Privacy Policy

1. Who we are

Undertone SKN LLC ("Undertone SKN," "we," "us") is a Florida limited liability company solely owned by Zinthia Garcia. We operate a private studio at 2915 Biscayne Blvd Suite 200-29, Edgewater Miami, FL 33137. You can reach us at info@undertoneskn.com or 305-965-0145.

This policy explains what personal information we collect through our website, intake forms, scheduling system, and in-studio services, and how we use, store, share, and protect it.

2. What we collect

Contact & identity

• Full name, email address, phone number, date of birth
• How you found us (referral source)

Health & wellness information (from intake forms)

• Current skin concerns, goals, and stress/sleep self-reports
• Allergies, sensitivities, and adverse reactions
• Skincare products and prescriptions you're currently using
• Recent cosmetic treatments (Botox, fillers, peels, lasers, etc.)
• Relevant medical conditions and medications
• Pregnancy and nursing status (when you choose to share)

Session records

• Treatment notes Zinthia records before, during, and after each session
• Before/after photographs — only if you've given consent on your intake (private file always; marketing use only if you separately opt in)
• Pre-session check-in responses (skin status, stress, sleep) when you submit them before a visit

Payment information

Payments are processed by Acuity Scheduling (for online booking deposits and prepayments) and Stripe (the underlying card processor). We do not store your full card number on our servers. We may store a token that lets us charge a card you've authorized us to keep on file (for example, to enforce the cancellation policy if you've agreed to it).

Website usage

• Pages visited, time on site, device type, approximate location (city-level), referring source
• Cookies and similar technologies (see Section 9)

3. How we use your information

• Provide services. Plan and customize your sessions based on your skin, history, and goals.
• Communicate with you. Send appointment confirmations, reminders, post-session follow-ups, and direct responses to your questions.
• Maintain your file. Build a record over time so each session picks up where the last one left off.
• Process payments for sessions and (in the future) products.
• Improve our services. Identify patterns across treatments to refine our approach. Where we use aggregated or de-identified data for this, we remove information that identifies you personally.
• Comply with the law and protect our legal interests when required.

We do not sell your personal information, and we do not share it with advertisers or marketing partners.

4. How we store your information

Your records are stored in a PostgreSQL database hosted on Railway, with encryption at rest. Photographs may be stored in our database or with our image-hosting partner Cloudinary. Access requires authentication; only Zinthia (and any future Undertone SKN team members under written confidentiality terms) can view your records.

We follow reasonable industry-standard safeguards to protect against unauthorized access, loss, or misuse. No system is perfectly secure, but we take this seriously and review our practices regularly.

5. Who we share your information with

The service providers we currently use:

• Acuity Scheduling (Squarespace, Inc.) — online booking, intake forms, appointment management.
• Stripe, Inc. — payment processing.
• Railway Corporation — application hosting and database.
• Cloudinary Ltd. — image hosting and delivery.
• Anthropic PBC — AI processing of session notes, treatment briefs, and content drafts (see note below).
• Google LLC — Google Tag Manager and analytics (see Section 9).

A note on AI processing. We use Anthropic's Claude API to help structure session notes Zinthia dictates, generate treatment briefs for her own use before a session, and draft routine client communications. Information sent to Anthropic is used to produce the requested response and is not used by Anthropic to train its models on terms applicable to API customers. We do not send raw photographs or your full file — only the relevant context for the task at hand.

We may share information when required by law, in response to a valid legal request, or to protect the rights, property, or safety of Undertone SKN, our clients, or others.

6. Your rights

You have the right to:

• Access — request a copy of the personal information we hold about you.
• Correct — ask us to fix anything inaccurate or out of date.
• Delete — request that we erase your records (subject to limited exceptions where we're legally required to keep certain information).
• Port — receive your data in a structured, machine-readable format you can take elsewhere.
• Withdraw consent — for example, revoke your photo marketing consent at any time.
• Object — to specific uses of your information.

To exercise any of these rights, email us at info@undertoneskn.com with "Privacy Request" in the subject line and a brief description of what you'd like. We'll respond within 30 days. We may ask you to verify your identity before acting.

7. Health information — Florida-specific handling

Undertone SKN is not a HIPAA-covered entity. We're a private wellness studio, not a healthcare provider, and we don't bill insurance. However, we recognize that the information you share on intake — medical history, medications, pregnancy status — is sensitive. We handle it with elevated care:

• Health information is stored only in your private client file, separate from any marketing or analytics data.
• Only Zinthia accesses it, and only for the purpose of providing safe, customized care.
• We do not share health information with third parties for marketing.
• We comply with Florida state law, including the Florida Information Protection Act (FIPA), regarding the security of personal information.

If you have concerns about a specific medical condition's relevance to facial work, we recommend consulting your physician before booking. We may decline to perform certain treatments if we believe they're not safe for you.

8. Photo consent

Photographs are handled based on the consent you provide during your intake:

• Private file (required for ongoing clients): before/after photos are stored in your private record so Zinthia can track your progress over time. These are never shared without separate written permission.
• Marketing use (optional, opt-in): if you opted in, anonymized photos may be used in Undertone SKN's marketing materials. Marketing photos are cropped to the treatment area only — never your full face — and you can withdraw consent at any time by emailing us. Withdrawal applies to future use; we'll remove the photos from active marketing channels.

9. Cookies and tracking

We use the following on our website:

• Essential cookies — required for the site to function (e.g., remembering you've dismissed the cookie banner).
• Google Tag Manager and Google Analytics — anonymous, aggregated information about how visitors use the site (pages viewed, time on page, device type, approximate location). We do not use this for advertising retargeting.

You can decline non-essential cookies through the banner that appears on your first visit, by adjusting your browser settings, or by using a privacy extension. Declining analytics cookies does not affect your ability to use the site.

10. California residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

• Right to know what categories of personal information we collect, the sources, the business purpose, and the categories of third parties we share it with.
• Right to delete personal information we have collected from you (subject to legal exceptions).
• Right to correct inaccurate personal information.
• Right to opt out of "sale" or "sharing" of personal information. We do not sell or share personal information for cross-context behavioral advertising.
• Right to limit use of sensitive personal information.
• Right to non-discrimination for exercising your privacy rights.

To exercise California rights, email info@undertoneskn.com with "California Privacy Request" in the subject line. You may also designate an authorized agent to make a request on your behalf.

11. Children

Our services and website are intended for adults aged 18 and over. We do not knowingly collect information from anyone under 18. If you are under 18, you may only book a session with the written consent and presence of a parent or legal guardian, and only the guardian may submit intake information on your behalf. If you believe we have collected information from a minor without proper consent, please contact us at info@undertoneskn.com and we will delete it.

12. How long we keep your information

We retain your personal and health information for five (5) years after your last interaction with us (your most recent session, communication, or purchase). After that, your records are deleted from active systems.

Aggregated or de-identified information that no longer reasonably identifies you may be retained longer for analytical purposes. We may also retain specific records longer where required by tax law, applicable consumer protection law, or to resolve disputes.

You can request deletion at any time before the five years are up — see Section 6.

13. Updates to this policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top of this page reflects the most recent revision. If we make material changes — for example, adding a new category of data we collect or a new third party we share with — we will notify active clients by email and post a notice on this page for at least 30 days before the change takes effect.

Continued use of our website or services after changes take effect indicates your acceptance of the updated policy.