How SkinLuxes collects, stores, and protects clinical inquiry and tracking data.

This privacy policy took effect on October 17, 2026. It applies to all clinical booking inquiries, website visitor sessions, and advertising traffic delivered to skinluxes.click on or after that date.

The data controller for all personal information collected on this website is Skinluxes, trading at skinluxes.click. Our registered clinical facility is located at 130 North Tryon Street, Charlotte, North Carolina 28202, Charlotte, North Carolina, United States.

Clinical practice operations and client record administration are overseen directly by practitioner Casey Finch, LE/LI. You may contact our administrative desk by telephone at +1 (307) 555-3072 or via email at office@skinluxes.click.

We only record data necessary to manage clinical aesthetic inquiries and ensure legitimate technical website operation:

• Inquiry Form Submissions (coha4a2.php): Full legal name, telephone number (if provided), email address (if provided), mailing address or ZIP code (if provided), treatment kind, requested clinical specifications, client health notes or medication history, affirmative consent confirmation, and the specific referral source page.
• Technical and Server Transmission Data: The IP address from which the connection originated, browser user-agent string, referring URL, timestamp when the form was rendered on screen, and timestamp when submission occurred.
• Live Support Chat Records (pipe715.php): Clinical chat conversation messages and a locally stored browser authentication token that allows you to return to the active conversation thread.
• Consent Registry: The state of your cookie preference stored strictly in your browser under the local storage key site_consent_v2.
• Advertising Identifiers: Marketing click parameters appended to incoming URLs by paid advertising platforms, specifically gclid (Google Ads), msclkid (Microsoft Advertising), and fbclid (Meta Ads).

We do not create user accounts, require passwords, or store credit card payment details on this site. Our catalogue is strictly inquiry-based; no financial transactions are processed online.

We use the information collected for specific, limited clinical and administrative objectives:

• To evaluate treatment candidacy, verify contraindications (such as recent isotretinoin use, facial injectables, or photosensitizing drugs), and prepare room equipment prior to your arrival.
• To reply to your questions regarding fee bands ($90–$1,880 USD), procedural pass counts, downtime expectations, and available appointment times.
• To maintain server integrity, block automated bot spam, and protect our clinical communication endpoints from unauthorized access.
• To measure the effectiveness of paid advertising campaigns on Google Ads, Microsoft Advertising, and Meta Ads so we do not waste marketing resources.

Under applicable US privacy frameworks and the GDPR for international visitors, we process your information under three clear legal bases:

• Consent: When you check the affirmative consent box on our intake forms, initiate a support chat session, or click "Accept All" on our cookie consent banner. You may withdraw this consent at any time.
• Contractual Necessity: Processing your intake request is necessary to take preparatory steps prior to entering into a professional service agreement for clinical aesthetic treatments in our Charlotte facility.
• Legitimate Interests: Maintaining server security, diagnosing technical errors, preventing fraudulent inquiries, and assessing overall advertising attribution without overriding your fundamental privacy rights.

This website is an active destination for paid marketing traffic. We run paid campaigns across three specific networks:

• Google Ads: google ads attaches the unique click identifier gclid to inbound links to measure ad conversions.
• Microsoft Advertising: microsoft advertising appends the click identifier msclkid to evaluate search campaign performance.
• Meta Ads: Where campaigns run on Meta platforms (Facebook / Instagram), inbound links carry the identifier fbclid.

We do not sell personal data to these platforms. They receive diagnostic ad interaction data solely to report campaign performance and attribute clinical inquiries to the corresponding advertisement.

We operate consent mode under Google Consent Mode v2 standards. By default, before you take any action on our cookie consent banner, all four advertising and analytics consent signals are held in a denied state:

• ad_storage='denied'
• ad_user_data='denied'
• ad_personalization='denied'
• analytics_storage='denied'

If you choose to click "Accept All", these signals update to granted for your browsing session. If you click "Decline Non-Essential" or close the banner, these four parameters remain or are explicitly set back to denied. No marketing cookies or personalization identifiers will be stored on your device without your affirmative consent.

We share data only with trusted infrastructure providers bound by confidentiality and data processing agreements:

• Google LLC / Google Ireland Ltd: Operates Google Ads and Google Analytics under Consent Mode v2 protocols.
• Microsoft Ireland Operations Ltd: Operates Microsoft Advertising. You can review how Microsoft protects information directly via the Microsoft privacy statement at privacy.microsoft.com.
• Meta Platforms Ireland Ltd / Meta Platforms Inc: Handles attribution where Meta Ads campaigns are active.
• Web Hosting & Database Infrastructure: Secure web servers located in enterprise US facilities that house our application code and clinical inquiry records.
• Secure Email Routing: Encrypted mail transfer agents that deliver incoming intake notifications directly to office@skinluxes.click.

SkinLuxes operates in Charlotte, North Carolina, United States. Data submitted through this website is stored and processed on secure servers located within the United States.

For visitors accessing this site from the European Economic Area (EEA), the United Kingdom, or Switzerland, your data is transferred to the United States based on Standard Contractual Clauses (SCCs) approved by the European Commission, or where applicable, the EU-U.S. Data Privacy Framework.

We do not store information indefinitely. We observe strict, defined retention periods:

• Clinical Inquiries & Email Notifications: Retained for 24 months from submission to facilitate continuity of skin history and follow-up consultation planning.
• Chat Transcripts & Tokens: Retained for 18 months, after which session threads are permanently purged.
• Server Access & Technical Logs: Retained for 90 days for network diagnostic and threat detection purposes, then overwritten.
• Browser Consent Choices: Your site_consent_v2 choice persists in your local browser for 12 months before re-prompting.

We employ layered security controls appropriate for clinical aesthetic inquiries:

• Full Transport Layer Security (TLS 1.3) encryption across all public web endpoints and administrative mail transports.
• Server-side input sanitization, honeypot spam traps (department, site), and rate-limiting to prevent brute-force exploitation.
• Restricted administrative database access requiring multi-factor authentication, accessible only to licensed practitioner Casey Finch.
• Physical isolation of client consultation notes and strict disposal policies for non-active patient documentation.

If you reside in the European Economic Area or United Kingdom, the General Data Protection Regulation (gdpr) grants you specific statutory rights regarding your personal data:

• Right of Access: You can request a complete copy of all personal information we hold about you.
• Right to Rectification: You can require us to correct inaccurate or incomplete medical intake notes or contact records.
• Right to Erasure ("Right to be Forgotten"): You may request that we delete your clinical inquiry records where retention is no longer necessary.
• Right to Restriction of Processing: You can ask us to pause processing of your data while a dispute or accuracy check is resolved.
• Right to Data Portability: You have the right to receive your data in a structured, machine-readable format.
• Right to Object: You can object to any processing based on legitimate business interests or direct marketing.
• Right to Withdraw Consent: Where processing relies on affirmative consent, you may withdraw it at any time without penalty.

Residents of California under the California Consumer Privacy Act (ccpa) and California Privacy Rights Act (CPRA), alongside residents of Colorado, Virginia, Connecticut, and other states with enacted comprehensive privacy legislation, hold specific consumer rights:

• The right to know the categories and specific pieces of personal information collected about you.
• The right to know the categories of third parties with whom personal information is shared.
• The right to request deletion of personal information collected from you.
• The right to correct inaccurate personal data.
• The right to opt-out of the "sale" or "sharing" of personal data for cross-context behavioral advertising. SkinLuxes does not sell your personal data for monetary consideration.
• The right to non-discrimination for exercising any of your statutory privacy rights.

Yes. If your browser transmits the Global Privacy Control (Sec-GPC) header, our website automatically interprets this signal as an immediate, affirmative request to opt out of non-essential tracking, targeting cookies, and data sharing for advertising purposes. We honour global privacy control without requiring you to open the cookie consent modal.

No. Our website and clinical aesthetic treatments (chemical resurfacing, laser therapy, and advanced extractions) are directed exclusively to adults aged 18 and older. We do not knowingly collect, store, or solicit personal information from individuals under the age of 18.

If an adolescent seeks treatment for severe comedonal acne, intake documentation must be submitted directly by a parent or legal guardian who attends all clinical consultations at our Charlotte facility.

If you believe our processing of your personal data infringes applicable privacy regulations, you have the right to lodge a formal complaint with the competent supervisory authority:

• In North Carolina: The Consumer Protection Division of the North Carolina Attorney General's Office.
• In California: The California Privacy Protection Agency (CPPA) or the Office of the California Attorney General.
• In other US States: The office of your respective state Attorney General.
• In the European Union: The national Data Protection Authority (DPA) in your member state of residence.

To request access, review, correction, or deletion of your personal records, submit a formal written request directly to our clinical administration desk:

When modifications are made to our privacy practices, tracking technologies, or legal bases, we will publish the revised policy directly on this page and update the "Effective Date" at the top of this document.

For material changes that impact how we handle previously submitted clinical intake records, we will post a conspicuous notification on our homepage or notify active clients directly via their verified email address prior to the implementation date.

You can reach our designated privacy officer and licensed practitioner Casey Finch directly through the following official communication channels: