.svg)
.svg)
Legal
New Patients Receive 20% Off Their First Treatment — Reserve Your Appointment
Thanks. We'll reply within one business day.
Something went wrong. Please call us at (972) 803-3957.
New Patients Receive 20% Off Their First Treatment — Reserve Your Appointment
VIV Wellness, LLC, a Texas limited liability company doing business as VIV Anti-Aging + Wellness Center (“VIV,” “we,” “us,” or “our”), respects your privacy. This Privacy Policy explains what information we collect, how we use and share it, and the choices and rights you have.
This Policy applies to:
Collectively, the Site, the VIV App, and these related interactions are the “Services.”
This Policy does not apply to protected health information. See Section 2 below.
By using the Services, you acknowledge that you have read and understood this Privacy Policy.
VIV is a health care provider. The confidentiality of your medical information is governed by a different set of rules than the information described in this Privacy Policy.
Protected health information (“PHI”) — the health information we create, receive, and maintain in connection with your treatment, payment for your care, and our health care operations — is governed by:
Our use and disclosure of PHI is described in our separate Notice of Privacy Practices, which we provide to you at or before the time you become a patient, which is posted on this website, and which is available at our Dallas location and on request in printed or alternative accessible format.
In the event of any conflict between this Privacy Policy and our Notice of Privacy Practices with respect to PHI, the Notice of Privacy Practices controls.
This Privacy Policy governs information that is not PHI — for example, information collected from visitors browsing the Site, marketing contacts, event registrants, prospective patients who have not yet established care, newsletter subscribers, and website analytics and advertising data.
We recognize that the line between these two categories is not always obvious to the people we serve. Where we are uncertain whether information constitutes PHI, we treat it as PHI and apply the more protective standard.
Depending on how you interact with us, we may collect:
When you visit the Site or use the VIV App, we and our service providers automatically collect:
We collect this information using cookies, pixels, tags, software development kits (SDKs), server logs, and similar technologies. See Section 4.
Some of the information described above is treated as “sensitive personal data,” “sensitive personal information,” or “consumer health data” under state privacy laws — for example, information that identifies your past, present, or future physical or mental health condition, treatment, or diagnosis. Precise geolocation data is also sensitive under those laws; we do not collect it through the Site.
We do not sell sensitive personal data, and we do not sell biometric data. We do not use sensitive personal data to build advertising audiences, and we do not upload patient lists, email lists, or phone numbers to advertising platforms for audience matching.
Under the Texas Data Privacy and Security Act, we obtain your consent before processing sensitive personal data, and we obtain consent wherever else state law requires it. That consent is obtained through our consent banner for online activity, and through the forms and authorizations you complete in connection with your care.
We use the following third-party technologies. Each provider’s own privacy policy governs its handling of the data it receives.
You can opt out of Google Analytics across all websites using the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout, and you can manage Google ad personalization at myadcenter.google.com.
You can manage your Meta advertising preferences in the Ad Preferences section of your Facebook or Instagram account settings, including “Off-Facebook Activity.”
We understand that browsing a page about a specific treatment can reveal something personal. We take the following measures:
Web browsers may offer a “Do Not Track” setting. Because there is no consistent industry standard for how to respond to that signal, the Site does not respond to Do Not Track. We do honor the Global Privacy Control signal as described above.
We use the information described in Section 3 for the following purposes:
We do not use automated processing to make decisions that produce legal or similarly significant effects concerning you without human involvement.
We share personal information in the following circumstances. We do not sell your personal information for money.
We share information with vendors who perform services for us and are contractually restricted from using it for their own purposes. These include: our website host and content platform; our online scheduling and practice management platform; our electronic health record vendor; our payment processor; our email and SMS marketing platform; our telephone and text messaging providers; our rewards and mobile app platform; our review management and reputation platform; our analytics and advertising vendors; our accessibility technology provider; our IT support, hosting, and security vendors; and our professional advisors, including attorneys, accountants, and insurers.
Any vendor that receives PHI on our behalf executes a HIPAA-compliant Business Associate Agreement with us before receiving that information.
We share online identifiers and Site activity data with Google and Meta as described in Section 4, subject to your consent choices and the restrictions in Section 4.3.
If you choose a third-party financing option, we share the transaction amount and confirmation details needed to complete your purchase. See Section 9.4.
If you enroll in a manufacturer rewards program, we share the enrollment and treatment-eligibility information necessary to award your points. Enrollment is voluntary.
With your authorization or as otherwise permitted by HIPAA and Texas law, we share clinical information with other health care providers involved in your care, laboratories, pharmacies, and compounding facilities.
We disclose information when we believe in good faith that disclosure is required by law, subpoena, court order, or other legal process, or is necessary to protect the rights, property, or safety of VIV, our patients, our personnel, or the public; to investigate suspected fraud or violations of our terms; or to cooperate with law enforcement. Disclosure of PHI is limited to what HIPAA and Texas law permit.
If VIV is involved in a merger, acquisition, financing, reorganization, sale of assets, or bankruptcy, personal information may be transferred as part of that transaction. We will require the recipient to honor this Privacy Policy or provide notice and choice as required by law.
We share information with entities under common ownership or control with VIV for the purposes described in this Policy.
We share information whenever you ask us to, such as when you request that we send records to another provider.
We may create and use aggregated or de-identified information that cannot reasonably be used to identify you. We maintain such information in de-identified form and do not attempt to reidentify it, except to test our de-identification methods.
We do not exchange your personal information for money. However, several state privacy laws define "sale," "share," or "targeted advertising" broadly enough that the use of third-party advertising cookies and pixels described in Section 4 may qualify. Out of caution and transparency, we treat our use of those advertising technologies as activity you are entitled to opt out of, and we provide that opt-out to every visitor regardless of state of residence, through our consent banner, the "Your Privacy Choices" link in our footer, and the Global Privacy Control signal.
We do not sell sensitive personal data. We do not sell biometric data. We do not sell the personal information of consumers we know to be under 18 years of age.
Some states, including Washington and Nevada, regulate "consumer health data" — information linked or reasonably linkable to a consumer that identifies past, present, or future physical or mental health status — separately from other personal information, and apply their laws to consumers who are residents of those states or whose data is collected there, regardless of where the business is located.
Health-related information you provide in inquiry, consultation, or intake forms; the treatments or service categories you inquire about, book, or purchase; appointment and provider information; and, in limited cases, inferences drawn from the treatment pages you visit on the Site.
We use consumer health data to provide, schedule, and follow up on services, to communicate with you, and to maintain our records. We do not sell consumer health data, and we do not use it to build advertising audiences or to target advertising to you. We share it with service providers and processors bound by contract, and with other health care providers or as required by law.
One category deserves a specific explanation. The advertising and analytics technologies described in Section 4 record which pages of our website a browser visits, and some of those pages describe particular treatments. We restrict this as described in Section 4.3: no form contents, no appointment or treatment selection, no information from your patient record, and no tags at all in the authenticated booking flow. We do not use treatment-page activity to build advertising audiences. Where these technologies are active at all, they operate only with your consent and can be switched off at any time through our consent banner or by sending a Global Privacy Control signal.
If you are a resident of a state with a consumer health data law, you have the right to confirm whether we collect, share, or sell your consumer health data; to access it, including a list of the third parties with whom we have shared it; to withdraw consent to its collection and sharing; and to have it deleted, including by our service providers. To exercise these rights, use the contact methods in Section 12. We honor consumer health data deletion requests to the extent the information is not part of a medical record we are required to retain under 22 Texas Administrative Code § 165.1 and other applicable medical recordkeeping rules.
Access to consumer health data within VIV is limited to personnel whose duties require it, and each is bound by confidentiality obligations.
If you are a Texas resident, you have the right to:
How we respond. We will respond to an authenticated request without undue delay and within 45 days of receipt. Where reasonably necessary, we may extend that period by an additional 45 days, and we will tell you within the first 45 days that we are doing so and why. Information is provided free of charge up to twice in any twelve-month period. If a request is manifestly unfounded, excessive, or repetitive, we may charge a reasonable administrative fee or decline to act, and we will explain why.
Medical records requests are faster. If your request is for a copy of your medical record rather than for website, marketing, or account data, different and shorter deadlines apply: Texas Health and Safety Code § 181.102 requires us to provide an electronic health record within 15 business days of your written request, and HIPAA independently requires access within 30 days. Those deadlines apply instead of the 45-day period above. To request your medical record, contact us by phone or in person so that we can verify your identity.
Appeals. If we decline to act on your request, we will tell you why within 45 days and explain how to appeal. To appeal, reply to our response or contact us using the methods in Section 12 with the subject line "Privacy Request Appeal." We will decide the appeal and respond in writing within 60 days, including a written explanation of our reasoning. If we deny your appeal, we will provide you with an online mechanism or other method to submit a complaint to the Office of the Texas Attorney General, whose Consumer Protection Division can be reached at texasattorneygeneral.gov.
Residents of California, Colorado, Connecticut, Virginia, Utah, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Rhode Island, Indiana, Kentucky, and other states with comprehensive privacy laws may have rights that are similar to, and in some cases broader than, the Texas rights described above — including the right to know the categories of personal information collected, the sources of that information, the business purpose for collecting it, and the categories of third parties to whom it is disclosed; the right to limit the use of sensitive personal information; and the right to appeal a denial.
As a matter of policy, VIV extends the substantive rights described in Section 8.1 to every individual who submits a request, regardless of where you live. We do not require you to prove residency in a particular state. Where your state's law provides a right, deadline, or appeal process more favorable to you than the one described above, we honor the more favorable standard.
California residents may also designate an authorized agent to submit requests on their behalf and may request the specific pieces of personal information we have collected. California's "Shine the Light" law (Civil Code § 1798.83) permits California residents to request information about disclosures of personal information to third parties for their direct marketing purposes; VIV does not disclose personal information to third parties for those third parties' own direct marketing purposes.
Submit a privacy request by any of these methods:
Verification. To protect your information, we must verify your identity before acting on an access, correction, deletion, or portability request. We will ask you to confirm information already in our records, and for certain requests we may require additional verification. If we cannot verify your identity, we will tell you and will not be able to act on the request. If you use an authorized agent, we will require proof of the agent's authority and may contact you directly to confirm.
Limits on these rights. Some rights do not apply to information we are required to retain. In particular, medical records and related documentation must be retained under HIPAA and Texas medical recordkeeping rules, including 22 Texas Administrative Code § 165.1, and we cannot delete them on request. We may also decline a request where an exception applies under the governing law, and we will explain our reasoning when we do.
Opting out of marketing does not stop transactional messages such as appointment confirmations, reminders, aftercare instructions, and billing notices.
VIV sends appointment-related and, with your consent, marketing text messages from (972) 803-3957 and (844) 848-5893.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information may be shared with subcontractors who support our messaging platform, such as our text messaging provider, and those subcontractors are prohibited from using it for any other purpose. All other categories of information sharing described in this Policy exclude text messaging originator opt-in data and consent.
We use Klaviyo to send and measure marketing email. If you are a subscriber, we may associate your Site activity with your subscriber profile in order to personalize content, suppress irrelevant offers, and measure engagement. You can unsubscribe at any time.
The VIV App is provided through a third-party platform. When you create an account, you provide information directly to that platform as well as to us, and the platform's privacy policy applies to information it collects in its own right. We use App information to administer rewards, track visits and point balances, offer member pricing, and communicate about your membership.
We offer patient financing through Cherry (including the Cherry-powered payment plans offered through Allē), Affirm, and CareCredit. These are independent companies, not VIV. When you apply:
Review each provider's privacy policy before applying.
We participate in manufacturer-sponsored loyalty programs, including Allē. Enrollment is voluntary and is administered by the manufacturer. If you enroll, we share the information necessary to register your qualifying treatments so points can be credited to your account. The manufacturer's privacy policy governs its use of that information.
Our social media pages are hosted by the platforms, not by VIV. Content you post publicly on those pages is visible to others and is governed by the platform's terms and privacy policy. Do not post health information, appointment details, or other sensitive information on social media. If you send us a direct message containing health information, we will move the conversation to a secure channel.
If you post a public review, that content is public. If you provide a testimonial or authorize the use of your name, likeness, or before-and-after photographs, we will obtain your written authorization before using it, and you may revoke that authorization prospectively at any time by contacting us. See our Terms and Conditions.
The Site contains links to third-party websites and embedded third-party content. We are not responsible for the privacy practices of those third parties. Review their policies before providing information.
We retain personal information for as long as necessary to fulfill the purposes described in this Policy, and then for the additional period required by law, professional standards, or our legitimate business needs.
When information is no longer needed, we delete it or de-identify it in a manner designed to prevent reidentification.
We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, disclosure, and destruction. These include encryption of data in transit using TLS, encryption of data at rest in our clinical and payment systems, role-based access controls, unique user credentials, multi-factor authentication for administrative systems, workforce training, vendor due diligence and Business Associate Agreements, and incident response procedures.
No method of transmission or storage is completely secure. We cannot guarantee absolute security. Please do not send health information, payment card numbers, or government identification numbers to us by unencrypted email, text message, or social media. Use the phone, our secure forms, or an in-person visit instead.
If we experience a breach of unsecured personal information, we will notify affected individuals and regulators as required by HIPAA, Texas Business and Commerce Code § 521.053, and other applicable law.
The Site and the Services are intended for adults. We do not knowingly collect personal information online from children under 13, and we do not direct the Site to children. Our services are generally provided to individuals 18 years of age or older; where a service is available to a minor, it requires the consent and participation of a parent or legal guardian and is handled in person, not through the Site.
If we learn that we have collected personal information online from a child under 13 without verifiable parental consent, we will delete it. A parent or guardian who believes we may have collected such information should contact us using the methods in Section 12.
We do not knowingly sell or share for targeted advertising the personal information of any individual under 18 years of age.
VIV operates in the United States, and our Services are directed to individuals in the United States. If you access the Services from outside the United States, your information will be transferred to, stored in, and processed in the United States, where privacy laws may differ from those of your country. By using the Services, you understand that your information will be processed in the United States.
If you need this Privacy Policy in an alternative format — including large print, plain text, or read aloud over the phone — contact us at (972) 803-3957 or info@vivwellness.com and we will provide it at no charge. See our Accessibility Statement.
We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top. If we make a material change to how we use or share your personal information, we will provide additional notice — such as a prominent notice on the Site, a consent banner update, or an email to subscribers — before the change takes effect. Your continued use of the Services after the effective date of an updated Policy constitutes acknowledgment of the update. Where a change requires your consent under applicable law, we will obtain it.
Prior versions of this Policy are available on request.
For privacy requests, please use the subject line "Privacy Request." For appeals, use "Privacy Request Appeal." For questions about your medical records or protected health information, please contact us by phone or in person so that we can verify your identity before discussing your record.