Privacy Policy

This Privacy Policy describes how Vera Pelle Esthetics, Inc., doing business as Vera Pelle European Skin Spa (“Vera Pelle,” “we,” “our”), collects, uses, protects, and shares information about you. We are a Texas-licensed esthetics business; we are not a medical provider, and the health-related information we collect is handled under the TDPSA, not HIPAA.

01Information we collect

• Booking & purchase information — your name, phone number, email address (collected by Square at booking and, if you opt in, for our newsletter), billing and shipping address, and a payment-card token held by Square. We never see or store your full card number.
• Skin consultation information — the health and skin information you provide on our consultation form: skin history, medical contraindications, medications, allergies, current routine, treatment goals, hormonal status, relevant skin conditions, and your signed consent and signature. This is sensitive information and we treat it as such (see §3 and §6).
• Electronic-signature record — when you sign and submit our consultation form, we record the date and time of signing, your IP address, and your browser/device type. We keep this with your signed consultation form as evidence of your electronic signature, consistent with the federal E-SIGN Act and the Texas Uniform Electronic Transactions Act (see our Terms, §16). It is stored only on the encrypted consultation record and the copy sent to your esthetician inside our Microsoft 365 tenant; it is not written to our website logs and is never shared with our analytics, advertising, or marketing tools.
• Communications — messages you send us through the contact form, by phone or voicemail, by Instagram direct message, or by text message through our Square booking page.
• Site analytics & advertising data (only with your consent) — if, and only if, you opt in through our cookie banner, limited analytics and advertising events such as page views, booking-link clicks, and gift-card purchases. These carry event names and generic parameters only — never your consultation answers or form-field values — and are never collected on the consultation page.

02How we use your information

• To deliver the services you request — bookings, treatments, products, and gift cards.
• To prepare for your appointment — your esthetician reviews your consultation form before your session.
• To authenticate and keep a legal record of your electronic signature on the consultation form, and to help prevent fraud or misuse.
• To send appointment confirmations, reminders, and post-treatment care messages through Square.
• To operate our loyalty program (Il Cerchio) and referral program if you participate (see §7).
• To improve the Site and measure advertising, but only using analytics and advertising you have consented to.
• To meet legal obligations such as tax records and consumer-protection requirements.

03How your skin-consultation information is handled

Your consultation information is the most sensitive data we hold, and it is handled differently from everything else. When you submit the consultation form:

• It is rendered into a single document (a PDF) and stored in Microsoft OneDrive, inside our Microsoft 365 tenant, protected with a Microsoft sensitivity label that encrypts the file (AES-256). This encrypted record is the authoritative copy.
• A copy of your intake is sent to your esthetician’s Microsoft 365 mailbox using Microsoft’s own mail service (Microsoft Graph), so it stays entirely within Microsoft and is protected by our message-protection controls. It is not sent through any outside email service.
• It is not stored in our Square booking or customer system, and it is not shared with our analytics, advertising, or marketing tools.

By design, our website keeps no separate database of your health information and has no client login. While you fill out the form, the most sensitive fields — your consents, signature, medications, allergy and contraindication details — are not saved in your browser. Our servers record only a random submission identifier and a status code, never your health answers. Technical details that evidence your electronic signature — the time, your IP address, and your device type — are kept with your signed consultation record, not in our logs. We process this sensitive information only with your separate, affirmative consent, given when you submit the form, and only to prepare for and perform your treatment.

04Who processes your information (subprocessors)

We work with a small set of service providers. Each is bound by its own privacy and security terms.

We do not sell your personal information for money, and we do not share your consultation health information with advertising or analytics providers.

05Cookies, tracking & Meta advertising

Our website sets no cookies of its own except a single first-party cookie that records your cookie preference. We do not load analytics or advertising cookies unless you choose “Accept” (in whole or by category) in our cookie banner. If you opt in:

• Analytics enables Google Analytics 4 (which sets _ga / _gid).
• Marketing enables the Meta (Facebook) Pixel (which sets _fbp) so we can measure and target our advertising.

Our use of the Meta Pixel for advertising is treated under Texas law as “targeted advertising” and as a “sale” of personal data (which Texas defines broadly to include sharing data for valuable consideration, even without money changing hands). You have the right to opt out of targeted advertising and this kind of sharing. You can do so by declining or withdrawing marketing consent in our cookie banner at any time using the “Cookie settings” link in our footer, and we honor Global Privacy Control (GPC) browser signals — if your browser sends a GPC signal, we treat it as an opt-out and the advertising pixel does not fire. We never include your consultation or health information in advertising data, and we do not sell sensitive personal data.

Until you opt in, no analytics or advertising cookies are set. To measure our advertising without tracking you, Google may receive anonymized, cookieless signals (Google Consent Mode) — these set no cookie and do not identify you, and are used only for aggregate measurement and modeling. These cookieless signals are not sent if you send a Global Privacy Control signal, and are never sent from our consultation page. The Meta (Facebook) Pixel does not run at all until you opt in. Square’s payment and booking pages may set their own cookies during checkout under Square’s privacy practices.

06Your Texas privacy rights

Under the Texas Data Privacy and Security Act (TDPSA), Texas residents have the right to:

• Access — confirm whether we process your personal data and obtain a copy.
• Correct — fix inaccuracies in your personal data.
• Delete — request deletion of personal data we hold about you.
• Data portability — obtain a portable copy of data you provided.
• Opt out — of targeted advertising and of the “sale” of personal data (see §5).
• Appeal — if we decline a request, you may appeal, and we will respond as the TDPSA requires.

Because your consultation information is sensitive data, we process it only with your consent and only to prepare for and perform your treatment. To exercise any of these rights, contact us through the contact form at verapelleskin.com, by phone at (832) 699-2049, or by mail to Vera Pelle Esthetics, Inc., 2200 Edwards St, Ste 305, Houston, TX 77007. We will respond within 45 days (extendable once by an additional 45 days where reasonably necessary, with notice to you). We may need to verify your identity before acting on a request. To opt out of marketing email, use the unsubscribe link in any marketing message; to opt out of consented analytics or advertising, use the “Cookie settings” link in the footer or send a Global Privacy Control signal.

07Loyalty, referrals & information about others

Il Cerchio, our loyalty program, is automatic. Your first booked visit enrolls you, and Punti accrue at checkout — nothing to sign up for. Clients who were already with us were enrolled when the program launched. We record program activity such as points earned and referral links through Square. There is no fee and nothing to buy: the rewards are a benefit of being a client, not a sale of your personal data. If you would rather not take part, call us at (832) 699-2049 or send a message on Instagram and we will remove you. If you give us information about another person — for example, a gift-card recipient’s name and contact details — you confirm you have their permission for us to use it to fulfill your request.

08How long we keep your information

We keep personal information only as long as needed for the purposes described here, then delete or de-identify it. Booking, payment, and tax records are retained as required by law. Each appointment generates its own signed consultation and consent record; we retain each consultation record, encrypted, for seven (7) years from the date of that appointment — for treatment continuity and to defend potential claims — after which it is deleted. Because a new signed record is created at each visit, your most recent visit’s record is always retained for a full seven years.

09Security & breach notification

The Site is served over HTTPS and enforces HTTPS (HSTS). Payment data is tokenized and held by Square (PCI-DSS Level 1). Your consultation record is encrypted at rest in Microsoft OneDrive under a Microsoft sensitivity label, and its delivery to your esthetician stays within Microsoft 365 with message-level protection. Our consultation page runs under a strict content-security policy, and our servers do not log your health answers. No method of transmission or storage is perfectly secure, but we apply controls appropriate to the sensitivity of the information we hold.

If a breach of your sensitive personal information occurs, we will notify affected individuals without unreasonable delay, consistent with Texas law (Tex. Bus. & Com. Code §521.053), and will notify the Texas Attorney General where the law requires.

10Children

Vera Pelle services and Site are directed to adults 18 and older, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

11Changes to this policy

We may update this Privacy Policy from time to time. The current version is always posted at verapelleskin.com/privacy with its effective date. Material changes will be reflected by an updated effective date.

12Contact

Questions about this policy or your information? Reach us through the contact form on verapelleskin.com, by phone at (832) 699-2049, or by mail at Vera Pelle Esthetics, Inc., 2200 Edwards St, Ste 305, Houston, TX 77007.