Consumer Health Data Privacy Policy

This is a separate privacy policy, in addition to our general Privacy Policy, that describes specifically how Plastic Surgery Local ("we," "us") handles "consumer health data" as that term is defined by Washington's My Health My Data Act, Nevada's Consumer Health Data Law (SB 370), and similar state laws. It applies to visitors from those states and, as a matter of practice, to everyone who uses the Service.

What counts as "consumer health data" here

These laws define consumer health data broadly — not just diagnoses, but information that identifies a consumer's attempt to seek health care services, including reproductive and gender-affirming care. Searching this site for a procedure, or asking a practice about one, generally qualifies, even though it is not a medical record and no clinical relationship exists.

On Plastic Surgery Local, that means:

• The procedure or category you search or filter by (for example, searching "rhinoplasty near me").
• The service of interest you name in an appointment or consultation request.
• Anything about a health condition, procedure, or treatment you include in a waitlist comment, a review, or a message to an automated assistant on a provider's profile.
• The photo you upload and the procedure you preview with the "See Your Result" AI simulator, together with the email and ZIP you provide there.

Your name, email, and phone number are not health data by themselves, but become "consumer health data" under these laws when they are linked to one of the categories above — for example, your email combined with the fact that you asked about a specific procedure.

What we collect and why — the required disclosure

We do not infer, derive, or purchase consumer health data about you from any other source, and we do not use any of the above to build an advertising profile.

AI photo simulations — "See Your Result"

The simulator lets you upload a selfie and see an AI-generated illustration of a cosmetic procedure. Because a photo tied to interest in a procedure is sensitive, it gets its own rules:

• Your uploaded photo is never stored. It is held in memory only long enough to create the simulation, and then discarded. It is not written to disk, not kept in a database, and not used to train anything.
• Processing uses a third-party AI service (Google). Your photo is transmitted to Google's generative AI API once, solely to create your simulation, under terms that restrict use to providing the service.
• The simulated image is kept for up to 30 days so your private result link works, then automatically deleted. You can request earlier deletion at any time (see Your rights above).
• Consent comes first. The simulator requires you to read and accept a specific photo-processing consent — including confirming you are 18 or older and that the photo is of you (or you have that person's permission) — before anything is uploaded. We log that acknowledgment (with its version and date) as required.
• Simulations are illustrations, not medical information. They are not diagnoses, treatment plans, or promised outcomes, and they carry that label wherever they are shown.
• If you ask a practice about your preview, your name, contact details, procedure interest — and, for participating practices, your simulation link — go to that practice so they can respond. That sharing happens only when you submit that request, and it's why you're submitting it.

Consent — before we collect it, not after

Where the law requires your prior consent before we collect or share consumer health data, we ask for it before you submit — for example, the checkbox on our appointment and consultation forms, or the acknowledgment on our waitlist form. We do not collect consumer health data through a form that lacks that acknowledgment. We collect the minimum necessary to provide the specific feature you're using — connecting you with a practice, publishing your review, showing you relevant updates — and no more.

How we share it — and how we do not

• With the practice you choose: your request — including the service you're interested in — goes to that practice so they can respond. That is the entire point of the request, and it's why you're submitting it.
• Service providers who help us operate the Service (hosting, email delivery, text messaging), under agreements limiting their use of your information to that purpose.
• We do not sell consumer health data. "Selling" under these laws is defined broadly — broader than an exchange of cash — and covers any exchange for value with a third party. We do not do this, so the separate written authorization these laws require before a sale is never needed, because there is no sale to authorize. If that ever changed, we would ask for that specific authorization before any sale, separately from any other consent.
• We do not share consumer health data with data brokers, ad networks, or analytics platforms, and — consistent with our general Privacy Policy — we do not use third-party advertising trackers on the Service at all.
• We do not use geofencing around any medical facility, clinic, or practice to identify, track, or target ads to people who visit or have visited it. This is a specific practice these laws prohibit, and we don't do it.

Your rights

Regardless of which state you're in, you can ask us to:

• Confirm whether we are processing consumer health data about you, and access it.
• Withdraw consent to our collection or processing of it at any time. We will stop within 30 days of your request and tell any service provider or affiliate we shared it with to do the same.
• Delete consumer health data we hold about you. We will delete it — and instruct any service provider or affiliate holding a copy to delete it — within 30 days, unless we're legally required to keep something (for example, a fraud or security record).
• Appeal if we deny a request. Email us at the address below with "Appeal" in the subject line, and tell us why you disagree with our decision; we will respond within 45 days with the outcome and, if we still deny it, how to escalate to your state Attorney General.

We will not charge you for exercising these rights, and we will not deny you service, charge you a different price, or provide a different level of service because you exercised them.

To exercise any of these rights, email support@plasticsurgerylocal.com with "Consumer Health Data Request" in the subject line. We may ask for enough information to verify it's really you asking, but we won't ask for more than we need.

How this relates to our general Privacy Policy

Everything in our general Privacy Policy — including retention periods, security practices, and your general privacy rights — applies to consumer health data too. Where this page and the general policy overlap, this page's terms control for consumer health data specifically, because the law requires that specificity.

Changes to this policy

If we make a material change to how we handle consumer health data, we will update the date at the top of this page and, where the change is significant, take reasonable steps to let you know before it takes effect.

Contact

Questions about this policy, or to exercise a right described above: support@plasticsurgerylocal.com, or Camden Ventures AZ, PO Box 18902, Fountain Hills, AZ 85269.