Privacy Policy

Effective August 12, 2026. Last updated August 12, 2026.

Two different sets of rules protect two different things.

Your medical record is protected by federal and California health privacy law. How we use and disclose your health information as your dermatology practice is described in our Notice of Privacy Practices, which you also receive at your first visit and can request from either office. Nothing on this page changes it or replaces it.

This policy covers the website. What happens when you visit coastaldermaesthetics.com, fill out a form, or request an appointment.

Our online forms are built to schedule and route, not to collect your medical history. They ask who you are, how to reach you, which office you want, and the general reason for your visit. That is deliberate, and the website is built to hold as little as possible.

If you need to discuss symptoms, medications, results, or anything else about your care, call the office. Email and web forms are not the right channel for it, and we would rather take it on the phone.

This is the part most privacy policies get backwards, so we will be specific.

When you arrive, no analytics or advertising script has loaded. Not Google Analytics, not Google Tag Manager, not the Meta pixel, not LinkedIn, not TikTok. Nothing. The banner asks first, and your answer is what loads them.

If you decline, they are not loaded, and any that were are removed. Declining is not a preference we record and ignore. It is the switch.

If your browser sends a Global Privacy Control signal, we treat that as your answer. Global Privacy Control is a setting some browsers and extensions send automatically to tell every website you do not want to be tracked. When we see it and you have not already chosen for yourself, we apply a full decline, we do not show you the banner, and we tell you quietly that we honored it. The settings button stays available if you want to change it.

We do not act on the older “do not track” browser header. It was never finished as a standard and almost nothing honors it. Global Privacy Control is the signal that actually works, and we honor that one.

Category	What it is	Default
Necessary	Page loading, form submission, security, and remembering your cookie choice	Always on. The site cannot work without it
Functional	Additional site tools we may run	Off until you allow it
Google Analytics	Which pages people read, how they found us, where they leave	Off until you allow it
Google Tag Manager	The container we use to manage the tags above	Off until you allow it
Advertising	Meta, LinkedIn, and TikTok advertising measurement	Off until you allow it

Your choice is stored on your own device, not in an account. You can change it at any time using the cookie settings button, which stays on screen after you answer. We ask again periodically so the choice stays current, and clearing your browser storage clears it.

When you fill out a form. Your name, email address, phone number, which office you want, and the choices you make in the form. What happens to each of those is set out in the next section.

When you allow analytics. Pages viewed, how you arrived, roughly where you are, and technical details about your browser and device. We see patterns across visitors, not a file on you.

When you decline analytics. Our server records that a page was served, as every web server does. Our own form logging records that a submission happened, with the visit’s IP address and browser identifier stored only as one-way hashes that cannot be turned back into the originals.

We do not ask for, and you should not send, Social Security numbers, insurance identification numbers, or payment card details through this website.

This is worth explaining properly, because it is unusual and it is in your favor.

Your submission never travels in the web address. It is posted directly to our server over an encrypted connection. Nothing about you ends up in a URL, in a link you might share, or in the referrer information a browser passes to other sites.

We split what we keep into two records with two different lifetimes.

The first is a receipt. It records that a form was submitted, which form, which page it came from, roughly when, and whether the notification reached us. It carries no name, no email address, and no phone number. We keep it so we can tell whether the website is working.

The second is the part that identifies you: your name, email address, and phone number. It exists for one reason, which is that if the notification email fails we do not lose your request. It is encrypted while it is stored, and it is deleted after 30 days, automatically, on a schedule that is checked continuously so it cannot quietly stop running.

After those 30 days, what remains cannot be connected back to you.

We only keep the fields we have declared. If a form collects something that is not on the list of things we store, it is used to answer you and then dropped rather than saved. The site does not accumulate whatever happens to be typed into it.

The internal reference we use for a submission never leaves our server. It is not in the email we receive, not in the subject line, not on the confirmation you see, and not on any page.

If you get an acknowledgement email from us, it will not repeat what you wrote. It confirms we received your message and nothing more, because an email that echoes your details back is an email that can reach the wrong address.

Anything that becomes part of your medical record is kept under the rules for medical records, not under this policy.

• To answer you and to schedule your appointment
• To send appointment reminders
• To operate, secure, and improve the website
• To understand which pages are useful, where you have allowed analytics
• To tell you about services, events, and promotions where you asked us to
• To meet our legal and professional obligations

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law.

We share information with companies that provide services on our behalf, and only so they can provide them: our website host, our email delivery provider, our practice management and scheduling systems, and the analytics and advertising platforms you have allowed.

We also disclose information where the law requires it, where it is necessary to protect someone’s safety, or in connection with a sale or transfer of the practice.

Where a page includes something hosted elsewhere, such as a map or a video, nothing is requested from that company until you choose to load it. Until then the other company does not know you were on the page.

Links to our gift card store and to manufacturers’ websites take you off our site entirely. Once you follow one, this policy stops applying and theirs begins.

• Tracking. Change your answer any time with the cookie settings button, or set Global Privacy Control in your browser and we will follow it.
• Email. Every marketing email has an unsubscribe link. Appointment reminders and messages

about your care are not marketing and continue regardless.

• Your information. Ask us what we hold, ask us to correct it, or ask us to delete it. Because

of the 30-day deletion above, we may already hold nothing that identifies you.

• Your medical record. Access, amendment, restriction, and accounting of disclosures are

covered by our Notice of Privacy Practices, not by this page.

California residents have specific rights over personal information under state privacy law. Medical information held by a health care provider is governed by health privacy law instead. If you are unsure which covers what you are asking about, ask us and we will tell you.

This website is not directed at children under 13 and we do not knowingly collect information from them through it. We do treat children as patients, and information about a minor patient is part of that patient’s medical record, governed by health privacy law and by a parent or guardian’s consent.

If you believe a child has submitted information through this website, contact us and we will remove it.

The site is served over an encrypted connection. Form submissions are checked for tampering and rate limited before they are accepted. The identifying part of a submission is encrypted where it is stored. Our own logs record that something happened without recording what you wrote.

No website is perfectly secure, which is the reason for the rule near the top of this page. Do not send medical detail through a web form.

We update this page when our practices change. The effective date at the top tells you which version you are reading.

Coastal Dermatology + Aesthetics
892 Aerovista Place, Suite 120
San Luis Obispo, CA 93401
(805) 544-5567

525 E. Plaza Drive, Suite 200
Santa Maria, CA 93454

privacy@coastaldermaesthetics.com

Phone hours are Monday through Friday, 9:00 AM to 4:00 PM, closed for lunch.