PRIVACY POLICY
Effective Date: April 29, 2026
Last Updated: April 29, 2026
Body Preserve (“we,” “us,” “our,” or the “Company”) operates the website bodypreserve.com (the “Site”) and provides medical spa services at our physical location. This Privacy Policy describes in detail how we collect, use, disclose, store, and protect your personal information when you visit our Site, use our services, make purchases through our online store, or otherwise interact with us.
Body Preserve is a medical spa located at 3200 Hayden Rd #275, Scottsdale, AZ 85251. We are committed to protecting your privacy, complying with applicable federal and state privacy laws, and handling your data with transparency and care.
By accessing or using our Site, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, please discontinue use of the Site immediately.
If you have questions or concerns about this Privacy Policy or our data practices, contact us at info@bodypreserve.com or call (480) 788-2425.
1. Information We Collect
We collect personal information in several ways, depending on how you interact with our Site and services. The categories below are organized to align with the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) disclosure requirements.
1.1 Information You Provide Directly
When you use our contact forms, request a consultation, schedule an appointment, create an account, subscribe to communications, submit a review, or purchase products through our WooCommerce-powered online store, we may collect the following categories of information:
Identifiers: First and last name, email address, phone number, mailing address, billing address, and username or account credentials.
Commercial Information: Records of products or services purchased, obtained, or considered; purchase history; shopping cart contents; payment method type (we do not store full payment card numbers — see Section 7 below).
Communications: The content of any messages, inquiries, reviews, or feedback you submit through our contact forms, live chat, email, phone, or social media channels.
Service Preferences: Treatment interests, appointment preferences, consultation requests, and any aesthetic goals or concerns you voluntarily share.
Financial Information: When you apply for patient financing through our Cherry Technologies integration, Cherry collects and processes your financial information directly — we do not receive or store your credit score, Social Security number, or full financial details. We receive only approval status and payment plan terms.
1.2 Information Collected Automatically
When you visit our Site, certain technical and usage information is collected automatically through cookies, pixels, tags, and similar tracking technologies. Importantly, in compliance with applicable privacy laws including the California Invasion of Privacy Act (CIPA), all non-essential tracking technologies on our Site are blocked by default and do not fire until you affirmatively consent via our cookie consent banner. Before you click “Accept,” zero third-party tracking requests are transmitted from your browser.
Upon your consent, the following categories of information may be collected automatically:
Internet or Network Activity: IP address, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, referring URL (the website that directed you to us), pages visited, time spent on each page, click patterns, scroll depth, navigation paths, and session duration.
Geolocation Data: Approximate geographic location derived from your IP address (city/region level). We do not collect precise GPS-based location data.
Inferences: We or our analytics partners may draw inferences from the above data to create a profile reflecting your preferences, interests, or engagement patterns. These inferences are used solely for improving our Site and marketing effectiveness.
1.3 Information from Third-Party Sources
We may receive information about you from third-party sources, including:
Advertising Networks: Google Ads and StackAdapt may provide us with aggregated or pseudonymized data about how users interact with our advertisements across their networks.
Social Media Platforms: If you interact with our content on Facebook, Instagram, or TikTok, those platforms may share certain interaction data with us in accordance with their privacy policies and your platform settings.
Analytics Providers: Google Analytics, Microsoft Clarity, Segment, and Netrics may provide us with aggregated insights about website traffic and user behavior patterns.
1.4 Sensitive Personal Information
Our contact forms and website are not designed to collect protected health information (“PHI”) as defined by the Health Insurance Portability and Accountability Act (“HIPAA”), Social Security numbers, driver’s license numbers, financial account numbers, precise geolocation, racial or ethnic origin, religious beliefs, sexual orientation, or biometric data.
Important Notice: Please do not submit sensitive health information, diagnoses, medical history, prescription details, or other PHI through our website contact forms, live chat, or email. Our digital communication channels are not HIPAA-compliant environments. If you inadvertently submit such information, we will delete it promptly upon discovery and will not use it for any purpose.
Clinical consultations, treatment-related information, and medical intake forms are handled separately through our in-office processes and are governed by applicable healthcare privacy practices and our Notice of Privacy Practices, which is provided at the time of service.
1.5 Information We Do Not Collect
We do not knowingly collect: biometric identifiers (fingerprints, facial recognition data, voiceprints); precise geolocation (GPS coordinates); contents of private communications (mail, email, text messages) unless you send them to us directly; genetic data; or information about union membership, citizenship, or immigration status.
2. How We Use Your Information
We use the personal information we collect for the following business and commercial purposes:
Service Delivery: To respond to your inquiries, schedule consultations, provide requested services, process transactions, fulfill orders placed through our online store, and manage your account.
Communications: To send appointment confirmations, reminders, service-related notifications, and transactional emails (e.g., order confirmations, shipping updates).
Marketing (With Consent): To send promotional communications, special offers, and newsletters about our services. You may opt out of marketing communications at any time by clicking the “unsubscribe” link in any email or contacting us directly.
Advertising & Remarketing: With your consent, to deliver targeted advertising through Google Ads, StackAdapt, and related platforms, and to measure the effectiveness of our marketing campaigns through conversion tracking.
Analytics & Improvement: To analyze website traffic, understand user behavior, identify trends, optimize our Site’s performance, improve our services, and enhance user experience through tools like Google Analytics 4, Microsoft Clarity, Segment, and Netrics.
Security & Fraud Prevention: To detect, investigate, and prevent technical issues, fraudulent transactions, unauthorized access, and other potentially harmful activities.
Legal Compliance: To comply with applicable laws, regulations, legal processes, and governmental requests, and to enforce our Terms of Service.
Patient Financing: To facilitate your use of Cherry Technologies’ patient financing platform, which processes financing applications independently under its own privacy policy.
3. Cookies and Tracking Technologies
Our Site uses cookies and similar tracking technologies to analyze site performance, deliver relevant advertising, and improve your experience. In compliance with applicable privacy laws — including the California Invasion of Privacy Act (CIPA, California Penal Code § 631) — all non-essential tracking technologies are fully blocked until you provide affirmative consent through our cookie consent banner.
This is not a “soft block” or “consent mode” approach — our implementation physically prevents all third-party tracking scripts from loading, executing, or making any network requests whatsoever until you click “Accept.” No data is transmitted to Google, Microsoft, StackAdapt, Segment, Netrics, or any other third-party analytics or advertising platform before consent is given.
3.1 How Our Consent Mechanism Works
When you first visit our Site, a cookie consent banner appears at the bottom of the page. You have two options:
Accept: All analytics and advertising technologies described below are activated, and a consent cookie is stored for 365 days so you are not prompted again on future visits.
Decline: Only strictly necessary cookies (such as those required for shopping cart functionality and session management) remain active. No third-party tracking scripts are loaded. A preference cookie is stored for 365 days to remember your choice.
You may change your preference at any time by clicking the “Manage Cookies” link that appears at the bottom of every page, which will clear your stored preference and display the consent banner again on your next page load.
3.2 Strictly Necessary Cookies (Always Active)
These cookies are essential for basic Site functionality and cannot be disabled:
WooCommerce Session Cookies — Maintain your shopping cart contents, session state, and login status. Provider: WooCommerce (self-hosted). Retention: Session or up to 48 hours.
WordPress Cookies — Manage authentication for logged-in users and form submissions. Provider: WordPress (self-hosted). Retention: Session to 14 days.
Cookie Consent Preference (intuico_consent) — Stores your cookie consent or decline choice. Provider: Body Preserve (first-party). Retention: 365 days.
3.3 Analytics and Performance Cookies (Require Consent)
These cookies help us understand how visitors interact with our Site:
Google Analytics 4 (GA4) — Measures site traffic, user behavior, engagement metrics, conversion events, and audience demographics. Sets cookies including _ga (expires: 2 years), _ga_[ID] (expires: 2 years), and _gid (expires: 24 hours). Provider: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043. Privacy Policy: policies.google.com/privacy.
Google Tag Manager (GTM) — A tag management system that deploys and manages analytics and marketing tags. GTM itself does not set cookies but enables the deployment of other tracking technologies listed here. Provider: Google LLC.
Microsoft Clarity — Records anonymized session replays, heatmaps, and click maps to help us understand how users interact with our Site. Sets cookies including _clck (expires: 1 year) and _clsk (expires: 1 day). Provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052. Privacy Policy: privacy.microsoft.com.
Segment — Customer data platform that collects, standardizes, and routes analytics events to downstream tools. Sets cookies including ajs_anonymous_id (expires: 1 year) and ajs_user_id (expires: 1 year). Provider: Twilio Inc., 101 Spear Street, San Francisco, CA 94105. Privacy Policy: twilio.com/legal/privacy.
Netrics — Website analytics and performance monitoring platform. Provider: Netrics.ai. Retention and cookies vary by implementation.
3.4 Advertising and Remarketing Cookies (Require Consent)
These cookies are used to deliver relevant advertisements and measure campaign performance:
Google Ads Conversion Tracking — Tracks actions users take after clicking on our Google advertisements, including form submissions, phone calls, and purchases. Sets cookies including _gcl_au (expires: 90 days). Provider: Google LLC. Opt-out: Google Ad Settings.
Google DoubleClick (DV360) — Ad serving, frequency capping, and cross-device conversion attribution. Sets cookies including IDE (expires: 13 months) and test_cookie (expires: 15 minutes). Provider: Google LLC. Opt-out: Google Ad Settings.
StackAdapt — Programmatic advertising platform for targeted display, native, video, and connected TV campaigns. Sets cookies including sa-user-id and sa-user-id-v2 (expires: 1 year). Provider: StackAdapt Inc., 500 King Street West, Toronto, ON M5V 1L9, Canada. Privacy Policy: stackadapt.com/privacy. Opt-out: StackAdapt opt-out page.
Google Call Tracking — Dynamically replaces displayed phone numbers to track phone calls generated from website visits and measure advertising campaign effectiveness. Provider: Google LLC.
3.5 Functional Third-Party Technologies
These technologies provide specific functionality on our Site:
Cherry Technologies — Patient financing widget that allows visitors to explore payment plan options and apply for financing. Cherry collects and processes financial information under its own privacy policy. Provider: Cherry Technologies Inc. Privacy Policy: withcherry.com/privacy-policy. Note: Because Cherry provides core transactional functionality (not tracking), it is not blocked by our cookie consent mechanism.
WooCommerce — E-commerce platform powering our online store. Handles shopping cart, checkout, order processing, and account management. Provider: Automattic Inc. (self-hosted on our server). Privacy Policy: automattic.com/privacy.
3.6 Google Consent Mode v2
Our Site implements Google Consent Mode v2, which communicates your consent status to all Google services in real time. When consent is denied, all Google tags operate in a fully restricted mode — no cookies are set, no identifiers are stored, and no advertising data is collected. Our implementation goes beyond the standard Consent Mode behavior by physically blocking script execution (not merely setting consent signals to “denied”), ensuring zero network requests to Google servers before consent is granted.
3.7 Do Not Track (DNT) and Global Privacy Control (GPC)
Our Site honors Do Not Track browser signals and Global Privacy Control (GPC) signals. Because our consent mechanism blocks all tracking by default until affirmative consent is given, DNT and GPC users receive the same protection as all visitors — no tracking occurs without explicit opt-in. If you have GPC enabled and you accept cookies, we treat your GPC signal as an opt-out of the sale or sharing of personal information for cross-context behavioral advertising, consistent with CCPA/CPRA requirements.
4. How We Share Your Information
We do not sell your personal information in exchange for monetary consideration. Under the CCPA/CPRA’s broad definition of “sharing,” certain data disclosures to advertising partners for cross-context behavioral advertising may constitute “sharing.” You may opt out of this sharing by declining cookies via our consent banner or by enabling Global Privacy Control (GPC) in your browser.
We may disclose your personal information to the following categories of third parties for the business purposes described below:
Analytics Providers: Google LLC (GA4, GTM), Microsoft Corporation (Clarity), Twilio Inc. (Segment), and Netrics — to analyze website traffic, measure engagement, and improve our Site. Data shared: pseudonymized usage data, device information, and interaction data (only after consent).
Advertising Partners: Google LLC (Google Ads, DoubleClick) and StackAdapt Inc. — to deliver targeted advertisements and measure campaign performance. Data shared: pseudonymized identifiers, conversion events, and browsing behavior (only after consent).
Payment Processors: Our payment processing partners handle your payment card information directly and securely. We do not receive or store full credit card numbers, CVV codes, or bank account details.
Patient Financing: Cherry Technologies Inc. — processes financing applications independently. Data shared: we transmit only the information necessary to initiate a financing inquiry at your request.
E-Commerce Platform: WooCommerce/Automattic — powers our online store. As a self-hosted solution, transaction data remains on our servers; however, certain extensions may communicate with Automattic’s services for updates and functionality.
Email and Communication Services: We use third-party email service providers to send transactional and marketing communications. These providers process your email address and name on our behalf under data processing agreements.
Professional Advisors: Attorneys, accountants, auditors, and consultants who provide professional services to us and are bound by confidentiality obligations.
Legal and Regulatory: We may disclose personal information when required by law, subpoena, court order, regulatory investigation, or other legal process, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
Business Transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal information may be transferred as part of the transaction. We will notify you via prominent notice on our Site of any change in ownership or use of your personal information.
5. Your Privacy Rights
5.1 California Residents — CCPA/CPRA Rights
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):
Right to Know / Access: You may request that we disclose (a) the categories of personal information we have collected about you, (b) the categories of sources from which we collected it, (c) the business or commercial purpose for collecting or sharing it, (d) the categories of third parties to whom we disclosed it, and (e) the specific pieces of personal information we have collected about you. You may request this information for the 12-month period preceding your request.
Right to Delete: You may request that we delete personal information we have collected from you, subject to certain legal exceptions (e.g., completing a transaction, detecting security incidents, complying with legal obligations).
Right to Correct: You may request that we correct inaccurate personal information we maintain about you.
Right to Opt-Out of Sale/Sharing: We do not sell your personal information for monetary consideration. To the extent that our disclosure of data to advertising partners constitutes “sharing” for cross-context behavioral advertising under the CPRA, you may opt out by (a) declining cookies via our consent banner, (b) enabling Global Privacy Control (GPC) in your browser, or (c) contacting us directly.
Right to Limit Use of Sensitive Personal Information: We do not use or disclose sensitive personal information for purposes beyond those permitted under the CPRA.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights. We will not deny you goods or services, charge different prices, provide a different quality of service, or suggest that you will receive a different level of service for exercising your rights.
Submitting a Request: To exercise any of these rights, contact us at info@bodypreserve.com or call (480) 788-2425. We will verify your identity before processing your request by matching information you provide against information we have on file. We will respond to verifiable consumer requests within 45 days. If we require additional time (up to an additional 45 days), we will notify you of the extension and the reason for it.
Authorized Agents: You may designate an authorized agent to submit a request on your behalf. If an agent submits a request, we may require (a) signed written authorization from you, (b) verification of your identity directly, and (c) confirmation that you authorized the agent to act on your behalf.
5.2 California Shine the Light (Civil Code § 1798.83)
California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. As stated above, we do not disclose personal information to third parties for their own direct marketing purposes without your consent. To make such a request, contact us at info@bodypreserve.com.
5.3 California Invasion of Privacy Act (CIPA) Compliance
Our Site is designed to comply with the California Invasion of Privacy Act (California Penal Code § 631). All third-party tracking scripts, pixels, and network requests are physically blocked from loading or executing until you provide affirmative consent via our cookie consent banner. This ensures that no “interception” or “eavesdropping” on your communications occurs without your knowledge and consent.
5.4 Nevada Residents
Under Nevada Revised Statutes Chapter 603A, Nevada residents may opt out of the sale of their “covered information” (as defined by Nevada law). We do not sell covered information as defined by Nevada law. If you are a Nevada resident and wish to submit an opt-out request, contact us at info@bodypreserve.com.
5.5 Colorado, Connecticut, Virginia, Texas, Oregon, Montana, and Other State Privacy Laws
Residents of states with comprehensive privacy laws (including the Colorado Privacy Act, Connecticut Data Privacy Act, Virginia Consumer Data Protection Act, Texas Data Privacy and Security Act, Oregon Consumer Privacy Act, and Montana Consumer Data Privacy Act) may have similar rights, including the right to access, correct, and delete personal information, the right to opt out of targeted advertising, and the right to data portability. To exercise any applicable rights, contact us at info@bodypreserve.com. We will process requests in accordance with the applicable state law and respond within the timeframe required by that law.
5.6 Arizona Residents
While Arizona does not currently have a comprehensive consumer data privacy statute, we extend the same transparency, access, correction, and deletion rights described above to all Arizona residents. You may request information about the personal data we hold about you and request its deletion at any time by contacting us.
5.7 International Visitors (GDPR)
Our Site is primarily intended for users located in the United States. If you access our Site from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using our Site, you consent to the transfer of your information to the United States.
For visitors from the European Economic Area (EEA), United Kingdom, or Switzerland: where applicable, the legal basis for our processing of your personal data includes (a) your consent (for cookies and marketing), (b) performance of a contract (for processing orders and providing services), and (c) legitimate interests (for security, fraud prevention, and improving our services). You may have additional rights under the General Data Protection Regulation (GDPR), including the right to access, rectification, erasure, restriction of processing, data portability, and the right to object. To exercise these rights, contact us at info@bodypreserve.com.
6. Data Retention
We retain personal information only for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Our retention practices are guided by the following principles:
Contact Form Submissions: Retained for up to 24 months from the date of submission, unless you request earlier deletion or we need to retain them for legal purposes.
Customer Account Data: Retained for the duration of your account and for up to 36 months after your last interaction with us, to allow for re-engagement and to fulfill any outstanding obligations.
Transaction Records: Retained for a minimum of 7 years to comply with tax, accounting, and financial reporting obligations under federal and Arizona state law.
Marketing Preferences: Retained until you withdraw consent or unsubscribe, plus a suppression record retained indefinitely to honor your opt-out request.
Analytics Data: Google Analytics data is retained for 14 months by default. Microsoft Clarity session recordings are retained for up to 30 days. Segment data is retained in accordance with our Segment workspace settings.
Cookie Data: Cookie retention varies by cookie type (see Section 3 above for specific cookie expiration periods). Your consent preference cookie is retained for 365 days.
When personal information is no longer needed, we securely delete or anonymize it. Anonymized data (which cannot reasonably be used to identify you) may be retained indefinitely for research and analytical purposes.
7. Payment and Financial Data
When you make a purchase through our WooCommerce-powered online store, your payment is processed by our third-party payment gateway. We do not receive, store, transmit, or have access to your full credit card number, CVV/security code, or bank account information. Our payment processor is PCI DSS (Payment Card Industry Data Security Standard) compliant.
We receive only: confirmation of the transaction, the last four digits of your payment card (for your reference), transaction amount, and billing address for order fulfillment purposes.
If you use Cherry Technologies’ patient financing option, Cherry independently collects and evaluates your financial information under its own privacy policy and terms of service. We do not receive your credit report, Social Security number, or detailed financial information from Cherry. We receive only your approval status and the terms of your payment plan.
8. Data Security
We implement reasonable and appropriate technical, administrative, and physical safeguards designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include, but are not limited to:
Encryption in Transit: All data transmitted between your browser and our Site is encrypted using HTTPS/TLS (Transport Layer Security) protocols.
Access Controls: Access to personal information is restricted to authorized personnel who require it to perform their job functions, and such personnel are subject to confidentiality obligations.
Secure Hosting: Our Site is hosted on servers that employ industry-standard security measures, including firewalls, intrusion detection systems, and regular security patches.
Regular Assessments: We conduct periodic security assessments and vulnerability scans to identify and address potential risks.
Vendor Security: We require our third-party service providers to maintain appropriate security measures and to process personal information only as directed by us and subject to confidentiality obligations.
However, no method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. If you have reason to believe that your personal information has been compromised, please contact us immediately at info@bodypreserve.com.
9. Children’s Privacy
Our Site, services, and online store are not directed to individuals under the age of 18. Our medical spa services are intended for adults, and certain aesthetic treatments may have additional age requirements. We do not knowingly collect, use, or disclose personal information from children under 18. If we learn that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you are a parent or guardian and believe your child has provided personal information to us, please contact us at info@bodypreserve.com.
10. Third-Party Links and Services
Our Site may contain links to third-party websites, applications, and services that are not operated or controlled by us, including but not limited to social media platforms (Facebook, Instagram, TikTok), review sites (Google Business, Yelp), scheduling platforms, and payment processors. This Privacy Policy does not apply to any third-party websites or services. We encourage you to review the privacy policies and terms of service of any third-party sites before providing them with your personal information.
The inclusion of a link to a third-party site does not imply our endorsement of that site or its content, products, or services. We are not responsible for the privacy practices or the content of third-party websites.
11. Email and SMS Communications
Marketing Emails: If you opt in to receive marketing communications from us, we may send you promotional emails about our services, special offers, and events. Every marketing email includes an “unsubscribe” link at the bottom. You may also opt out by contacting us directly. We will process your unsubscribe request within 10 business days, as required by the CAN-SPAM Act.
Transactional Emails: Even if you opt out of marketing emails, we may still send you transactional communications related to your orders, appointments, account activity, and service-related notices. These are not marketing communications and are necessary for the performance of our services.
SMS/Text Messages: If we offer SMS communications in the future, we will obtain your express written consent before sending any text messages, in compliance with the Telephone Consumer Protection Act (TCPA). Standard message and data rates may apply. You may opt out of SMS at any time by replying STOP to any message.
12. User-Generated Content and Reviews
If you submit a review, testimonial, comment, or other content through our Site or third-party review platforms, that content may be publicly visible. We may display reviews on our Site with your first name and last initial. Do not include personal information in reviews that you do not want to be publicly available. We are not responsible for personal information you choose to make public through reviews or comments.
13. Data Breach Notification
In the event of a data breach that compromises your personal information, we will notify affected individuals and relevant authorities in accordance with applicable federal and state breach notification laws, including Arizona Revised Statutes § 18-552. Notification will be provided without unreasonable delay and within the timeframes required by applicable law.
14. Accessibility
We are committed to making our Privacy Policy accessible to all users, including individuals with disabilities. If you have difficulty accessing or understanding this Privacy Policy due to a disability, please contact us at info@bodypreserve.com or call (480) 788-2425, and we will provide the information in an alternative format.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the “Effective Date” and “Last Updated” date at the top of this page and, where appropriate, provide additional notice (such as a banner on our Site or an email notification). We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of our Site after any changes constitutes your acceptance of the updated Privacy Policy.
16. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy, our data practices, or your privacy rights, please contact us:
Body Preserve
3200 Hayden Rd #275
Scottsdale, AZ 85251
Email: info@bodypreserve.com
Phone: (480) 788-2425
For privacy-specific inquiries, please include “Privacy Request” in the subject line of your email to ensure prompt routing.
If you are not satisfied with our response to your privacy concern, you may have the right to lodge a complaint with your applicable data protection authority or state attorney general’s office.
