Privacy Policy

1. Information We Collect

We collect personal information necessary to provide high-quality hair restoration services and to communicate with you effectively. This includes:

1.1 SMS / Text Message Data

When you opt in to receive SMS messages from us — via our website contact form we collect your name and mobile phone number. We use this information solely to send you the types of messages you consented to: appointment reminders, account notifications, order updates, and/or marketing and promotional messages. We do not sell, rent, share, or disclose your mobile phone number or SMS opt-in data to any third party for marketing purposes. We may share your information with our SMS service provider solely for the purpose of delivering messages on our behalf. That provider is contractually prohibited from using your data for any other purpose.

1.2 Personal Identification Information

• Full name, date of birth, and gender
• Contact details: email address, phone number, and mailing address
• Government-issued identification when required for medical records

1.3 Health and Medical Information

• Hair loss history, scalp condition, and relevant medical history
• Current medications, allergies, and pre-existing conditions
• Photographs and images of your scalp and hairline for consultation and treatment records
• Treatment plans, procedure notes, and post-operative care information

1.4 Financial and Payment Information

• Payment card details (processed securely through third-party payment processors)
• Billing address and insurance information if applicable
• Financing and payment plan arrangements

1.5 Online and Technical Information

• IP address, browser type, and device information
• Pages visited, time spent on site, and referring URLs
• Cookies and similar tracking technologies (see Section 7)
• Information submitted through contact forms or online consultations

2. How We Use Your Information

ReGrow Medical, Professional Corporation uses the information we collect for the following purposes:

• To schedule consultations, procedures, and follow-up appointments
• To provide, personalize, and improve our hair restoration services
• To maintain accurate medical and clinical records
• To process payments and manage billing inquiries
• To communicate with you regarding your care, including pre- and post-procedure instructions
• To send SMS appointment reminders, order confirmations, and account notifications — only to users who have explicitly opted in via the checkbox on our contact form
• To send SMS marketing and promotional messages — only to users who have explicitly opted in via the separate marketing checkbox on our contact form
• To send appointment reminders, newsletters, and promotional materials (with your consent)
• To comply with applicable healthcare laws and regulations
• To detect and prevent fraud, security breaches, or unlawful activity
• To analyze website usage and improve user experience

3. Legal Basis for Processing

Where applicable under privacy law, we process your personal data on the following legal bases:

• Consent: Where you have explicitly provided consent for marketing communications or optional data collection
• Contract Performance: To fulfill our obligations related to your treatment and appointments
• Legal Obligation: To comply with applicable healthcare, tax, and regulatory requirements
• Legitimate Interests: To improve our services, prevent fraud, and maintain the security of our systems

4. Sharing of Your Information

We do not sell, rent, or trade your personal information to third parties for marketing purposes. We may share your information only in the following circumstances:

4.1 Healthcare Providers and Clinical Partners

We may share relevant medical information with referring physicians, pathology labs, anesthesiologists, or other healthcare providers directly involved in your care, strictly on a need-to-know basis.

4.2 Service Providers

We engage trusted third-party vendors to support our operations, including:

• Electronic medical record (EMR) and practice management platforms
• Payment processing and financing companies
• Email, SMS, and appointment reminder services
• Website hosting and analytics providers

All service providers are contractually obligated to maintain the confidentiality and security of your information and are prohibited from using it for any other purpose.

4.3 Legal and Regulatory Disclosure

We may disclose your information when required by law, subpoena, court order, or governmental authority, or when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of ReGrow Medical, Professional Corporation, our patients, or the public.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to a successor entity. You will be notified via email or prominent notice on our website if such a change occurs.

5. Protection of Health Information (HIPAA)

ReGrow Medical, Professional Corporation complies with the Health Insurance Portability and Accountability Act (HIPAA) and applicable state healthcare privacy laws. Your Protected Health Information (PHI) is handled in accordance with our Notice of Privacy Practices, which is provided separately and available upon request.

We implement administrative, physical, and technical safeguards to protect your PHI from unauthorized access, use, or disclosure. These measures include:

• Encrypted storage and transmission of medical records
• Role-based access controls limiting staff access to PHI
• Staff training on HIPAA compliance and privacy obligations
• Regular security audits and vulnerability assessments

6. Data Retention

We retain your personal and medical information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Medical records are typically retained for a minimum of seven (7) years from the date of last treatment, or as required by applicable law.

SMS Data: Your mobile phone number and SMS opt-in consent records are retained for as long as you remain subscribed to our messaging program, and for a minimum of four (4) years thereafter as required for compliance documentation. You may request deletion of your SMS data at any time by texting STOP or contacting us at info@regrowmedical.com. Upon opt-out, your number will be removed from active messaging lists within 24 hours.

When information is no longer needed, we securely destroy it using methods appropriate to the sensitivity of the data.

7. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance your browsing experience and analyze site traffic. The types of cookies we use include:

• Essential Cookies: Required for basic website functionality and security
• Analytics Cookies: Help us understand how visitors interact with our site (e.g., Google Analytics)
• Marketing Cookies: Used to deliver relevant advertisements and track campaign effectiveness

You may control cookie preferences through your browser settings or our cookie consent tool. Please note that disabling certain cookies may affect website functionality.

8. Third-Party Links

Our website may contain links to third-party websites, including social media platforms and partner organizations. ReGrow Medical, Professional Corporation is not responsible for the privacy practices or content of those third-party sites. We encourage you to review their privacy policies before providing any personal information.

9. Your Rights and Choices

Depending on your location and applicable law, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal data, subject to legal and medical record retention requirements
• Restriction: Request that we limit processing of your data in certain circumstances
• Portability: Receive your data in a portable, machine-readable format
• Opt-Out of Marketing: Unsubscribe from promotional communications at any time via the unsubscribe link in our emails or by contacting us directly
• Do Not Sell: We do not sell personal information; however, California residents may submit opt-out requests under the CCPA

To exercise any of these rights, please contact our Privacy Officer using the contact information in Section 12. We will respond to verified requests within 30 days.

10. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you specific rights, including the right to know what personal information is collected, the right to delete personal information, and the right to non-discrimination for exercising your privacy rights.

To submit a CCPA request, contact us at [email protected] or call our toll-free number. We will verify your identity before processing your request.

11. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a child has provided us with personal information without parental consent, please contact us immediately and we will take steps to delete such information.

12. Mobile Terms of Service

By providing your phone number and checking the opt-in boxes on our contact form, you consent to receive SMS messages as described above. Consent is not a condition of purchase or service.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy Officer:

We are committed to resolving privacy concerns promptly and will respond to all inquiries within a reasonable timeframe.

14. Updates to This Privacy Policy

ReGrow Medical, Professional Corporation reserves the right to update this Privacy Policy at any time to reflect changes in our practices, legal requirements, or services. We will notify you of material changes by posting the updated policy on our website with a revised effective date. Continued use of our services following the posting of changes constitutes your acceptance of tho