Luxey LLC ("Luxey," "we," "us," or "our") operates the Luxey platform, a practice management and electronic medical records system for medical aesthetics practices, accessible at www.luxey.co (the "Platform"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our Platform.
By accessing or using the Platform, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the Platform.
We may collect the following categories of information:
Account information: Name, email address, phone number, practice name, role, and credentials provided during registration.
Practice data: Appointment records, scheduling data, provider information, inventory records, financial transactions, and operational data entered into the Platform by authorized users.
Protected health information (PHI): Patient demographic information, treatment records, clinical notes, medical history, photographs, and other health-related data entered by licensed providers and practice staff. PHI is handled in accordance with HIPAA requirements and applicable Business Associate Agreements.
Payment information: Credit card details, billing addresses, and transaction records processed through our integrated payment partners. Luxey does not store full credit card numbers on our servers.
Communication data: SMS messages, emails, and other communications sent through the Platform's messaging features, including appointment reminders and marketing communications.
Usage data: IP addresses, browser type, device information, pages visited, features used, and other analytical data collected automatically through cookies and similar technologies.
We use the information we collect to:
How consent is collected: When a patient provides their phone number during online booking, in-person check-in, intake form completion, or account registration, they are presented with a clear disclosure and opt-in checkbox consenting to receive SMS and email communications from the practice through the Luxey platform. Consent is recorded with a timestamp, the method of collection, and the specific categories of messages authorized. Consent is not a condition of purchasing any service.
Types of messages: By opting in, patients may receive:
Message frequency: Message frequency varies by message type. Transactional messages are sent in direct relation to scheduled appointments (typically 2-4 messages per appointment). Marketing messages, when consented to, are limited to no more than 8 messages per month. Message and data rates may apply.
Opt-out: You may opt out of SMS messages at any time by replying STOP to any message. You will receive a single confirmation message and no further messages will be sent. To opt out of email communications, click the unsubscribe link included in every email. Opting out of marketing messages does not affect transactional messages related to active appointments.
Help: For help or questions about SMS messaging, reply HELP to any message or contact us at support@luxey.co.
No sharing of phone numbers: We will never sell, rent, or share patient phone numbers or email addresses with third parties for their own marketing or promotional purposes. Phone numbers are used solely for communications sent on behalf of the practice through the Luxey platform.
Carriers: Supported carriers include all major US carriers. Carriers are not liable for delayed or undelivered messages.
We share information with third-party service providers who perform services on our behalf, including:
All third-party providers are contractually obligated to protect your information and use it only for the purposes for which it was disclosed. Where PHI is involved, Business Associate Agreements are in place as required by HIPAA.
Luxey functions as a Business Associate under HIPAA when processing PHI on behalf of covered entities (medical practices). We maintain:
Practices using the Platform are responsible for obtaining appropriate patient consents and authorizations as required by HIPAA and applicable state laws.
We retain information for as long as necessary to provide the Platform and fulfill the purposes described in this policy. Practice data and PHI are retained in accordance with applicable medical record retention requirements and our agreements with practices. When a practice terminates its account, we will work with the practice to export or securely delete their data in compliance with applicable regulations.
We implement industry-standard security measures including encryption in transit (TLS) and at rest (AES-256), multi-factor authentication, role-based access controls, and regular security assessments. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.
Depending on your jurisdiction, you may have the right to:
For patient rights regarding PHI, including access, amendment, and accounting of disclosures, patients should contact their medical practice directly, as the practice is the covered entity responsible for responding to such requests.
We use cookies and similar technologies to maintain session state, remember preferences, and analyze Platform usage. You may disable cookies through your browser settings, though some features of the Platform may not function properly without them.
The Platform is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child without parental consent, we will take steps to delete that information.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Platform and updating the "Last updated" date. Your continued use of the Platform after changes are posted constitutes acceptance of the revised policy.
If you have questions about this Privacy Policy or our data practices, please contact us: