KESH MEDSPA WEBSITE PRIVACY POLICY
Last updated: November 12, 2026
PLEASE COMPLETE BEFORE PUBLISHING
Confirm the exact legal entity responsible for the website and retail activity, the exact legal name of the clinical practice entity, the privacy contact email, and which analytics, booking, payment, and messaging services are enabled. Replace the bracketed fields below. This website policy is not a substitute for a separate HIPAA Notice of Privacy Practices if the clinical practice is a HIPAA covered entity.
1. WHO WE ARE AND WHAT THIS POLICY COVERS
KESH MedSpa (“KESH,” “we,” “us,” or “our”) is a medical aesthetics and wellness practice and boutique in Melrose, Massachusetts. The KESH MedSpa name is associated with KESH MedSpa Management LLC for nonclinical and retail activities and with 950 Main Medspa PLLC for clinical care. The responsible entity may depend on whether you are using the website, shopping, or receiving clinical services.
This policy describes information handled through www.keshmedspa.com, its website forms, retail and appointment inquiries, and our related communications. Medical records created in connection with treatment are also subject to the clinical practice’s applicable privacy notice and professional obligations.
2. INFORMATION WE MAY COLLECT
Depending on how you interact with us, we may collect:
• Contact details such as your name, email address, phone number, and mailing address.
• Information you submit through a contact, waitlist, booking, or other website form, including your requested service, preferred appointment details, and message.
• Retail order and transaction information.
• Information about your use of the website, such as device, browser, pages visited, and cookie or analytics data, if those tools are enabled.
• Health or treatment information you provide in connection with clinical services, such as health history, medications, allergies, treatment records, photographs, and follow-up information. Please do not send sensitive medical details through a general website contact form. Use the secure clinical intake or patient communication method provided by the practice.
3. HOW WE USE INFORMATION
We may use information to:
• Respond to questions and requests.
• Manage waitlist, appointment, retail, and client communications.
• Provide, document, and coordinate clinical care.
• Process retail orders and payments.
• Send service-related messages and, when you separately opt in, marketing text messages or emails.
• Operate, maintain, protect, and improve our website and services.
• Meet legal, regulatory, recordkeeping, and safety obligations.
4. WHEN WE MAY SHARE INFORMATION
We may share information with service providers that support our operations, such as website hosting, appointment and clinical record systems, payment processing, and communications providers. These providers may use information only as permitted by their service arrangements and applicable law. We may also disclose information when required by law, to protect safety or rights, or as part of a business transfer, subject to applicable protections.
Mobile information will not be shared with third parties/affiliates for marketing/promotional purposes.
Mobile information, including SMS opt-in and consent data, will not be shared with third parties or affiliates for their marketing or promotional purposes. We may provide it to service providers only as needed to deliver messaging services on KESH MedSpa’s behalf, and they may not use it for their own marketing.
5. CLINICAL INFORMATION AND HIPAA
Clinical information is used by the clinical practice and its authorized workforce for treatment, payment, healthcare operations, and other purposes permitted by applicable law. Where HIPAA requires it, the clinical entity will use written business associate agreements with vendors that handle protected health information on its behalf.
Whether HIPAA applies depends on the clinical entity’s activities, including whether it conducts certain standard electronic healthcare transactions. If the clinical entity is a HIPAA covered entity, it will provide a separate Notice of Privacy Practices describing its HIPAA duties, permitted uses and disclosures, and patient rights. This website Privacy Policy does not replace that notice.
6. TEXT MESSAGES
You will receive marketing text messages only if you opt in through a clear SMS consent control. Consent to marketing texts is optional and is not a condition of purchasing goods or services. Message and data rates may apply, and message frequency may vary. Reply HELP for help. Reply STOP or UNSUBSCRIBE to opt out. We may still send necessary non-marketing communications where permitted, such as a response to a request you made.
7. COOKIES AND SIMILAR TECHNOLOGIES
Our website may use cookies or similar technologies for site functionality, security, preferences, and traffic measurement. The tools and choices available may depend on which services are enabled on the site. You can manage cookies through your browser settings; disabling some cookies may affect site features.
8. RETENTION AND SECURITY
We retain information for as long as reasonably necessary for the purpose it was collected, including applicable clinical recordkeeping, business, tax, and legal requirements. We use administrative, technical, and physical safeguards appropriate to the information we maintain. No website, email, text message, or storage system can be guaranteed completely secure.
9. YOUR CHOICES AND REQUESTS
You may opt out of marketing emails using the unsubscribe link in the message. You may opt out of text messages by replying STOP or UNSUBSCRIBE. You may contact us to ask about, correct, or request deletion of information, subject to applicable law and clinical record-retention obligations. For clinical-record access or amendment requests, contact the clinical practice directly using the contact details in its Notice of Privacy Practices, if applicable.
10. THIRD-PARTY WEBSITES
Our website may link to third-party websites or services. Their privacy practices are governed by their own policies, and we encourage you to review them.
11. CHILDREN
Our website is not intended for children under 13, and we do not knowingly collect personal information online from children under 13. If you believe a child has submitted information, contact us so we can review it.
12. CHANGES TO THIS POLICY
We may update this policy as our practices or legal requirements change. We will post the updated policy on this page and revise the “Last updated” date.
13. CONTACT US
For website privacy questions or requests, contact:
KESH MedSpa
950 Main St.
Melrose, MA 02176
Email: khoffman@keshmedspa.com
SMS CONSENT TEXT FOR WEBSITE FORMS
Place this next to the phone field on every form that collects a phone number and offers text messages. Use an unchecked, optional consent checkbox:
[ ] I agree to receive text messages from KESH MedSpa.
By entering your phone number, you agree to receive text messages from us. Message and data rates may apply. Message frequency may vary. Reply HELP for more information. Reply STOP or UNSUBSCRIBE to opt out.
If your Squarespace form supports a dedicated SMS marketing opt-in checkbox, enable it and confirm that its displayed disclosure contains the required information above. Do not treat a phone number entered for appointment contact as marketing-text consent unless the visitor separately opts in.