Privacy Policy

No medical advice by phone or message

Nothing on this website creates a provider-patient relationship. That relationship begins only when you have completed a consultation with one of our licensed providers and we have accepted you as a patient.

Who we are and what this policy covers

TruFusion Clinics (“TruFusion,” “we,” “us” or “our”) is a medical aesthetics and wellness clinic located at 600 Nut Tree Road, Suite 220, Vacaville, California 95687. This Privacy Policy applies to personal information we collect through:

• our website at trufusionclinics.com and any page that links to this policy (the “Site”);
• the callback request and booking tools on the Site, including the appointment calendar embedded on the Site;
• phone calls, voicemails, text messages and emails exchanged with our team;
• our social media pages and online advertising, to the extent we receive information from them; and
• any other interaction where we reference this policy.

This policy does not replace the Notice of Privacy Practices we give to patients, which governs protected health information under federal law. See Medical information and HIPAA for how the two documents fit together.

By using the Site or contacting us through the channels above, you acknowledge that you have read this policy. If you do not agree with it, please do not use the Site or submit information to us.

Medical information and HIPAA

TruFusion Clinics is a health care provider. Information about your health that we create or receive in the course of providing care to you as a patient is protected health information (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”) and medical information under the California Confidentiality of Medical Information Act (“CMIA”). We use and disclose PHI only as permitted by those laws and as described in our Notice of Privacy Practices, which you receive when you become a patient and can request at any time from our front desk.

Information you submit through the Site before you become a patient, such as a callback request, the treatments you are interested in or a booking inquiry, is generally not PHI when it is collected, but we still treat it as sensitive. Once you become a patient, information that we add to your medical record is governed by HIPAA, the CMIA and our Notice of Privacy Practices. Where those laws provide greater protection than this policy, those laws control.

We do not sell PHI or medical information, and we do not use PHI for marketing without the authorization the law requires.

Information we collect

Information you give us

• Contact details: your first and last name, mobile number, email address and, if you provide it, your mailing address.
• Callback and booking details: the best time to call you, the treatments or goals you are interested in, the type of visit you requested, appointment dates and times, and any notes you add.
• Communications: the content of phone calls, voicemails, text messages, emails and chat messages you exchange with our team, along with the date, time and phone number or email address used.
• Reviews and feedback: comments you leave in surveys, review requests or on third-party review platforms that you choose to share with us.
• Payment-related details: when you place a reservation deposit through our booking tool, the payment is processed by a third-party payment processor. We receive confirmation of the payment and limited details such as the last four digits of the card, but we do not store full card numbers on the Site.

Information we collect automatically

• Device and connection data: IP address, browser type and version, operating system, device type, screen size, language and referring website.
• Usage data: the pages you view, the links and buttons you click, how long you spend on a page, the date and time of your visit, and the search terms you enter in the Site’s search box.
• Cookies and similar technologies: identifiers set by our hosting provider, analytics tools and, where enabled, advertising pixels. See Cookies, analytics and advertising.
• Campaign data: the advertisement, email or link that brought you to the Site, including UTM parameters and click identifiers.

Information we receive from others

• Practice-management and messaging platform: when you request a callback, book online or text us, your details are received through the customer-relationship and scheduling platform we use to run the clinic (currently HighLevel, operating as LeadConnector), which also provides our business phone and text-messaging service.
• Advertising and social platforms: if you reach us through an advertisement or a lead form on a platform such as Meta (Facebook and Instagram) or Google, that platform may send us the information you entered and limited campaign data.
• Review and mapping services: public reviews and ratings you post about us on Google or similar services.

How we use information

We use personal information to:

• respond to your callback request, schedule, confirm, remind you of and reschedule appointments;
• communicate with you about your inquiry, your consultation and, once you are a patient, your care;
• verify your identity when you contact us or make a privacy request;
• process reservation deposits and payments and keep accurate financial records;
• operate, maintain, secure and improve the Site and our services, including understanding which pages and treatments visitors are most interested in;
• send appointment reminders, service updates and, with your consent, promotional messages about treatments and offers;
• measure the performance of our advertising and reach people who may be interested in our services;
• detect, prevent and investigate fraud, abuse, security incidents and violations of our policies;
• comply with legal, regulatory, licensing, insurance and record-keeping obligations; and
• establish, exercise or defend legal claims.

We do not use information collected through the Site to make automated decisions that have legal or similarly significant effects on you.

Text messaging and phone calls

What we send

• Conversational and transactional messages: replies to your callback request, appointment confirmations, reminders, reschedule notices, directions and follow-up after a visit.
• Marketing messages: only if you have separately agreed to receive them, we may send occasional promotions, seasonal offers and news about new treatments.

Your choices

• Reply STOP to any text message to stop receiving texts. You may receive one final message confirming your opt-out. You can also ask us to stop by calling (707) 633-2503 or emailing info@trufusionclinics.com.
• Reply HELP for assistance, or contact us using the details above.
• If you opt out of texts, we may still contact you by phone or email about an appointment you have already booked.

Our commitments

• We will not sell, rent or share your mobile number or your text-messaging opt-in consent with third parties or affiliates for their own marketing purposes.
• Mobile information is shared only with the platform providers that deliver our messages on our behalf, as described in How we share information.
• Text messages are not a secure channel. Please do not send us sensitive health details by text. Our team will not give medical advice by text; see the notice above.
• Calls with our team may be recorded or transcribed for quality, training and record-keeping. Where the law requires it, you will hear a notice at the start of the call.

How we share information

We do not sell personal information, and we do not sell PHI or medical information. We share personal information only in the following circumstances:

• Service providers that work on our behalf. We rely on vendors to host the Site (Vercel), to run our patient relationship, scheduling, phone and text-messaging tools (HighLevel / LeadConnector), to process payments, to deliver fonts and embedded content (Google), and to measure our advertising (Google and Meta, where enabled). These providers may only use your information to provide services to us and are bound by contracts that restrict their use of it. Where a vendor handles PHI, it does so under a HIPAA business associate agreement.
• Our providers and staff. Members of our clinical and administrative team who need the information to respond to you, schedule you or provide care.
• Advertising platforms. If advertising pixels are enabled on the Site, limited browsing data (such as the fact that a page was visited) may be shared with Meta or Google to measure and improve our advertising. You can opt out as described in Cookies, analytics and advertising. We do not send PHI or the contents of your inquiries to advertising platforms.
• Legal and safety reasons. To comply with a subpoena, court order, licensing board request or other legal obligation; to protect the rights, property or safety of TruFusion, our patients, our staff or others; and to enforce our policies.
• Business transfers. If TruFusion is involved in a merger, acquisition, financing or sale of all or part of its business, personal information may be transferred to the successor, who must honor the commitments in this policy. Medical records will be transferred only as the law allows.
• With your direction or consent. For example, when you ask us to send records to another provider or to leave a public review.

Cookies, analytics and advertising

The Site uses cookies and similar technologies (such as pixels, tags and local storage) that are set by us or by the providers listed below.

Your choices

• Browser settings. Most browsers let you block or delete cookies. Blocking strictly necessary cookies may stop the booking calendar from working.
• Global Privacy Control. We honor Global Privacy Control (GPC) signals from your browser as a request to opt out of the sharing of personal information for cross-context behavioral advertising, as required by California law.
• Platform controls. You can adjust ad settings directly with Meta (Ad Preferences) and Google (Ads Settings), and opt out of many ad networks through the Digital Advertising Alliance at optout.aboutads.info.
• Do Not Track. There is no common standard for “Do Not Track” browser signals, so we do not respond to them, but we do respond to GPC signals as described above.

Third-party services and links

The Site embeds an appointment calendar and a callback form provided by HighLevel (LeadConnector). Information you enter in those tools is transmitted to that platform and stored in our account there. The Site also loads fonts from Google Fonts, which means Google receives your IP address when the fonts are requested, and it links to our Google Business Profile so you can read patient reviews.

Links to third-party websites, including Google, Meta and payment providers, are provided for convenience. Those sites have their own privacy policies, and we are not responsible for their content or practices. We encourage you to read their policies before providing any information.

How long we keep information

• Inquiries and callback requests from people who do not become patients are kept for as long as reasonably needed to respond and to run our business, generally no longer than three years from your last contact with us, unless a longer period is required by law or for a legal claim.
• Patient records, including information added to your chart, are kept for the period required by California law and our licensing and insurance obligations, which is at least seven years from the last date of service and longer for minors.
• Text and call logs are retained in our messaging platform for record-keeping and compliance with telephone-consumer-protection rules.
• Website logs and analytics data are retained for the periods set by our hosting and analytics providers, typically between a few weeks and 26 months.

When information is no longer needed, we delete it or de-identify it so it can no longer be linked to you.

How we protect information

We use administrative, technical and physical safeguards designed to protect personal information, including encrypted connections (HTTPS) on the Site, access controls and role-based permissions in our practice-management platform, staff training, and contractual obligations for vendors. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a breach affecting your unencrypted personal or medical information, we will notify you as California and federal law require.

Please help protect your information by not sending health details through unencrypted email or text, and by contacting us right away at info@trufusionclinics.com if you believe your information has been used without authorization.

Children and minors

The Site and our services are intended for adults. We do not knowingly collect personal information online from anyone under 18, and we do not knowingly sell or share the personal information of consumers under 16. Treatments for patients under 18 require the consent and participation of a parent or legal guardian and are arranged only through an in-person consultation. If you believe a minor has provided us with personal information through the Site, contact us and we will delete it.

Your California privacy rights

This section applies to California residents and supplements the rest of this policy. It is provided under the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the “CCPA”). Medical information governed by the CMIA and PHI governed by HIPAA are exempt from the CCPA and are handled under those laws and our Notice of Privacy Practices instead.

Notice at collection

In the preceding twelve months we have collected the following categories of personal information, for the purposes described in How we use information, and retained them for the periods described in How long we keep information.

We use sensitive personal information only to provide the services you request, to schedule and deliver care, and for the other purposes permitted by the CCPA. We do not use it to infer characteristics about you for advertising.

Your rights

• Right to know. You may request the categories and specific pieces of personal information we have collected about you, the sources, our purposes, and the categories of third parties with whom we have shared it.
• Right to delete. You may request that we delete personal information we collected from you, subject to exceptions, for example where we must keep it to complete a transaction, comply with a legal obligation or maintain medical records.
• Right to correct. You may request that we correct inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell personal information. To the extent advertising pixels on the Site constitute “sharing” for cross-context behavioral advertising, you may opt out by enabling Global Privacy Control in your browser or by contacting us as described below.
• Right to limit use of sensitive personal information. We use sensitive personal information only for the limited purposes the law allows, so no additional limitation is available, but you may contact us with any concerns.
• Right to non-discrimination. We will not deny you services, charge you a different price or provide a different level of service because you exercised your privacy rights.

We do not offer financial incentives in exchange for personal information.

Shine the Light

California Civil Code section 1798.83 lets California residents ask for a list of third parties to whom we disclosed personal information for their own direct marketing during the previous year. We do not disclose personal information to third parties for their own direct marketing purposes.

Residents of other states

If you live in a state with a comprehensive privacy law, such as Colorado, Connecticut, Oregon, Texas, Utah or Virginia, you may have similar rights to access, correct, delete and port your personal information and to opt out of targeted advertising or the sale of personal information. We extend the rights described above to all visitors as a courtesy, subject to the exceptions in the applicable law. You may exercise them using the process below, and you may appeal a decision by replying to our response and asking for a review.

How to make a privacy request

You, or an authorized agent acting on your behalf, may submit a request by:

• emailing info@trufusionclinics.com with the subject line “Privacy request”;
• calling (707) 633-2503; or
• writing to TruFusion Clinics, Attn: Privacy, 600 Nut Tree Road, Suite 220, Vacaville, CA 95687.

To protect your information we will verify your identity before acting, usually by matching the name, phone number and email address you provide against our records and, for requests about medical records, by following the identity checks required for health information. An authorized agent must provide written permission signed by you, and we may ask you to confirm the request directly. We will respond within 45 days, and we will tell you if we need up to 45 more days. Requests for medical records follow the timelines in our Notice of Privacy Practices.

Changes to this policy

We may update this policy as our practices, technology or the law change. When we do, we will post the revised policy on this page and update the “last updated” date at the top. If a change materially reduces your rights, we will provide additional notice, such as a notice on the Site or a message to the contact details we hold for you. Your continued use of the Site after a change means you accept the updated policy.

How to contact us

Questions about this policy, our privacy practices or your medical records can be directed to:

If you believe your privacy rights under HIPAA have been violated, you may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.