Privacy Policy

Who we are and what this covers

Kolibri Aesthetics ("Kolibri," "we," "us") operates a skin therapy and wellness studio at 16850 E Avenue of the Fountains, Suite 102, Fountain Hills, Arizona 85268.

This policy explains how we handle information about you when you visit kolibriaesthetics.com, book an appointment with us online or in our mobile app, sign up for a membership, complete an intake or consent form, receive texts or emails from us, or visit our studio.

It applies to our website, our iOS and Android apps, and the booking and account tools we provide. It does not apply to other companies' websites or apps that we link to.

Information we collect

We collect only what we need to book your appointments, care for you safely, take payment, and stay in touch.

Information you give us

Contact and account details

Your name, mobile phone number, email address, and date of birth. We use your phone number as your account identifier, so it is required to book.

Appointment details

The services you book, which practitioner you see, your appointment times, your visit history, and any scheduling notes you or our team add (for example, a preference for a quieter room).

Health information

Information you provide on intake and consent forms, and anything you tell us about your skin, medical history, medications, allergies or implanted devices. See Health information below.

Payment details

Handled by our payment processor, not by us. See Payment information below.

Messages you send us

What you write in our consultation request form, in texts and emails to us, and in any reviews or feedback you send directly.

Information we collect automatically

• Device and usage information — the type of device and browser you use, your approximate region, the pages or screens you open, and the date and time. This helps us keep the site working and spot problems.
• Push notification token — if you allow notifications in our app, so we can send your appointment reminders to that device.
• Local storage — small values stored in your own browser so we remember things like a dismissed banner. See Cookies and local storage.

We do not buy personal information about you from data brokers, and we do not use advertising or cross-site tracking technology on our website or in our apps.

How we use your information

• To book, confirm, reschedule and cancel your appointments.
• To send you appointment confirmations, reminders, preparation instructions and aftercare.
• To treat you safely — reviewing your intake and consent forms before device-based or advanced treatments.
• To take payment, hold a deposit, bill a membership and apply package or points balances.
• To answer your questions and provide customer service.
• To operate and improve our website, apps and studio operations.
• To send you marketing about our treatments, offers and events — only if you have opted in, and you can opt out at any time.
• To meet our legal, tax, accounting and recordkeeping obligations, and to establish or defend legal claims.

We do not sell your personal information, and we do not share it with third parties for their own marketing.

Health information

To treat you safely we need to know relevant things about your health — your skin history, medications, allergies, pregnancy, and any implanted device that would make a therapy unsuitable for you. We treat this information as confidential.

Access to health information is limited to the practitioners and staff who need it to care for you. We do not use health information for advertising or marketing, and we never share it with third parties for their marketing purposes.

Before-and-after photographs are taken only with your separate written consent, and any use of them beyond your own record requires your specific permission, which you can withdraw.

Text messages

When you give us your mobile number and agree to receive texts, we use SMS to send appointment confirmations, reminders, intake form links, schedule changes and — if you separately opt in — occasional offers.

Consent to receive marketing texts is never a condition of booking an appointment or purchasing anything from us.

Push notifications

If you install our app, we will ask whether you want push notifications. We ask only after you have made a booking, never on first launch, and declining costs you nothing — you will still receive reminders by text or email.

We use push notifications for appointment confirmations, reminders, schedule changes and account notices. You can turn them off at any time in your device settings or in the app under Profile, and we will fall back to another channel.

Payment information

Card payments are processed by Stripe. Your full card number goes directly to Stripe and is never stored on our systems. We keep only the card brand, the last four digits, the expiry date and a token that lets us charge a card you have chosen to save.

We save a card on file when you book so that deposits, balances and any cancellation or no-show fee described in our Terms of Service can be applied. You can remove a saved card at any time from your account.

Cookies and local storage

Our marketing website does not use advertising cookies or third-party tracking. It stores a small number of values in your own browser so the site behaves sensibly — for example, remembering that you dismissed the announcement bar or already saw the new-client offer. These never leave your device and we cannot read them.

Our booking tools and apps use cookies or equivalent secure storage to keep you signed in and to keep your booking session working. These are necessary for the service to function.

Our website embeds a Google Maps frame on the Visit section. Google may set its own cookies when that map loads; Google's practices are governed by its own privacy policy.

Who we share information with

We share information only with service providers who help us run the business, and only with what they need. They are contractually required to protect it and may not use it for their own purposes.

• Payments — Stripe, to process cards, deposits, memberships and refunds.
• Intake and consent forms — our HIPAA-aligned forms provider, under a Business Associate Agreement.
• Text messaging — our SMS provider, to deliver appointment messages.
• Email — our email provider, to deliver confirmations, receipts and replies.
• Push notifications — the notification services operated by Apple and Google, and our app platform, to deliver messages to your device.
• Hosting and data storage — our website host and managed database provider.
• Account sign-in — our authentication provider, which verifies your phone number.

We may also disclose information if the law requires it, in response to a valid legal request, to protect the safety of a person, to enforce our Terms, or in connection with a sale or transfer of the business — in which case we will tell you before your information becomes subject to a different policy.

How long we keep information

We keep appointment, treatment and consent records for as long as Arizona law and our professional obligations require, and we keep financial records for as long as tax and accounting rules require. Marketing preferences and opt-out records are kept for as long as we operate, so that we continue to honor your choice.

When information is no longer needed we delete it or anonymize it so it can no longer be connected to you.

How we protect information

We encrypt information in transit and at rest, restrict access to the staff who need it, require multi-factor authentication for staff accounts, and keep an audit record of access to sensitive records. Our forms provider holds intake and consent answers in a system built for that purpose.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your information, we will notify you as required by law.

Your choices and rights

You can, at any time:

• See what we hold about you, and ask for a copy.
• Correct anything inaccurate — you can edit most details yourself in your account.
• Delete your account and personal information, subject to the records we are legally required to keep.
• Opt out of marketing — reply STOP to a text, use the unsubscribe link in any marketing email, or change your preferences in the app. This does not affect appointment messages.
• Turn off push notifications in your device settings.
• Withdraw consent for photography or any optional use of your information.

Depending on where you live, you may have additional rights under your state's privacy law — including the right to know what we collect, to have it deleted, to correct it, to obtain a portable copy, to opt out of sale or targeted advertising (we do neither), and not to be discriminated against for exercising those rights. To make a request, contact us using the details below. We will verify your identity before acting, and we will respond within the time your law allows. If we decline, we will tell you why and how to appeal.

Deleting your account

Teen clients and children

Our website, apps and accounts are intended for adults. We do not knowingly collect personal information from children under 13, and children under 13 may not create an account.

We do offer treatments designed for teenagers. A client under 18 must be booked by a parent or legal guardian on the guardian's own account, as a dependent profile. The guardian provides the health information and signs the consent forms, and must accompany the teen to the appointment unless we have agreed otherwise in writing.

If you believe a child has given us information without a guardian's involvement, contact us and we will delete it.

Changes to this policy

We will update this policy when our practices change. The effective date at the top always reflects the current version. If a change materially affects how we use your information, we will tell you by email, text or an in-app notice before it takes effect, and where the law requires it we will ask for your consent.