Privacy Policy

Night & Day Esthetics collects only what's needed to book and provide your service well. This page also serves as the Consumer Health Data Privacy Policy required under Washington's My Health My Data Act (MHMDA) for the health-related information described below.

What's collected

• Contact details you provide when booking or filling out a form: name, email, phone number, and date of birth.
• Consumer health data, meaning information collected on the client intake form and/or consent form that identifies your health status or history: allergies and product sensitivities, current and past skin/medical conditions, medications and topical products, prior reactions to services, and, where relevant, pregnancy or breastfeeding status.
• Your electronic signature and the IP address it was submitted from, as part of the record of what you agreed to and when.
• Payment and card-on-file information, handled and stored by PocketSuite, never stored directly by Night & Day Esthetics.

Why it's collected, and who sees it

Consumer health data is collected directly from you, on the intake and consent forms, for one purpose: to screen services safely and provide appropriate care. It is used only by Madison, the licensed esthetician providing your service. It is never sold, never used for advertising, and never shared with any third party except PocketSuite (for booking and payment only, which does not receive your health answers) and the infrastructure providers that host this site and its database (Cloudflare), who process it only to store and serve it securely and do not use it for their own purposes.

How it's protected

Health answers and signatures are encrypted before they're stored, in addition to the encryption Cloudflare applies to the database itself. The admin dashboard where Madison reviews submissions requires a login, and every view or deletion of a record is logged.

Your rights and how to exercise them

Under MHMDA, you have the right to know what consumer health data has been collected about you, to withdraw your consent to its collection or use, and to request it be corrected or deleted. To exercise any of these rights, email [email protected] from the address you used to submit your form. Verified requests are completed within 30 days.

Retention

Signed consent and intake forms are kept on file for the period required for professional licensing and liability purposes (generally at least 2 years from your last visit), then securely deleted. You can request earlier deletion at any time using the contact above.

Cookies and tracking

This site does not use cookies or any tracking, analytics, or advertising tools. Booking and payment happen through PocketSuite, which has its own privacy practices for the information you provide there.

Questions

For any question about this privacy policy or your information, reach out anytime at [email protected].