Effective Date: October 1, 2026

My Skin by Leah Michel ("My Skin," "we," "us," or "our") provides medical, surgical, and cosmetic dermatology and aesthetic services at our offices in St. Petersburg and Bradenton, Florida, and operates the website myskinstpete.com. We respect your privacy and are committed to protecting your personal and health information.

This Privacy Policy explains what information we collect through our website and practice, how we use and share it, and the rights you have, including your rights under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

Our Commitment Under HIPAA

As a healthcare provider, My Skin is a covered entity under HIPAA. Information that identifies you and relates to your past, present, or future health, the care you receive, or payment for that care is called Protected Health Information (PHI). Examples include your medical history, treatment records, clinical photographs, insurance details, and appointment history.

We are required by law to:

• Maintain the privacy and security of your PHI

• Provide you with our Notice of Privacy Practices describing our legal duties and privacy practices

• Follow the terms of the Notice of Privacy Practices currently in effect

• Notify you if a breach occurs that may have compromised the privacy or security of your PHI

Notice of Privacy Practices. Our Notice of Privacy Practices explains in detail how your PHI may be used and disclosed and how you can access it. A copy is available at both of our offices, on request. If anything in this Privacy Policy conflicts with our Notice of Privacy Practices regarding your PHI, the Notice of Privacy Practices controls.

Information We Collect

Information you provide to us

• Name, phone number, email address, and mailing address

• Date of birth

• Appointment requests, booking details, and form submissions

• Insurance and payment information

• Medical history, treatment information, and clinical photographs (as a patient)

Information collected automatically on our website

• Pages visited, time spent on the site, and how you arrived at our site

• Browser type, device type, and general location based on IP address

• Information collected through cookies and similar technologies (see "Cookies and Tracking Technologies" below)

Please note: Our general website contact forms are not intended for detailed medical information. Please do not include symptoms, diagnoses, or other sensitive health details in a general contact form. To discuss your health, call the office directly.

How We Use and Disclose Your Health Information

We may use and disclose your PHI without your written authorization for the following purposes:

• Treatment: to provide, coordinate, and manage your care, including sharing information with other providers involved in your care, such as a pathology lab or referring physician

• Payment: to bill and collect payment for services, including communicating with your health plan

• Healthcare operations: to run our practice, including quality improvement, staff training, scheduling, and appointment reminders

We may also use or disclose PHI when permitted or required by law, including:

• When required by federal, state, or local law

• For public health activities and reporting

• For health oversight activities, such as audits and licensing

• In response to a court order, subpoena, or other lawful process

• To law enforcement in limited circumstances

• To prevent a serious threat to health or safety

• For workers' compensation purposes

• To coroners, medical examiners, and funeral directors

Uses that require your written authorization

We will not use or disclose your PHI for the following without your written authorization:

• Marketing purposes, except as permitted by HIPAA (for example, face-to-face communications with you)

• Sale of your PHI (we never sell your PHI)

• Use of your photographs, before-and-after images, testimonials, or story on our website, social media, or in advertising

• Any other use or disclosure not described in this policy or our Notice of Privacy Practices

You may revoke an authorization at any time in writing, except to the extent we have already relied on it.

How We Use Website Information

We use information collected through our website to:

• Schedule and confirm appointments

• Respond to your questions and requests

• Send updates, promotions, and newsletters you have opted in to receive

• Understand how visitors use our website and improve it

Marketing Communications

If you sign up for our emails or promotions, we may send you information about our services, events, and special offers. We do not use your PHI for marketing without your written authorization, except as HIPAA permits.

You can opt out of marketing emails at any time by clicking "unsubscribe" in any email or by contacting us. Opting out of marketing does not affect appointment reminders or other communications related to your care.

Text Messaging (SMS)

If you provide your mobile number and consent to receive text messages, we may send appointment reminders, confirmations, care-related messages, and, if you separately agree, promotional messages. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time or HELP for help.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties, except service providers that help us deliver our messages.

Sharing Your Information With Service Providers

We do not sell your personal information or your PHI.

We work with trusted service providers, such as scheduling, electronic health record, billing, communication, and website platforms, to operate our practice. When a service provider creates, receives, maintains, or transmits PHI on our behalf, we require a Business Associate Agreement that obligates them to protect your information as HIPAA requires.

Cookies and Tracking Technologies

Our website uses cookies and similar technologies to keep the site working, remember your preferences, and understand how visitors use our site. We take steps so that tracking technologies on our website do not disclose PHI to third parties unless HIPAA permits it, such as under a Business Associate Agreement or with your written authorization.

You can disable or delete cookies in your browser settings. Some features of the site may not work properly if cookies are disabled.

Your Rights Regarding Your Health Information

Under HIPAA, you have the right to:

• Access your records: inspect and get a copy of your medical and billing records, including in electronic form. We may charge a reasonable, cost-based fee.

• Request an amendment: ask us to correct information you believe is incorrect or incomplete

• Request an accounting of disclosures: receive a list of certain disclosures of your PHI

• Request restrictions: ask us to limit how we use or share your PHI. If you pay for a service in full out of pocket, you may ask us not to share information about that service with your health plan, and we will honor that request unless the law requires otherwise.

• Request confidential communications: ask us to contact you in a specific way or at a specific location

• Get a copy of our Notice of Privacy Practices: in paper or electronic form, at any time

• Be notified of a breach: receive notice if your unsecured PHI is affected by a breach

• Choose someone to act for you: such as a legal guardian or person with medical power of attorney

To exercise any of these rights, contact our Privacy Officer using the information below.

Data Security

We use administrative, physical, and technical safeguards to protect your information, including limiting access to staff who need it, training our team on privacy practices, and using secure systems for health records. No method of transmission over the internet or electronic storage is completely secure, but we work to protect your information and respond promptly to any security concern.

Breach Notification

If a breach of unsecured PHI occurs, we will notify affected individuals without unreasonable delay and no later than 60 days after discovery, as required by HIPAA. We will also provide any notices required by Florida law.

Florida Privacy Laws

In addition to HIPAA, we comply with applicable Florida laws that protect the confidentiality of patient records and personal information, including Section 456.057 and Section 501.171 of the Florida Statutes. Where Florida law gives you greater privacy protection than HIPAA, we follow Florida law.

Children's Privacy

Our website is not directed to children under 13, and we do not knowingly collect personal information from children online. Care for minors is provided with the involvement and consent of a parent or legal guardian as required by law.

Third-Party Links

Our website may link to third-party sites, including social media platforms. We are not responsible for the privacy practices of those sites. Please do not share health information through public comments or direct messages on social media.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes take effect when posted on this page with a new effective date.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at www.hhs.gov/ocr/complaints or by calling 1-800-368-1019. We will not retaliate against you for filing a complaint.

Contact Us

Privacy Officer: Leah Michel, APRN, FNP-BC

My Skin by Leah Michel

Email: [email protected]

St. Petersburg Office 111 2nd Ave NE, Suite 1406 St. Petersburg, FL 33701 (727) 295-7223

Bradenton Office 4301 32nd St. W., Suite D2 Bradenton, FL 34277 (941) 330-5805