Privacy Policy

Women's LifeCenter Aesthetic Surgery and Medispa Elysa Fisher, MD, FACS 124 1/2 Skokie Blvd, Wilmette, IL 60091 Phone: 847.256.9400

Effective Date: September 1, 2026 Last Updated: September 1, 2026

1. Introduction and Scope

Women's LifeCenter Aesthetic Surgery and Medispa ("Women's LifeCenter," "the Practice," "we," "us," or "our") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website at elysafisher.com (the "Website"), subscribe to our communications, or otherwise interact with us online.

This Policy applies to the Website and to information collected through it. It does not apply to information collected offline, in person at our office, or through third-party websites, platforms, or applications that we link to but do not control (see Section 9).

By using the Website, you agree to the collection and use of information as described in this Policy. If you do not agree, please do not use the Website.

2. Relationship to Our HIPAA Notice of Privacy Practices

Women's LifeCenter is a health care provider and a "covered entity" under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA"). Health information that we create or receive in connection with your care—your medical history, treatment records, consultation notes, clinical photographs, billing information, and similar records—is "Protected Health Information" ("PHI") and is governed by our Notice of Privacy Practices, not by this Website Privacy Policy.

Our Notice of Privacy Practices describes how we may use and disclose your PHI, your rights with respect to that information, and how to file a complaint. A copy is available at our office and upon request by contacting us using the details in Section 17. Where this Policy and the Notice of Privacy Practices conflict with respect to PHI, the Notice of Privacy Practices controls.

This Website Privacy Policy covers information that is generally not PHI, such as general website usage data, newsletter sign-ups, and inquiries submitted through the Website. Please read Section 7 for important information about how we handle any health-related information that may be submitted online.

3. Information We Collect

3.1 Information You Provide to Us

We collect information that you voluntarily provide when you:

• Subscribe to our newsletter or mailing list. We collect your first name, last name, email address, phone number, and your consent selections.
• Contact us through the Website. If you use a contact form, we collect the information you enter, which may include your name, email address, phone number, and the content of your message.
• Call or email us. We collect the information you share during the communication.
• Schedule an appointment. Appointment booking is handled through a third-party scheduling platform (see Section 9). Information you enter on that platform is collected by that platform and shared with us so we can manage your appointment.

We ask that you not submit detailed medical information, photographs, insurance details, or other sensitive health information through general Website forms, newsletter sign-ups, or standard email. These channels are not designed for secure transmission of PHI. If you need to share health information with us, please call our office so we can direct you to an appropriate secure method.

3.2 Information Collected Automatically

When you visit the Website, we and our service providers automatically collect certain technical information, including:

• IP address (which may be truncated or anonymized by our analytics provider)
• Browser type and version, operating system, and device type
• Screen resolution and language settings
• Referring website or source (for example, a search engine or social media link)
• Pages viewed, links clicked, time spent on pages, and navigation paths within the Website
• Approximate geographic location derived from IP address (city or region level)
• Date and time of your visit

This information is collected through cookies, pixels, tags, and similar technologies as described in Sections 5 and 6.

3.3 Information From Third Parties

We may receive information about you from third-party services we use, such as our appointment scheduling platform, email marketing provider, or social media platforms when you interact with our profiles or content there.

4. How We Use Your Information

We use the information we collect for the following purposes:

• To respond to you. To answer your questions, respond to inquiries, and follow up on requests for information about our services.
• To manage appointments. To schedule, confirm, reschedule, or cancel consultations and treatments.
• To send communications you have requested. To deliver our newsletter, practice news, skincare guidance, educational resources, event announcements, and occasional treatment offers, where you have opted in.
• To operate and improve the Website. To understand how visitors use the Website, identify popular content, diagnose technical problems, and improve design, navigation, and content.
• To measure the effectiveness of our marketing. To understand which channels bring visitors to the Website in aggregate.
• To protect the Website and our Practice. To detect, prevent, and address fraud, security incidents, abuse, and violations of this Policy.
• To comply with legal obligations. To satisfy applicable laws, regulations, legal process, or governmental requests.

We do not use information collected through the Website to make automated decisions that produce legal or similarly significant effects about you.

5. Cookies and Similar Technologies

Cookies are small text files placed on your device when you visit a website. We use the following categories of cookies and similar technologies:

• Strictly necessary cookies. Required for the Website to function, such as cookies that support page loading, security, and form submission. These cannot be disabled through our cookie tools.
• Analytics and performance cookies. Help us understand how visitors interact with the Website by collecting information in aggregate. See Section 6.
• Functional cookies. Remember choices you make, such as language or region preferences, to provide a more personalized experience.
• Third-party embedded content. Certain features, such as embedded maps and social media links, may set cookies from the third party providing that content.

Your choices. Most browsers allow you to refuse or delete cookies through their settings. If you disable cookies, some portions of the Website may not function properly. You can also opt out of Google Analytics specifically as described in Section 6. Where a cookie consent banner is displayed on the Website, you may use it to accept or decline non-essential cookies.

6. Google Analytics and Google Tag Manager

We use Google Analytics, a web analytics service provided by Google LLC ("Google"), which is deployed on the Website through Google Tag Manager. Google Analytics uses cookies and similar identifiers to collect information about how visitors use the Website and to compile reports on website activity.

6.1 What Google Analytics Collects

Google Analytics collects information such as the pages you visit, how long you stay, how you arrived at the Website, the device and browser you use, and your approximate location based on IP address. Google Analytics 4 does not log or store full IP addresses. The data we receive from Google Analytics is aggregated and does not directly identify you by name.

6.2 How We Configure Google Analytics

Because we are a health care provider, we take additional steps in how we deploy analytics on the Website:

• We do not send names, email addresses, phone numbers, form field contents, or any other personally identifiable information to Google Analytics.
• We do not deploy Google Analytics or Google Tag Manager on any patient portal, secure messaging system, or other page that requires you to log in or that is used to transmit PHI.
• We do not use Google Analytics data to build advertising profiles of individual visitors, and we do not link Google Analytics data to your patient record.
• We configure Google Analytics to use the shortest reasonable data retention period for user-level data.

6.3 Google's Use of Data

Google may use the data it collects to contextualize and personalize ads within its own advertising network, subject to Google's own privacy policies. Information collected by Google Analytics is transferred to and stored on Google servers, which may be located outside your state or country. For more information about how Google collects and processes data, please review Google's Privacy Policy at https://policies.google.com/privacy and Google's page "How Google uses information from sites or apps that use our services" at https://policies.google.com/technologies/partner-sites.

6.4 How to Opt Out

You can prevent Google Analytics from collecting information about your visits by:

• Installing the Google Analytics Opt-out Browser Add-on, available at https://tools.google.com/dlpage/gaoptout
• Declining analytics cookies through the cookie consent banner, where available
• Adjusting your browser settings to block third-party cookies
• Enabling the Global Privacy Control signal in a supported browser (see Section 15)

7. HIPAA and Protected Health Information

7.1 The Website Is Not a Secure Channel for PHI

The public-facing pages of this Website, including contact forms, newsletter forms, and the general email address listed on the Website, are not designed or intended to receive PHI. Standard email and web forms may not be encrypted end to end, and information sent through them could be intercepted or misdirected. Please do not include medical history, symptoms, diagnoses, medications, insurance information, or photographs of treatment areas in these channels.

If you choose to include health information in a Website form or in an email to us, you do so at your own risk, and by doing so you acknowledge that you understand the communication may not be secure. Once we receive it, however, we will treat any health information we receive in connection with your care as PHI and safeguard it in accordance with HIPAA and our Notice of Privacy Practices.

7.2 How We Protect PHI We Receive Online

Where any interaction through the Website results in the creation or receipt of PHI (for example, a scheduling request that identifies you and the treatment you are interested in), we:

• Store and process that information only in systems that meet HIPAA security requirements;
• Enter into Business Associate Agreements with vendors that create, receive, maintain, or transmit PHI on our behalf, as required by HIPAA;
• Limit access to PHI to workforce members who need it to perform their duties;
• Do not share PHI with advertising or analytics platforms; and
• Apply the same administrative, physical, and technical safeguards that we apply to PHI collected in our office.

7.3 Online Tracking Technologies and PHI

The U.S. Department of Health and Human Services (HHS) has issued guidance on the use of online tracking technologies by HIPAA-covered entities. Consistent with that guidance and with our own privacy commitments, we do not permit tracking technologies to collect or transmit PHI to third parties that have not signed a Business Associate Agreement with us. We periodically review the tags and scripts deployed on the Website to confirm this remains the case.

7.4 Your HIPAA Rights

Under HIPAA, you have rights with respect to your PHI, including the right to access and obtain a copy of your records, request amendments, request restrictions on certain uses and disclosures, request confidential communications, receive an accounting of certain disclosures, and file a complaint with us or with the HHS Office for Civil Rights without fear of retaliation. These rights are described in full in our Notice of Privacy Practices.

7.5 Testimonials, Reviews, and Photographs

We will never post your name, likeness, before-and-after photographs, or any information that could identify you as a patient on the Website or on social media without your specific, written authorization. If you have provided such an authorization, you may revoke it in writing at any time, although we cannot retract information that has already been published in reliance on your authorization.

8. How We Share Information

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes. We may share information collected through the Website in the following limited circumstances:

• Service providers. With vendors that perform services on our behalf, such as website hosting, appointment scheduling, email delivery, form processing, analytics, and IT support. These providers are permitted to use your information only to perform services for us and are bound by contractual confidentiality obligations. Where a service provider handles PHI, it is also bound by a Business Associate Agreement.
• Legal requirements. When required by law, subpoena, court order, or other legal process, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, or to investigate fraud or security issues.
• Business transfers. In connection with a merger, acquisition, sale of practice assets, or similar transaction, subject to the continued protections of this Policy and applicable law.
• With your consent. For any other purpose disclosed to you at the time of collection, with your permission.

9. Third-Party Services and Links

The Website incorporates or links to services provided by third parties. Each of these operates under its own privacy policy, and we encourage you to review those policies before providing information.

• Appointment scheduling (Mangomint). The "Book Now" and consultation links on the Website direct you to an online booking platform operated by Mangomint. Information you enter there, including your name, contact details, and selected service, is collected by Mangomint on our behalf and is subject to Mangomint's privacy policy and our agreement with Mangomint.
• Google Maps. Our location is displayed using an embedded Google Map. Google may collect information about your interaction with the map, subject to Google's Privacy Policy.
• Social media. The Website links to our profiles on social media platforms. If you follow or interact with us on those platforms, the platform's privacy policy governs that activity. We may see aggregate engagement data provided by the platform.
• Other links. We are not responsible for the privacy practices or content of external websites we link to.

10. Email, Text Messages, and Marketing Communications

When you subscribe to our mailing list, you consent to receive email communications from Women's LifeCenter about practice news, skincare guidance, educational resources, events, and occasional treatment offers. Where you have provided a phone number and given consent, we may also contact you by phone or text message.

• Email. You may unsubscribe at any time by clicking the "unsubscribe" link in any marketing email or by contacting us directly. We will continue to send transactional or service-related messages (such as appointment confirmations) as needed.
• Text messages. If you consent to receive text messages, message and data rates may apply. You may opt out at any time by replying STOP to any message. Consent to receive marketing texts is not a condition of receiving care.
• Marketing and PHI. We do not use PHI for marketing purposes without your written authorization, except as permitted by HIPAA (for example, face-to-face communications or communications about products or services we offer as part of your treatment).

11. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect the information we collect from unauthorized access, use, alteration, or disclosure. These include encryption of data in transit (the Website is served over HTTPS), access controls, and vendor due diligence.

No method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your information, we will notify you and any applicable regulators as required by law, including the HIPAA Breach Notification Rule and the Illinois Personal Information Protection Act where applicable.

12. Data Retention

We retain information collected through the Website only for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law.

• Newsletter subscription data is retained until you unsubscribe or ask us to delete it.
• Contact form inquiries are generally retained for a limited period after we resolve your inquiry.
• Website analytics data is retained according to the settings described in Section 6.
• Information that becomes part of your medical record is retained in accordance with Illinois medical record retention requirements and our record retention policy.

13. Your Privacy Rights and Choices

Depending on where you live, you may have certain rights regarding your personal information, which may include the right to:

• Know what personal information we have collected about you
• Access or obtain a copy of your personal information
• Correct inaccurate personal information
• Request deletion of your personal information
• Opt out of certain uses, such as marketing communications or non-essential cookies
• Not be discriminated against for exercising your privacy rights

To exercise any of these rights, please contact us using the details in Section 17. We may need to verify your identity before responding. Please note that rights relating to PHI are governed by HIPAA and our Notice of Privacy Practices, and certain requests (such as deletion) may be limited by our legal obligation to maintain medical records.

Illinois residents. We do not collect biometric identifiers or biometric information (such as facial geometry scans) through the Website. Any clinical photographs taken as part of your care are maintained as part of your medical record and are governed by our Notice of Privacy Practices and applicable Illinois law.

14. Children's Privacy

The Website is intended for adults. We do not knowingly collect personal information through the Website from children under the age of 13. If you believe a child has provided us with personal information through the Website, please contact us and we will delete it. Information about minor patients collected in the course of care is handled in accordance with HIPAA and applicable Illinois law.

15. Do Not Track and Global Privacy Control

Some browsers offer a "Do Not Track" setting. Because there is no common industry standard for responding to these signals, the Website does not currently respond to Do Not Track signals. However, where technically feasible, we will honor Global Privacy Control (GPC) signals as a request to opt out of non-essential cookies and analytics.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we do, we will revise the "Last Updated" date at the top of this page. Material changes will be highlighted on the Website or communicated to you directly where required by law. Your continued use of the Website after changes are posted constitutes acceptance of the revised Policy.

17. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or would like a copy of our Notice of Privacy Practices, please contact us:

Women's LifeCenter Aesthetic Surgery and Medispa Attn: Privacy Officer 124 1/2 Skokie Blvd Wilmette, IL 60091 Phone: 847.256.9400 Email: [email protected]

You also have the right to file a complaint regarding our handling of PHI with the U.S. Department of Health and Human Services, Office for Civil Rights, at https://www.hhs.gov/ocr/complaints. We will not retaliate against you for filing a complaint.