Privacy policy

This policy covers advancedskinmedspa.com, Dalia (the smart assistant on it), and the emails we send from it. Advanced Skin Medspa, Inc. runs all three, at 17 Old Main St, Suite 1, Fishkill, NY 12524. “We” and “us” mean the practice.

Your treatment records, from consultations and visits at our office, are kept separately and aren’t part of this website. Booking happens on Vagaro, and our shop runs on Shopify. Each has its own privacy policy.

When you send us a message

The contact form asks for your name, a phone number or email, what you’re interested in, and your message. We use it to get back to you. The email that confirms we got it never repeats what you wrote, and the alert our team receives doesn’t include your name, your number or your message.

When you RSVP to an event

We ask for your name, email, phone number (optional), how many people are coming, and any note. We use it to hold your spot, send your confirmation, a reminder the day before and a thank-you after, and to know how many people to expect. If you arrived from a link that names where it was shared, such as an Instagram post or one of our ads, we keep that name too, so we can see which invitations work.

When you join our email list

You can sign up at the bottom of any page, or tick the box on the RSVP and contact forms. We keep your email address, your first name if you give it, and a record of when and where you signed up and the exact words you agreed to. You’ll get a welcome, then events, new treatments and the occasional offer. Every one of those emails has an unsubscribe link.

When you chat with Dalia

Dalia is our smart assistant. She’s not a person, and she doesn’t give medical advice. We keep each conversation (what you write, her replies and the page you started on) so our team can follow up and see where she can do better, and we delete it after 90 days. Your messages are sent to Anthropic, whose Claude model writes her replies.

If you ask her to have someone contact you, she takes your name and a phone number or email, and we keep that request the way we keep a message. To keep the chat from being flooded, we count messages using a scrambled version of your internet address, never the address itself, and we clear the count within two days.

When you simply browse

We don’t use analytics or advertising trackers on this site, apart from Meta’s, below, which only runs if you say yes. Your browser keeps two small notes on your own device, and neither is sent to us: whether you chose the light or dark look, and what you picked in the concern planner on our home page, so it’s there when you come back.

Like every website, our host keeps standard server logs for a short time, such as internet addresses, browser types and the pages requested, to keep the site running and secure.

On our open house page, and only there, we ask whether we may let Meta, the company behind Facebook and Instagram, know what you do on that page, so we can see which of our ads work. Nothing is sent until you answer, and nothing at all if you say no.

If you say yes:

• Meta’s pixel runs on that page. It tells Meta that you visited, and whether you tapped to call us, saved the date, asked for directions or sent an RSVP. Like anything a page loads from another company, it also shares your browser type and internet address with Meta, and Meta sets its own cookie in your browser.
• When you RSVP, our server tells Meta about it too, so it’s counted once and matched to the ad you saw. Your email, phone number and name are scrambled (hashed) before they leave us, and they go with your browser type and the id in Meta’s cookie. We don’t send your internet address, your note, how many guests are coming, or anything about treatments or your health.
• Meta handles this under its own terms and privacy policy. It uses it to report how our ads do and to show them to people more likely to come.

Our treatment pages never load Meta’s pixel. When you follow a link from one of them to another site, such as our booking page on Vagaro, that site only learns that you came from advancedskinmedspa.com, not which treatment you were reading about.

We take a browser’s Global Privacy Control signal as a no. Your answer is saved in your browser for about six months, and you can change it here anytime. Switching to no also removes the cookies Meta set on this site.

These companies run parts of this site for us, and handle your information only to do that:

• Vercel hosts the website and connects Dalia to her model.
• Neon holds our database: messages, RSVPs, the email list and Dalia’s conversations.
• Resend sends our emails. It tells us if an email bounces or is marked as spam, so we stop sending to that address.
• Anthropic’s Claude model writes Dalia’s replies.

These companies are based in the United States. Meta receives information only if you say yes, as described above, and uses it under its own terms.

When you leave our site, the company you go to is in charge of what you give them: Vagaro for booking, Shopify for our shop, Google for maps and directions, and Instagram and Facebook for our pages there.

We may also share information if the law requires it, to protect someone’s safety, or if the practice ever changes hands, in which case this policy keeps applying to what you shared.

• We don’t sell your information, or trade it for anything.
• We don’t send anything about treatments or your health to advertisers.
• We don’t use analytics trackers, and we don’t load Meta’s pixel on treatment pages.
• We don’t store your internet address with your chat.
• We don’t add you to our email list unless you ask.

• Conversations with Dalia: 90 days, then deleted automatically.
• Messages, RSVPs and callback requests: as long as we need them to follow up and keep our records, and deleted when you ask, unless the law requires us to keep them.
• The email list: until you unsubscribe. After that we keep your address marked “unsubscribed” so it isn’t added back by mistake.
• A record of each email we send (the address, the subject and whether it was delivered), kept with our records.
• Your answer about Meta: in your own browser, for about six months.

The site only runs over an encrypted connection, our database provider encrypts what it stores, and messages and RSVPs can only be seen by our team and the agency that builds and runs the site for us, through a password-protected back office.

No system is completely secure, so we collect as little as we can: our forms don’t ask for medical history, and we ask you not to send health details through the site. If a breach ever affects your information, we’ll tell you as New York law requires.

• See, correct or delete: ask us what we have about you, have it corrected, or have it deleted. Call us, write to us, or use the contact form. We’ll answer within 30 days, and we may ask a question or two to confirm it’s you.
• Emails: unsubscribe with the link at the bottom of any email from us, or tell us. You’ll still hear from us about an RSVP or a message you sent.
• Meta: change your answer above, anytime.
• Cookies: you can clear or block cookies in your browser. The site works without them; the open house page will simply ask about Meta again.

Using any of these choices never changes how we treat you.

This website isn’t where your care happens. Please don’t send medical history, photos or other health details through our forms or to Dalia. Call us, or bring them to your consultation. Your treatment records are kept at our office under the rules for medical records, separately from this website.

This site is meant for adults. We don’t knowingly collect information from children under 13. If you believe a child has sent us something, tell us and we’ll delete it.

When we change how we handle information, we update this page and the date at the top.

Call (845) 392-2111, or send us a message through our contact form.