PRIVACY POLICY

Last Updated: 07/21/26

This Privacy Policy describes how Bonato MD Aesthetics LLC ("Company," "we," or "us") collects, uses, and shares your personal information when you use our website BonatoMD.com (the "Site").

Topics:

• Health information and HIPAA

• Personal information we collect

• How we use your personal information

• How we share your personal information

• How we store your data

• Email and text communications

• Behavioral advertising

• Your data protection rights

• Third party websites

• Changes

• Contact us

HEALTH INFORMATION AND HIPAA

This Privacy Policy governs information collected through the Site. It does not govern protected health information ("PHI") that we receive from you as a patient, which is protected under the Health Insurance Portability and Accountability Act (HIPAA) and governed by our Notice of Privacy Practices, available upon request from our office. Please do not submit medical history, symptoms, photographs, or other health information through general contact forms or unsecured email on this Site. Health information should be shared with us only through your patient portal or during your visit.

WEBSITE CHAT ASSISSTANT

Our website offers an automated chat assistant to answer general questions about our services, policies, and booking. It is an automated tool, not a medical professional, and its responses are informational only — not medical advice. Please do not share personal health information in the chat; anything clinical is best discussed privately at a consultation or by phone. Chat messages are processed in real time by Google Cloud, which hosts the assistant and provides the AI model that generates responses, solely to produce a reply. We do not store chat conversations, use them for marketing, or link them to your identity. For anything you would rather discuss with a person, call or text us at (541) 243-7546.

PERSONAL INFORMATION WE COLLECT

When you visit the Site, we automatically collect certain information about your device, including information about your web browser, IP address, time zone, and some of the cookies that are installed on your device. Additionally, as you browse the Site, we collect information about the individual web pages or products that you view, what websites or search terms referred you to the Site, and information about how you interact with the Site. We refer to this automatically collected information as "Device Information."

We collect Device Information using the following technologies:

• "Cookies" are data files that are placed on your device or computer and often include an anonymous unique identifier. For more information about cookies, and how to disable cookies, visit http://www.allaboutcookies.org.

• "Log files" track actions occurring on the Site, and collect data including your IP address, browser type, Internet service provider, referring/exit pages, and date/time stamps.

• "Web beacons," "tags," and "pixels" are electronic files used to record information about how you browse the Site.

We use Device Information for:

• Functionality: To recognize you on our website and recognize your previously selected preferences, including your preferred language and your location.

• Advertising: To collect information about your visit, the content you viewed, the links you followed, and information about your web browser, device, and IP address. We sometimes share limited aspects of this data with third parties for advertising and analytics purposes.

You can set your browser not to accept cookies, and the website above tells you how to remove cookies from your browser. Some of our website features may not function if you disable cookies. Please note that we do not alter our Site's data collection and use practices when we see a Do Not Track signal from your browser.

We also collect data you provide to us directly. We refer to the data you provide as "Provided Information." We collect and process data you provide when you:

• Register online, request or schedule an appointment, or place an order for any of our products or services

• Contact us through a form on the Site, by email, or by phone

• Voluntarily complete a customer survey or provide feedback

The Provided Information we collect may include:

• Personal identification information (name, email address, phone number, etc.)

• Billing information (billing address, payment information, including credit card numbers, etc.)

When we talk about "Personal Information" in this Privacy Policy, we are talking both about Device Information and Provided Information.

HOW WE USE YOUR PERSONAL INFORMATION

We use the Provided Information that we collect generally to fulfill any orders or appointment requests placed through the Site (including processing your payment information, delivering products or services, and providing you with invoices and/or confirmations). Additionally, we use Provided Information to:

• Communicate with you;

• Screen our orders for potential risk or fraud; and

• When in line with the preferences you have shared with us, provide you with information or advertising relating to our products or services.

We use the Device Information that we collect to help us screen for potential risk and fraud (in particular, your IP address), and more generally to improve and optimize our Site (for example, by generating analytics about how our visitors browse and interact with the Site, and to assess the success of our marketing and advertising campaigns).

HOW WE SHARE YOUR PERSONAL INFORMATION

We share your Personal Information with third-party service providers to help us use your Personal Information as described above. For example, we use Google Analytics to help us understand how our visitors use the Site — you can read more about how Google uses your Personal Information at https://www.google.com/intl/en/policies/privacy/, and you can opt out of Google Analytics at https://tools.google.com/dlpage/gaoptout.

The types of third parties with whom we might share elements of your Personal Information include:

• Payment processors engaged by us to securely store and handle payment information, such as credit or debit card information

• Our practice management and scheduling software providers

• Providers of email, text, and phone communication and management tools

• Providers of security and fraud prevention tools and services

• Providers of data aggregation and analytics software services that allow us to effectively monitor and optimize our Site

• Google Cloud, which hosts our website chat assistant and provides the AI model that powers it

We do not sell your Personal Information.

We may also share your Personal Information to comply with applicable laws and regulations, to respond to a subpoena, search warrant, or other lawful request for information we receive, or to otherwise protect our rights.

HOW WE STORE YOUR DATA

Our Site is hosted by Squarespace, and information submitted through the Site is stored on Squarespace's servers. We use commercially reasonable security measures to protect against unauthorized access to or unauthorized alteration, disclosure, or destruction of information stored on our servers. Of course, no computer network or data transmission on the internet can be guaranteed to be 100% secure, and so you submit your information at your own risk.

We will maintain your Personal Information for our records unless and until you ask us to delete this information, subject to any records we are required by law to retain.

EMAIL AND TEXT COMMUNICATIONS

If you make a purchase on this Site, request an appointment, and/or opt in to receive emails, you agree to receive email communications from us, including but not limited to newsletters, site updates, promotions, and other announcements and correspondence. You have the right at any time to stop us from contacting you for marketing purposes; every marketing email we send includes an unsubscribe link. If you opt to unsubscribe from receiving emails, you understand that you may no longer receive information or updates from this Site, including promotions.

If you provide us with your mobile phone number, you consent to receive calls and text messages from us related to your appointments and inquiries, including appointment confirmations and reminders. Message and data rates may apply, and message frequency varies. You may opt out of text messages at any time by replying STOP. Consent to receive text messages is not a condition of receiving any service.

BEHAVIORAL ADVERTISING

As described above, we use your Personal Information to provide you with targeted advertisements or marketing communications we believe may be of interest to you. For more information about how targeted advertising works, you can visit the Network Advertising Initiative's ("NAI") educational page at http://www.networkadvertising.org/understanding-online-advertising/how-does-it-work.

You can opt out of targeted advertising by using the links below:

• Facebook: https://www.facebook.com/settings/?tab=ads

• Google: https://www.google.com/settings/ads/anonymous

Additionally, you can opt out of some of these services by visiting the Digital Advertising Alliance's opt-out portal at http://optout.aboutads.info/.

YOUR DATA PROTECTION RIGHTS

Depending on where you live, you may have the right to access the personal information we hold about you and to ask that your personal information be corrected, updated, or deleted. Under certain conditions, you may also have the right to restrict or object to our processing of your data, and to request that we transfer your Personal Information to another organization. If you would like to exercise any of these rights, please contact us using the contact information below, and we will respond in accordance with applicable law.

If you are a European resident, we note that we are processing your information to fulfill contracts we might have with you (for example, if you make an order through the Site), or otherwise to pursue our legitimate business interests listed above. Please note that your information will be transferred outside of Europe, including to the United States. European residents also have the right to lodge a complaint with their local data protection regulator.

THIRD PARTY WEBSITES

Our privacy policy applies only to our website. We are not responsible for the data collection, privacy practices, or policies of any third-party site to which we may provide a link or that may link to our site. We encourage you to read the privacy statement and terms of use of other sites.

CHANGES

We may update this privacy policy from time to time to reflect, for example, changes to our practices or for other operational, legal, or regulatory reasons. The date of the last revision will be indicated by the "Last Updated" date at the top of this page.

COMPLAINTS

Please contact us if you have any complaints about how we use your Personal Information so we can resolve the issue whenever possible.

CONTACT US

For more information about our privacy practices, if you have questions, or if you would like to exercise your data protection rights, please do not hesitate to contact us.

Email: hello@bonatomd.com Write to us: 1112 Progress Dr, Suite 103, Medford, OR 97504