two instructions cannot both be followed. The block above is therefore provisional. The same value drives src/content/locations/*.yaml, the LocalBusiness JSON-LD, the footer and every rendered NAP string on the new site, so the decision must be made once and applied everywhere; it cannot be settled for this page alone.