LEGAL

Privacy Policy

EFFECTIVE DATE: May 9th, 2026

On This Page

01. Introduction

02. Information We Collect

03. How We Use Information

04. Cookies, Tracking, and Analytics

05. How We Share Information

06. Mobile Information & SMS Consent.

07. Your Privacy Rights

08. Children's Privacy

09. Data Security

10. Data Retention

11. Third-Party Links

12. Changes to This Policy

13. Contact Us

1. Introduction

The Spa, LLC, d/b/a The Spa by Sheena ("The Spa," "we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, and share information when you visit www.thespalubbock.com (the "Website"). By using the Website, you agree to this Policy.

This Policy covers information collected through the Website only. Protected Health Information (PHI) created or received in connection with medical treatment is governed by our separate Notice of Privacy Practices (HIPAA Notice), which controls in any conflict with this Policy.

2. Information We Collect

Information you provide directly:

Contact information (name, email, phone) submitted through forms, appointment requests, or live chat
Gift card purchase information (billing details processed by our payment processor; we do not store full card numbers)
Communications you send to us, including messages submitted through our live chat feature

Information collected automatically:

Device and browser data (IP address, browser type, operating system, referring URL, pages viewed, date and time of visit)
Cookies, pixels, and similar technologies (see Section 4)

Information we do not collect through the Website:

We do not request medical history, treatment details, or other health information through the Website. Clinical information is collected separately through our patient intake and electronic medical record system and is governed by HIPAA.

3. How We Use Information

We use information to:

Respond to inquiries and appointment requests
Process gift card purchases
Operate, maintain, secure, and improve the Website
Measure and analyze Website traffic and performance
Comply with legal obligations and enforce our terms

4. Cookies, Tracking, and Analytics

The Website uses cookies and similar technologies. The following tools operate on the Website:

Google Analytics 4 (GA4) — measures Website traffic and user behavior
Google Ads conversion tracking — measures the performance of our advertising
Meta Pixel (Facebook/Instagram) — measures the performance of our advertising
Session recording / heatmap tools (e.g., Hotjar) — records anonymized user interactions to help us improve the Website
Live chat / chatbot tool — enables real-time messaging with our team

Advertising and session-recording technologies (Meta Pixel, Google Ads conversion tracking, and session recording / heatmap tools) operate only on general marketing pages of the Website (such as the homepage, blog, and informational pages) and are not active on appointment booking pages, treatment-detail pages, patient portal pages, or other pages associated with the delivery of medical services.

You can control cookies through your browser settings or opt out of certain advertising cookies at:

Google Analytics opt-out: https://tools.google.com/dlpage/gaoptout
Digital Advertising Alliance: https://optout.aboutads.info
Network Advertising Initiative: https://optout.networkadvertising.org

We honor Global Privacy Control (GPC) signals where required by law for opt-out of targeted advertising.

5. How We Share Information

We do not sell or rent your personal information. We do not share your personal information with third parties for those parties' own marketing purposes.

We share information only as follows:

Service providers acting on our behalf (e.g., website hosting, analytics, payment processing, live chat platform, email delivery), bound by contract to use the information only for the services they provide to us
Legal and safety reasons — to comply with law, respond to lawful requests, enforce our terms, or protect the rights, property, or safety of The Spa, our customers, or others
Business transfers — in connection with a merger, acquisition, financing, or sale of all or part of our business

6. Mobile Information & SMS Consent

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

7. Your Privacy Rights

Texas residents (TDPSA). Under the Texas Data Privacy and Security Act, you have the right to:

Confirm whether we process your personal data and access that data
Correct inaccuracies in your personal data
Delete personal data we hold about you
Obtain a portable copy of your personal data
Opt out of (i) the sale of personal data, (ii) targeted advertising, and (iii) profiling that produces legal or similarly significant effects

We do not sell personal data and do not engage in profiling that produces legal or similarly significant effects.

Residents of other U.S. states with comprehensive privacy laws (including California, Colorado, Connecticut, Virginia, Utah, Oregon, Montana, and others) have similar rights under their respective laws.

To exercise your rights, contact us at legal@thespalubbock.com. We will verify your request and respond within the time required by applicable law (typically 45 days). You may appeal a denial by replying to our response within a reasonable time. There is no charge for most requests.

We will not discriminate against you for exercising your privacy rights.

8. Children's Privacy

The Website is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us at legal@thespalubbock.com and we will delete it.

9. Data Security

We use reasonable administrative, technical, and physical safeguards to protect information collected through the Website. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Data Retention

We retain Website-collected information for as long as necessary to fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods vary based on the type of data and the purpose for which it was collected.

11. Third-Party Links

The Website may contain links to third-party websites. We are not responsible for the privacy practices of those websites. Review their privacy policies before providing information.

12. Changes to This Policy

We may update this Policy from time to time. The "Effective Date" above will reflect the most recent version. Material changes will be posted on the Website. Continued use of the Website after the Effective Date constitutes acceptance.