Privacy Policy

Introduction and Our Commitment

At Lumière Gold Canyon Aesthetics, your privacy is foundational to the trust you place in us. This Privacy Policy and HIPAA Notice of Privacy Practices describes how we protect, use, and disclose your health information and how we handle information collected through our website.

We are committed to maintaining the confidentiality of your Protected Health Information (PHI) in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the HITECH Act, and applicable Arizona law. We have implemented physical, administrative, and technical safeguards designed to protect your information.

Who We Are - Covered Entity

Lumière Gold Canyon Aesthetics is a private aesthetic medicine practice located in Gold Canyon, Arizona. We are a covered entity under HIPAA. Our practice provides medical aesthetic services that involve the creation and maintenance of Protected Health Information.

Practice: Lumière Gold Canyon Aesthetics, Gold Canyon, AZ
Provider: Mary Ann Migaud, DNP, APRN, FNP-BC — licensed advanced practice provider in Arizona
Location: Off US-60 near Kings Ranch Road, Gold Canyon, AZ 85118
This Notice applies to all PHI we maintain, including electronic PHI (ePHI), whether created by us or received from you.

Information We Collect

A. Protected Health Information (PHI)

When you become a patient, we may collect and create the following categories of PHI:

Identifiers: Name, date of birth, contact information, address, photographs for clinical documentation
Health History: Medical history, allergies, medications, prior procedures, treatment goals
Clinical Information: Consultation notes, treatment records, before/after documentation, informed consents
Financial: Billing information, payment records, insurance information where applicable
Communications: Secure messages, intake forms, and correspondence related to your care

B. Website Non-PHI Information

When you visit lumieregoldcanyonaesthetics.com, we may automatically collect limited non-PHI information:

Technical Data: IP address, browser type, device type, pages visited, time spent
Cookies & Similar Technologies: Only essential cookies for site functionality and security. Any analytics cookies are used only if implemented in a HIPAA-compliant configuration with a signed BAA
Voluntary Submissions: Information you submit via our secure forms (name, phone, email, inquiry). Form submissions containing PHI are encrypted and transmitted via TLS and stored in a HIPAA-compliant environment
No PHI in Unsecured Channels: We do not knowingly collect PHI via unsecured email, standard contact forms, or social media

How We Use and Disclose Your Information

We use and disclose PHI only as permitted or required by HIPAA. The primary uses include:

For Treatment

To provide, coordinate, and manage your care — including consultations, treatment planning, documentation, follow-up communication, and referrals to other healthcare providers when necessary for your care.

For Payment

To bill and collect payment for services, verify eligibility, and process transactions through HIPAA-compliant payment processors with BAAs.

For Healthcare Operations

To support quality assurance, training, compliance auditing, business planning, and improvement of our services, subject to the minimum necessary standard.

Other Permitted Disclosures

With Your Written Authorization: Any use or disclosure not otherwise permitted requires your signed authorization, which you may revoke in writing except to the extent action has already been taken

As Required by Law: Court orders, subpoenas, law enforcement in limited circumstances, public health reporting, health oversight activities

To Avert Serious Threat: To prevent or lessen serious and imminent threat to health or safety

Business Associates: To vendors who perform services on our behalf and who have signed HIPAA-compliant

Business Associate Agreements

Personal Representatives: To persons with legal authority to act on your behalf

Website Specific Practices

Secure Forms: Patient intake forms are hosted in a HIPAA-compliant environment with TLS 1.2+ encryption. Do not submit PHI via unsecured email. If you receive an email from us, do not reply with sensitive health information unless through our secure portal
Cookies: We use only essential cookies necessary for site security and performance. No advertising or cross-site tracking cookies are used. You may disable cookies in your browser, though some features may not function
Analytics: If analytics are enabled, they are implemented only in a HIPAA-compliant manner, with IP anonymization, no PHI transmitted, and a signed Business Associate Agreement with the analytics provider. No analytics tools are used to identify patients
Third-Party Vendors & BAAs: We maintain Business Associate Agreements with all vendors who may have access to PHI — including EHR/EMR, hosting provider, secure form provider, email provider, cloud storage, and payment processor. Vendors are prohibited from using PHI beyond the contracted purpose
No Selling PHI: We never sell, rent, or trade your PHI. We never sell any personal information for marketing purposes
Links: Our site may link to third parties. We are not responsible for their privacy practices

Your Rights Under HIPAA

You have the following rights regarding your PHI:

Right to Access: Request to inspect and obtain a copy of your PHI. We will respond within 30 days. Electronic copies provided when feasible. A reasonable cost-based fee may apply
Right to Amendment: Request amendment of PHI you believe is inaccurate or incomplete. We may deny in certain circumstances but will provide a written explanation
Confidential Communications: Request communications at an alternative address or by alternative means. We will accommodate reasonable requests
Request Restrictions: Request restriction on uses/disclosures for treatment, payment, or operations. We are not required to agree, except when you have paid out-of-pocket in full and request restriction to a health plan
Accounting of Disclosures: Request a list of certain disclosures made in the past six years, excluding treatment, payment, healthcare operations, and certaain other disclosures
Paper Copy: Obtain a paper copy of this Notice upon request, even if you agreed to receive it electronically
Breach Notification: Right to be notified if there is a breach of your unsecured PHI
Right to Complain: Right to file a complaint with us or with the U.S. Department of Health and Human Services without retaliation

Our Duties

Maintain the privacy and security of your PHI as required by law
Apply the minimum necessary standard — we access only the PHI needed to perform our duties
Abide by the terms of the Notice currently in effect
Notify you promptly if a breach occurs that may compromise the privacy or security of your PHI
Not use or disclose your PHI for fundraising without your authorization, and never for marketing or sale without authorization
Provide this Notice and obtain acknowledgment where required

Security Measures

Maintain the privacy and security of your PHI as required by law
Apply the minimum necessary standard — we access only the PHI needed to perform our duties
Abide by the terms of the Notice currently in effect
Notify you promptly if a breach occurs that may compromise the privacy or security of your PHI
Not use or disclose your PHI for fundraising without your authorization, and never for marketing or sale without authorization
Provide this Notice and obtain acknowledgment where required

Data Retention

We retain PHI and medical records in accordance with HIPAA and Arizona law. Arizona requires retention of adult medical records for at least 6 years after the last date of service, and minor records until 3 years after the child reaches majority or 6 years after last service, whichever is longer. Billing records are retained for 6 years. After the retention period, PHI is securely destroyed or de-identified.

Website non-PHI analytics logs, if collected, are retained for no longer than 26 months and are anonymized.

Arizona and State Law Considerations

Where Arizona law is more protective of privacy than HIPAA, we follow Arizona law. This includes Arizona confidentiality statutes, minor consent provisions, and medical board record requirements. Arizona has no comprehensive consumer privacy law beyond existing health privacy statutes as of the effective date, but we will update this Notice if material changes occur.

Communications that may include health information are not sent without your consent to electronic delivery where required.

Minors

Our services are intended for adults 18 years and older. We do not knowingly provide aesthetic medical services to minors without parental or legal guardian consent as required by Arizona law. If we learn we have inadvertently collected information from a minor without proper consent, we will delete it promptly. Parents and guardians may have rights to access their minor child's PHI, subject to Arizona law and professional judgment regarding safety.

Marketing - No Sale pf PHI

We will not use your PHI for marketing purposes without your written authorization. This includes before/after photographs, testimonials, or other marketing communications that identify you.

We will never sell your PHI. Marketing communications, if any, will be sent only with your express authorization and will include an opt-out mechanism. You may revoke marketing authorization at any time in writing.

Changes to This Policy

We reserve the right to change this Privacy Policy and Notice of Privacy Practices at any time as permitted by law. Changes apply to PHI we already maintain as well as PHI created or received after the change. We will post the revised Notice on our website and in our practice with a new effective date. If a material change affects your rights, we will provide notice by prominent posting or direct communication where required.

We encourage you to review this Notice periodically.

How to Contact Us/ File a Complaint

If you have questions about this Notice or wish to exercise your rights, please contact:

Mary Ann Migaud
Lumière Gold Canyon Aesthetics
Off US-60 near Kings Ranch Road
Gold Canyon, AZ 85118
Phone: 602-330-2705
Email: mamigaud@gmail.com

If you believe your privacy rights have been violated, you may also file a complaint with the U.S. Department of Health and Human Services:

Office for Civil Rights (OCR)
U.S. Department of Health and Human Services
200 Independence Avenue, SW
Washington, D.C. 20201
Toll Free: 1-800-368-1019 · TDD: 1-800-537-7697
Website: www.hhs.gov/ocr
Email: OCRComplaint@hhs.gov

You will not be retaliated against for filing a complaint. All complaints must be submitted in writing.

Acknowledgment

By using our website or receiving services, you acknowledge that you have received, read, and understand this Privacy Policy & Notice of Privacy Practices. Where required, we will request your written acknowledgment of receipt of this Notice at your first visit.