Privacy Policy and HIPAA Notice of Privacy Practices Summary
PRIVACY POLICY & HIPAA NOTICE
Effective Date: August 24, 2026
Last Updated: August 24, 2026
Introduction
Enigma Medi Spa & Laser Center and Enigma Medi Spa & Plastic Surgery DBA Enigma Plastic Surgery are two separate corporations that share the Enigma Medi Spa website and mobile application (collectively, the “Platform”).
After this initial identification, the entities are referred to as Enigma Medi Spa & Laser Center and Enigma Plastic Surgery.
Each entity independently operates its own medical and business services and is responsible for the patient records and information associated with the services it provides.
For purposes of this Privacy Policy, the entities may collectively be referred to as “Enigma,” “we,” “us,” or “our.” This collective reference is for convenience only and does not change their status as separate corporations.
Enigma is committed to protecting the privacy, confidentiality, and security of personal and health information.
This Privacy Policy explains how we collect, use, disclose, maintain, and safeguard information when you visit or use the Platform, submit an appointment inquiry, communicate with us, or receive services.
This Privacy Policy does not replace an applicable HIPAA Notice of Privacy Practices (“NPP”). Where the Health Insurance Portability and Accountability Act (“HIPAA”) applies, the applicable Notice of Privacy Practices and applicable law govern the use and disclosure of Protected Health Information (“PHI”).
AI Concierge — Nia
The Platform may provide access to Nia, the Enigma AI Concierge, which can assist with general information about Enigma, available services, locations, and appointment inquiries.
Information provided by Nia is for general informational and administrative purposes only. Nia is not a physician or licensed healthcare provider, and its responses do not constitute medical advice, diagnosis, treatment recommendations, prescriptions, legal advice, or other professional advice.
AI-generated responses may occasionally contain errors, omissions, or information that does not apply to your individual circumstances.
Do not rely on Nia to diagnose symptoms, determine whether you are a candidate for a treatment or procedure, make medical decisions, or address urgent medical concerns.
For personalized medical information or treatment recommendations, consult an appropriately licensed healthcare provider.
Do not use Nia or the Platform for a medical emergency. If you believe you are experiencing a medical emergency, call 911 or seek immediate emergency medical care.
INFORMATION WE COLLECT
Information You Provide
We may collect information you voluntarily provide through the Platform, including:
- Name
- Email address
- Telephone number
- Mailing address
- Date of birth, when appropriate
- Requested service, treatment, procedure, or consultation
- Preferred appointment date and time
- Preferred location or provider
- Information included in an appointment inquiry
- Communications submitted through the Platform
- Other information you voluntarily provide
Health Information
When appropriate in connection with patient care, we may collect information concerning:
- Medical history
- Medications
- Allergies
- Relevant medical conditions
- Previous treatments or procedures
- Treatment preferences
- Consultation information
- Treatment records and outcomes
- Clinical photographs
- Other information reasonably necessary for healthcare services
Information maintained in connection with healthcare services may constitute PHI and may be protected by HIPAA and other applicable laws.
Appointment Information
The Platform allows users to submit appointment inquiries and appointment requests.
Information may include the service requested, preferred date and time, location, contact information, and other information you voluntarily provide.
Submitting an appointment request does not constitute a confirmed appointment.
An appointment is confirmed only after confirmation is provided by the applicable Enigma entity.
Information Collected Automatically
When you use the Platform, certain technical information may be collected automatically, including:
- IP address
- Browser and device type
- Operating system
- App version
- General device information
- Pages or Platform features accessed
- Date and time of access
- Referring website or page
- Diagnostic and performance information
HOW WE USE INFORMATION
We may use information collected through the Platform to:
- Respond to inquiries;
- Process appointment requests;
- Determine appointment availability;
- Schedule, confirm, reschedule, or cancel appointments;
- Send appointment reminders;
- Provide requested information about Enigma services;
- Route requests to the appropriate Enigma entity;
- Provide medical, surgical, cosmetic, or aesthetic services when applicable;
- Maintain appropriate patient and business records;
- Coordinate healthcare where appropriate;
- Operate and maintain the Platform;
- Improve Platform functionality;
- Maintain security and prevent unauthorized activity;
- Comply with applicable legal and regulatory requirements; and
- Protect or exercise legal rights.
The Platform’s appointment-inquiry functionality does not process patient payments.
If a payment or deposit is required for a service, separate instructions may be provided outside the appointment-inquiry functionality.
TEXT MESSAGES, EMAILS & COMMUNICATIONS
When you provide a telephone number or email address, Enigma may use that information to respond to your inquiry and communicate with you regarding appointments, consultations, requested services, and other appropriate administrative matters.
Communications may include:
- Responses to appointment inquiries;
- Appointment confirmations;
- Appointment reminders;
- Rescheduling or cancellation notices;
- Information you specifically requested; and
- Appropriate service-related communications.
Where required by law, separate consent will be obtained before sending promotional or marketing text messages.
You may opt out of promotional text messages by replying STOP and may unsubscribe from promotional emails using the unsubscribe option provided in the message.
Message and data rates may apply.
Opting out of promotional communications does not necessarily prevent communications reasonably necessary for an existing appointment, requested service, patient care, or other non-promotional purpose, subject to applicable law and your communication preferences.
Enigma does not sell or rent your telephone number or email address to unrelated third parties for their independent marketing purposes.
INFORMATION SHARING
We may disclose information when reasonably necessary to provide requested services, operate the Platform, coordinate healthcare, or comply with applicable law.
Information may be disclosed:
- In connection with treatment and coordination of healthcare;
- To service providers that support Platform operations, scheduling, communications, information technology, security, or other necessary functions;
- To professional advisers where appropriate;
- When required or permitted by law;
- To protect health or safety where permitted by law;
- To prevent fraud or unlawful activity; or
- In connection with an appropriate business transaction, subject to applicable legal protections.
Where a third party creates, receives, maintains, or transmits PHI on behalf of a HIPAA-covered Enigma entity and HIPAA requires a Business Associate Agreement, appropriate contractual safeguards will be implemented.
PHOTOGRAPHS & MARKETING
Clinical photographs may be collected when reasonably necessary for consultation, treatment planning, documentation, progress evaluation, or other legitimate healthcare purposes.
Clinical photographs are not automatically authorized for advertising or promotional use simply because a patient accepts this Privacy Policy.
Where written authorization is required, identifiable patient photographs will not be used for social media, advertising, before-and-after galleries, promotional materials, or similar marketing purposes without appropriate authorization.
COOKIES & TECHNOLOGY
The Platform may use cookies and similar technologies to operate and secure the Platform, remember preferences, understand technical performance, and improve functionality.
Where required by applicable law, users will be provided appropriate notice or choices concerning non-essential tracking technologies.
Healthcare-related information and technologies capable of receiving such information will be handled subject to applicable privacy and healthcare requirements.
DATA SECURITY
Enigma maintains reasonable administrative, technical, and physical safeguards designed to protect personal information and PHI against unauthorized access, use, disclosure, alteration, loss, or destruction.
No electronic system, mobile application, website, or method of electronic transmission can be guaranteed to be completely secure.
DATA RETENTION
We retain information for as long as reasonably necessary for the purposes for which it was collected and as required by applicable healthcare, professional, legal, regulatory, insurance, and recordkeeping requirements.
Medical records may be subject to specific retention requirements.
YOUR PRIVACY RIGHTS
Depending upon applicable law and the type of information involved, you may have the right to:
- Request access to certain information;
- Request correction of inaccurate information;
- Update your contact information;
- Modify communication preferences;
- Opt out of certain promotional communications; and
- Exercise other privacy rights available under applicable law.
Medical records and PHI may be governed by separate healthcare privacy laws and the applicable Notice of Privacy Practices.
CHILDREN’S PRIVACY
Enigma’s services are generally intended for adults.
The Platform is not intended to enable minors to independently obtain medical, surgical, cosmetic, or aesthetic services where parental or legal guardian authorization is required.
Information involving minors will be handled in accordance with applicable law.
THIRD-PARTY LINKS
The Platform may contain links to websites or services operated by third parties.
Enigma does not control the privacy, security, or data practices of independently operated third-party services. Users should review the applicable privacy policies before providing information directly to those services.
CHANGES TO THIS POLICY
We may periodically update this Privacy Policy to reflect changes in our practices, technology, Platform, services, or applicable legal requirements.
The Last Updated date at the top of this page identifies the most recent revision.
HIPAA NOTICE OF PRIVACY PRACTICES SUMMARY
Protecting Your Health Information
Where HIPAA applies, Enigma is committed to protecting the privacy and security of your Protected Health Information (“PHI”).
This section summarizes certain ways PHI may be used and disclosed and certain rights you may have under HIPAA.
This summary does not replace the applicable entity’s complete HIPAA Notice of Privacy Practices.
How We May Use and Disclose PHI
Subject to applicable law, PHI may be used or disclosed:
For Treatment: To provide, coordinate, or manage healthcare and related services.
For Payment: Where applicable, to conduct lawful billing, collection, insurance, or other payment-related activities.
For Healthcare Operations: For activities permitted by HIPAA, which may include quality improvement, compliance, auditing, training, credentialing, patient safety, and other healthcare operations.
For Appointment and Healthcare Communications: To communicate regarding appointments, treatment, follow-up care, or other healthcare-related matters as permitted by law.
As Required or Permitted by Law: Certain disclosures may be made for public health, healthcare oversight, judicial or administrative proceedings, law enforcement, workers’ compensation, serious health or safety concerns, and other circumstances permitted or required by law.
USES REQUIRING AUTHORIZATION
When HIPAA or another applicable law requires written authorization, Enigma will obtain appropriate authorization before using or disclosing PHI for that purpose.
Certain uses of PHI for marketing and certain uses of identifiable patient photographs may require separate written authorization.
Where permitted by law, an authorization may be revoked in writing, subject to actions already taken in reliance upon it.
YOUR HIPAA RIGHTS
Subject to applicable law, you may have the right to:
- Access your records and obtain copies of certain medical and billing information;
- Request an amendment to certain information you believe is inaccurate or incomplete;
- Request confidential communications through a particular method or at a particular location;
- Request restrictions on certain uses or disclosures of your PHI;
- Receive an accounting of certain disclosures of your PHI; and
- Receive a copy of the applicable Notice of Privacy Practices.
Not every requested restriction or amendment must be accepted. Your rights are subject to HIPAA and other applicable law.
OUR HIPAA RESPONSIBILITIES
Where HIPAA applies, the applicable Enigma entity is required to:
- Maintain the privacy and security of PHI;
- Provide notice of its legal duties and privacy practices;
- Follow its currently effective Notice of Privacy Practices;
- Provide required notification following a breach of unsecured PHI; and
- Comply with applicable federal and state healthcare privacy requirements.
PRIVACY QUESTIONS & COMPLAINTS
If you have questions about your privacy rights, wish to request medical records, or believe your privacy rights have been violated, please contact the applicable Enigma office.
You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.
Enigma will not retaliate against you for filing a privacy complaint or exercising a right available under applicable law.
CONTACT US
Enigma Medi Spa & Laser Center
10767 Bustleton Avenue
Philadelphia, PA 19116
Phone: 215-717-7000
Fax: 215-376-6777
Email: info@Enigmamedispa.com
Enigma Plastic Surgery
1520 Locust Street
Philadelphia, PA 19102
Phone: 215-717-7117
Email: enigmaplasticsx@gmail.com
For medical-record or HIPAA-related matters, please contact the applicable office.
Full HIPAA Notice
This page includes a summary of certain HIPAA privacy practices and patient rights.
The applicable Enigma entity’s complete Notice of Privacy Practices is available upon request.
If there is a conflict between this summary, the applicable full Notice of Privacy Practices, or applicable law, the full Notice and applicable law will control.
