Notice of Privacy Practices & Accessibility Statement

Effective Date: October 11, 2026

THIS NOTICE DESCRIBES HOW MEDICAL AND PERSONAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

---

1. Who We Are

This Notice applies to Magnolia Skin Center, Inc. ("Magnolia Skin Center," "we," "us," or "our"), 3508 1/2 W Magnolia Blvd, Burbank, CA 91505. It covers our clinic and our online services: our website and client portal (services.magnoliaskincenter.com), online booking, forms and consents you sign by link or on our in-clinic iPad, and our photo consultation tool.

We protect your Protected Health Information ("PHI") as required by the Health Insurance Portability and Accountability Act (HIPAA), the HITECH Act, the California Confidentiality of Medical Information Act (CMIA) (Cal. Civ. Code § 56 et seq.), and the California Consumer Privacy Act (CCPA / CPRA) (Cal. Civ. Code § 1798.100 et seq.).

---

2. Information We Collect

• ●Contact details: your name, mobile number, email address, and device and IP information when you use our online services.
• ●Health information: your health history, the forms and consents you sign, your treatment records and your appointments.
• ●Photographs and video: clinical before-and-after photographs, photos you send us, and consultation videos recorded for you by Dr. David McDonough, MD.
• ●AI simulations: if you use our photo consultation tool, computer-generated preview images made from your photo.
• ●Sign-in records: the one-time codes and access times for your client portal.

---

3. How We Use and Disclose Your Health Information

We may use and disclose your PHI without your separate authorization for:

• ●Treatment: to plan and provide your care, including reviewing your photos and preparing your consultation videos.
• ●Payment: to bill and process payments or deposits.
• ●Health care operations: quality review, staff training and running our systems securely.
• ●Reminders and messages: appointment reminders, forms to sign, portal sign-in codes and follow-up, by text message and email. These are sent for your care, not as marketing.
• ●As required by law: to comply with federal, state or local law, public health requirements, valid subpoenas or court orders.

---

4. Photographs, Video & AI Simulations

• ●Part of your medical record: your photographs, AI simulations and consultation videos are confidential medical records. They are kept on secure systems covered by HIPAA Business Associate Agreements.
• ●Shared only with your written permission: we do not show your photographs or video to anyone outside your care — other clients, social media, advertising, print or seminars — unless you sign our Photo, Video & Marketing Authorization, and then only at the level you choose. Saying no has no effect on your care.
• ●Other clients' photos we show you: before-and-after photos of other clients in your portal are shared with their written permission, for your review only. You may not save, copy, screenshot, forward, post or use them for any other purpose.
• ●AI simulations are labeled: AI-generated images are marked as computer-generated simulations. They illustrate a possibility; they are not real results, a guarantee or a diagnosis.

---

5. Uses That Need Your Written Authorization

• ●Marketing: any use of your likeness, photos or video in public promotion, social media or advertising.
• ●Sale of information: we do not sell, rent or trade patient data or images to anyone.
• ●Revoking an authorization: you may revoke any written authorization at any time by writing to our Privacy Officer. It takes effect when we receive it and does not undo uses already made.

---

6. California Privacy Rights

• ●CMIA: your medical information is protected against unauthorized disclosure under California Civil Code § 56, and any vendor handling it must protect it to the same standard.
• ●CCPA / CPRA: medical information covered by HIPAA and the CMIA is generally exempt. For other personal information collected through our website and forms, you have:
  • ●The right to know what personal information we collected, used or disclosed in the last 12 months.
  • ●The right to deletion of personal information collected from you, subject to California medical record retention rules (adult charts are kept at least seven years).
  • ●The right to non-discrimination for exercising these rights.
• ●We do not sell or share your personal information for cross-context behavioral advertising.

---

7. Your HIPAA Rights

• ●Inspect and copy: you may get an electronic or paper copy of your records, including your photos and videos.
• ●Amend: you may ask in writing for us to correct information you believe is wrong or incomplete.
• ●Accounting of disclosures: you may ask for a list of certain disclosures made outside treatment, payment and health care operations.
• ●Request restrictions: you may ask us to limit how we use or share your information. We consider every request but are not required to agree to one that conflicts with your care or the law.
• ●Confidential communications: you may choose the phone number, email or address where we contact you.
• ●Breach notification: you will be told promptly in writing if your unsecured PHI is accessed or disclosed without authorization.
• ●Paper copy of this Notice: available at our front desk at any time.

---

8. How We Keep Your Information Secure

• ●Encryption: your information, photos and videos are encrypted in transit and at rest.
• ●Secure infrastructure: our systems run in private cloud environments covered by HIPAA Business Associate Agreements.
• ●Code-protected portal: your client portal opens only after a one-time code is sent to the mobile number or email we have on file for you.

---

9. Dispute Resolution

Any dispute arising out of this Notice or our handling of your information — to the extent not pre-empted by federal enforcement authority — is resolved through final and binding individual arbitration administered by JAMS in Los Angeles County, California, as set out in Section 13 of our Terms of Service.

---

10. Changes to This Notice

We may revise this Notice and apply the revised practices to all information we hold. The current version is always at services.magnoliaskincenter.com/privacy, in your client portal, and in our clinic.

---

11. Complaints

If you believe your privacy rights have been violated, you may complain to:

Magnolia Skin Center Privacy Officer
Eileen Kenny, RN
3508 1/2 W Magnolia Blvd, Burbank, CA 91505
Phone: (747) 305-8973 · Email: rejuv@magnoliaskincenter.com

U.S. Department of Health & Human Services, Office for Civil Rights
200 Independence Avenue, S.W., Washington, D.C. 20201
(877) 696-6775 · https://www.hhs.gov/ocr/privacy/hipaa/complaints/

We will never retaliate against anyone, or deny care to anyone, for filing a privacy complaint.