Privacy policy
Effective [effective date]. Last updated October 2026.
Draft for legal review. This text is a detailed working draft, not legal advice. Have counsel licensed in your state review and adapt it, fill every bracketed item, and confirm it matches your Membership Agreement, before publishing.
This policy explains how [Med Spa 9 legal entity, LLC] (“Med Spa 9,” “we,” “us”) collects, uses, shares and protects information through medspa9.com, our membership application, member groups, events and the Shared IQ benchmarking service. It applies to visitors, applicants, members, sponsors and event attendees.
The short version
- We collect what you give us, the business metrics members contribute, and basic site analytics.
- Do not submit patient information. Med Spa 9 is built for business metrics, not protected health information.
- Your raw numbers stay inside your Group. Anything shared beyond it is aggregated and de-identified.
- We do not sell personal information, and sponsors never receive your contact details without your permission.
- Contributed data is never used to train AI models, by us or our technology partner.
1. Information we collect
Information you give us. When you inquire, apply, join, sponsor or register for an event, we collect your first and last name, email, phone number, business name and website, number of locations, your role, the interest you select, your message, and anything else you choose to send.
Membership and qualification information. To confirm fit for a Group, we may ask for revenue range, years in operation, locations, services offered, EMR and practice-management systems, and similar business details.
Contributed operating data. Members contribute standardized business metrics such as revenue, utilization, provider productivity, retention, rebooking, average ticket, staffing and marketing spend (“Member Data”). Member Data describes the business, not individual patients.
Payment information. Payments are handled by our payment processor, [processor name]. We receive billing contact details and the last four digits and expiry of your card, never your full card number.
Event information. Attendance, travel and dietary needs or accessibility requests you choose to share, plus photographs and video taken at events (see section 9).
Automatic information. Device and browser type, IP address, pages viewed, referring site and approximate location, collected through cookies and similar tools (see section 10).
2. Patient information: please don’t send it
Med Spa 9 is designed to receive business-level metrics only. We do not ask for, and you must not submit, protected health information (PHI) as defined by HIPAA, or any information that identifies a patient or client, including names, contact details, dates of service tied to a person, photographs, or treatment records.
Med Spa 9 is not a covered entity or business associate under HIPAA and does not sign business associate agreements. Members are responsible for configuring their EMR exports and integrations so that only de-identified, aggregate business data is shared. If we learn that PHI has been submitted, we will delete it and may suspend the related data connection until it is corrected.
3. How we use information
- To respond to inquiries and evaluate membership and sponsorship applications.
- To form Groups that are a good fit by size, stage and market.
- To run the Shared IQ benchmarking service: normalizing, comparing and reporting Member Data.
- To organize meetings and events, including travel and dietary arrangements.
- To bill membership and sponsorship fees and keep financial records.
- To send service messages, and, where you agree, newsletters and updates. You can unsubscribe at any time.
- To secure our systems, prevent fraud and misuse, and enforce our Terms.
- To meet legal, tax and accounting obligations, and to respond to lawful requests.
- To improve the site and our programs using aggregated, de-identified information.
4. How Member Data is shared
Inside your Group. Members of your Group see benchmark comparisons that include your Member Data. By default, comparisons within a Group are shown without your business name. A Group may agree, in writing, to show named comparisons; you can decline and stay anonymous.
Outside your Group. Your raw Member Data is never shared outside your Group without your written consent. We may publish or share aggregated, de-identified statistics (for example, industry medians in our Journal) only where the figure combines data from at least [five] businesses and no single business contributes more than [25%] of the result, so no individual business can be identified.
Competitive safeguards. To support fair competition, benchmarks focus on historical performance and are reported in aggregated form. We do not collect or circulate members’ future pricing, planned price changes, or individual employee wages. See the Antitrust and Fair Competition section of our Terms.
5. Who else we share information with
We do not sell personal information and do not share it for cross-context behavioral advertising. We share information only as follows:
- NEON, a NeonData Company, which provides the Shared IQ MCP that connects, normalizes and aggregates Member Data on our behalf under a written agreement that limits its use to providing the service.
- Service providers for hosting, email, scheduling, payments, analytics, event venues and travel, each bound to use the information only to serve us.
- Other members, as described in section 4, and your name and business at member meetings.
- Sponsors, only if you opt in, for example by requesting information at a session. Sponsors never receive member lists, contact details or Member Data from us otherwise.
- Professional advisers such as lawyers, accountants and insurers, under confidentiality.
- Legal and safety disclosures when required by law, subpoena or court order, or to protect rights, property or safety.
- Business transfers to a successor in a merger, acquisition or sale of assets, subject to this policy.
6. AI tools and third-party accounts
Shared IQ connects to each member’s own team Claude or ChatGPT account. When you use it, your prompts and results are also handled by that AI provider under your agreement with them. We do not control and are not responsible for that provider’s practices; review its terms and data settings, and use a business or team plan that does not train on your content.
Neither Med Spa 9 nor NEON uses Member Data to train AI models. AI-generated analysis can be wrong; treat it as a starting point and verify important figures.
7. How long we keep information
- Inquiries from people who do not join: up to [24] months after last contact.
- Member account and billing records: for the membership term plus [7] years for tax and legal purposes.
- Member Data: for the membership term. Shared IQ access is revoked on your last day of membership. Within [30] days, Med Spa 9 and NEON delete your raw Member Data and send you a written certificate of deletion. Only de-identified aggregates of [five] or more businesses already produced may remain.
- Event photos and video: as long as they are used in our materials, unless you ask us to remove them going forward.
8. How we protect information
We use administrative, technical and physical safeguards appropriate to the information, including encryption in transit, access controls limited to people who need it, multi-factor authentication on core systems, and vendor security review.
No method of transmission or storage is completely secure. If a breach affects your personal information, we will notify you and regulators as required by law. Keep your own account credentials and AI workspace settings secure; you are responsible for activity under your accounts.
9. Photos and recordings at events
We may photograph or film Med Spa 9 events and use those images in our website, social media and marketing. If you would rather not appear, tell the event lead on the day or email us and we will avoid using identifiable images of you going forward.
Group discussions are confidential. Members, guests and sponsors may not record any session without the written consent of Med Spa 9 and everyone present.
10. Cookies and analytics
We use essential cookies to run the site and analytics cookies, such as [analytics provider], to understand how it is used. We do not use advertising cookies. You can block or delete cookies in your browser settings. We honor Global Privacy Control signals as an opt-out of any sharing that requires one under applicable law.
11. Email and text messages
We send service emails related to your inquiry or membership. Marketing emails include an unsubscribe link and honor opt-outs promptly. If you opt in to text messages, message and data rates may apply; reply STOP to opt out at any time. Consent to texts is never a condition of membership.
12. Your choices and rights
Depending on where you live, you may have the right to know what personal information we hold, get a copy, correct it, delete it, or opt out of certain uses. We extend these choices to everyone where practical, not only where the law requires it.
To make a request, email [legal@medspa9.com]. We will verify your identity before acting and respond within [45] days. You may use an authorized agent, and we will not discriminate against you for exercising your rights. If we deny a request, you may appeal by replying to our decision.
13. Children
Med Spa 9 is for business owners and operators. We do not knowingly collect information from anyone under 18; if we learn we have, we will delete it.
14. Where we operate
Med Spa 9 operates in the United States and stores information in the United States. If you contact us from elsewhere, including Canada, your information will be transferred to and processed in the United States.
15. Changes to this policy
We may update this policy as our programs change. We will post the new version with a new “last updated” date and, for material changes, notify members by email at least [30] days before they take effect.
16. Contact us
[Med Spa 9 legal entity, LLC]
[mailing address]
[legal@medspa9.com]
Or use our contact form.