Privacy

Privacy Policy

Last updated: June 24, 2026

This Privacy Policy explains how The Vitality & Aesthetics Institute, PLLC ("TVAAI," "we," "us," or "our") collects, uses, and protects information when you visit our websites, book a visit, or receive services from us.

1. Who we are

The Vitality & Aesthetics Institute, PLLC is a medical aesthetics, longevity, and wellness practice located at 2603 Augusta Dr, Suite 1450, Houston, TX 77057. You can reach us at (832) 962-4455 or privacy@tvaai.com. This policy applies to tvaai.com and book.tvaai.com (the "Sites").

2. Protected health information (HIPAA)

As a healthcare provider, our handling of your protected health information ("PHI") — including medical history, treatment records, prescriptions, and lab results — is governed by the Health Insurance Portability and Accountability Act ("HIPAA") and described in our separate Notice of Privacy Practices, which controls in the event of any conflict with this policy.

This Privacy Policy governs information collected through the Sites and other non-PHI interactions. Where website information becomes part of your medical record, the NPP and HIPAA apply.

3. Information we collect

• Information you provide — name, contact details, date of birth, and the goals or services you select when booking or completing intake forms.
• Health information you submit through consultations, intake, or consent forms.
• Payment and financing information — processed by our third-party providers (see Section 6); we do not store full card numbers on our servers.
• Automatically collected data — IP address, device and browser type, and usage data collected through cookies and similar technologies for analytics and Site security.

4. How we use information

• To schedule, provide, and follow up on consultations and treatments.
• To process payments and financing applications you initiate.
• To communicate with you about appointments, care, offers, and account matters.
• To operate, secure, and improve the Sites, and to comply with legal and regulatory obligations.

5. Text message (SMS) and email communications

With your consent, we send appointment, care, and promotional messages by SMS and email. Message and data rates may apply. You may opt out of SMS at any time by replying STOP, and unsubscribe from marketing email using the link in any message. Opting out of marketing does not stop transactional messages necessary for your care. We do not sell or share your phone number with third parties for their own marketing.

6. Service providers we share information with

We share information only as needed to provide our services, and require these providers to protect it. Where they handle PHI, we maintain a Business Associate Agreement (BAA) as HIPAA requires.

• Prospyr — practice management, scheduling, records, and payments.
• Cherry Technologies, Inc. — patient financing (subject to Cherry's own privacy policy).
• Revive Rx and other independently licensed pharmacies — dispensing of prescriptions and compounded medications; see our Telehealth Informed Consent.
• Analytics and advertising-measurement providers — used in a privacy-protective configuration; we do not share information that directly identifies you or your health conditions with advertising platforms.

We may also disclose information when required by law or to protect the safety of our patients, staff, or the public.

7. Cookies and tracking

We use cookies and similar technologies for essential Site functionality, analytics, and (where applicable) advertising measurement. You can control cookies through your browser settings.

8. How we protect your information

We use administrative, physical, and technical safeguards to protect your information, including encryption of data in transit (SSL/TLS), access controls, and audit logging. No method of transmission or storage is completely secure, but we work to protect your information consistent with HIPAA and applicable law.

9. Data retention

We retain medical records for at least seven (7) years from the last date of service for adult patients, and longer where required for minors or by other applicable law. We keep other information for as long as needed for the purposes described here or as required by law.

10. Your choices and rights

You may request access to or correction of your information, opt out of marketing communications, and exercise the rights described in our Notice of Privacy Practices. To make a request, contact us using the details below. We do not knowingly collect information from children under 13, and our services are intended for adults 18 and older.

11. Changes to this policy

We may update this policy from time to time. The "Last updated" date above reflects the current version, and material changes will be posted on this page.