Privacy Policy

This policy describes how Ora Medical Spa, 4400 Bayou Blvd, Pensacola, FL 32503, handles information collected through this website.

It covers the cookie notice, the enquiry forms, and the data our servers record when you use the site. It does not cover what happens inside the studio — information you share at a consultation is handled separately, in the clinic’s own records, and is described under “Health information” below.

The first time you visit, a small notice asks whether you accept cookies. Accept and decline are both real answers, and we record either one — we keep a record of a declined choice so we can honor it and so we are not asking you the same question on every visit.

When you answer, we store:

• Your answer — accepted or declined — and the version of the notice you answered.
• A random visitor ID, generated on our server the first time you answer and then returned to your browser as a cookie. It is a string of characters and it is not linked to your name.
• The page you were on when you answered, and the page you arrived from if your browser sent one.
• Your browser's user agent string and preferred language.
• A coarse country, taken from the network request. Not a street, not a city — a country.
• A one-way salted hash of your IP address. We run the address through a cryptographic hash with a secret salt and keep only the result. The address itself is never written down, and the hash cannot be turned back into it.
• The date and time you answered.

That is the whole record. There is no advertising network, no cross-site tracking pixel, and no profile built from your browsing elsewhere — the one third-party script this site can load is the Cherry financing calculator, described under “Financing on the payment plans page” below.

• ora_consent — holds your answer and the version of the notice, so you are not asked again. Readable by the page.
• ora_vid — holds the random visitor ID described above. It is set server-side and cannot be read by scripts in the page.

Both last for one year, then expire. You can delete them at any time in your browser settings; the next visit will simply ask you again. If we reword the notice we treat your old answer as out of date and ask once more.

Those two are the only cookies this site sets itself. The Cherry financing widget on the payment plans page may set its own once it loads, and it only loads if you accepted the notice.

If you fill in a form on this site, we store what you typed, together with a few technical details:

• Your name, email address and phone number.
• How you would prefer to be contacted — email, phone or text.
• The treatment you are interested in, and the message you wrote.
• Whether you ticked the box to hear about offers.
• Which page you sent the enquiry from, and the date and time.
• Your browser's user agent string, and the same one-way salted hash of your IP address — never the address itself.

A copy is emailed to the studio so a person can reply to you, using Resend as the mail provider. Please do not include detailed medical history in a website form — bring it to your consultation instead, where it is handled properly.

Cookie decisions and enquiries are stored in a self-hosted Appwrite database operated for Ora. It is not a shared marketing platform and the records are not sold, rented or traded.

The site itself runs on hosting and email infrastructure engaged to operate it. Those providers process data on our instructions and for no purpose of their own.

We use this information for three things, and nothing else:

• To answer your enquiry and arrange your appointment.
• To honor and evidence your cookie choice, and to understand in aggregate which treatments people are looking at so we can improve the site.
• If — and only if — you opted in, to send occasional offers and studio news.

The basis for all of it is your consent: you choose to answer the cookie notice, you choose to send a form, and you choose whether to tick the marketing box. You can withdraw any of those choices at any time, and withdrawing one does not affect the others.

Anything you discuss at a consultation — your medical history, medications, skin assessment, treatment notes, before and after photographs — is clinical information. It is kept in the clinic’s own records, separately from this website, and is not stored in the website database.

Clinical photographs are only taken with your consent, and are only shared publicly with your separate written permission. You can withdraw that permission at any time by writing to us.

Our booking pages are hosted by Acuity Scheduling, a third-party service. When you book online you leave this site and the details you enter there — your name, contact details, the appointment you chose and any payment information — are collected and held by Acuity on our behalf, under Acuity’s own privacy policy and terms.

We receive the appointment details back so we can prepare for your visit. We never see your full card number.

Our payment plans page can show a financing calculator provided by Cherry. It is a third-party script loaded from files.withcherry.com, and it only loads if you accepted the cookie notice — decline the notice, or ignore it, and the script never runs.

If you do use the calculator, anything you enter goes to Cherry under Cherry’s own privacy policy and terms, not to us. Applying with Cherry is a soft credit check, and it happens on Cherry’s side. Loading the widget also fetches a font file from Google Fonts, starts an analytics service — Segment — on Cherry’s behalf, which sets its own storage in your browser, and lets the widget exchange data with Cherry’s own servers. None of that happens unless you accepted the notice.

Ora accepts CareCredit as well. That is arranged with CareCredit directly, and this website sends them nothing.

Nobody, beyond the service providers that run the site, the booking system and the financing calculator, and only to the extent they need it to do that job. We do not sell your information. We do not share it with advertisers or data brokers.

The only other circumstance is a legal one: if we are required to disclose something by law, by a court, or to protect someone’s safety.

• Cookie records: kept while the choice is current, and for a reasonable period afterwards as evidence of the choice.
• Enquiries: kept while we are dealing with them and for as long as you remain a client, so we have context next time you write.
• Marketing contacts: kept until you unsubscribe or ask to be removed.
• Clinical records: kept for the period Florida law requires for a healthcare record.

Once a record no longer serves any of those purposes, it is deleted.

Email Info@oramedicalspa.com or call 850-501-3350 and you can ask us to:

• Tell you what we hold about you.
• Correct anything that is wrong.
• Delete what we hold, where we are not required to keep it.
• Stop sending you marketing email — every marketing message also carries an unsubscribe link, and one click is enough.
• Change or withdraw your cookie answer. Clearing the cookies in your browser and reloading the page does this immediately, and the notice will ask again.

We will ask a question or two to check it is really you, then act on the request. There is no charge.

The site is served over an encrypted connection. Database access is restricted to the people and systems that need it. IP addresses are hashed before storage rather than kept, and the visitor ID cookie is set so that scripts in the page cannot read it.

No system is perfect, and we will not pretend otherwise. If a breach ever affected your information we would tell you promptly and tell you what to do about it.

Our services are for adults aged 18 and over. This site is not directed at children, and we do not knowingly collect information from anyone under 18. If you believe a child has sent us information, write to us and we will delete it.

This policy is written to respect the principles behind HIPAA, the GDPR and the CCPA — collect only what is needed, say plainly what it is for, keep it no longer than necessary, and let people see, correct and delete it.

Writing to those principles is not the same as a formal compliance certification, and we do not claim one here. Whether and how each of those regimes applies to the practice is a question for the practice’s own legal advisers.

If this policy changes we will update the date at the top of the page. If the change is significant, the cookie notice will ask you again.

Questions go to Info@oramedicalspa.com, 850-501-3350, or 4400 Bayou Blvd, Pensacola, FL 32503. See also our terms and conditions and cancellation policy.