Privacy Policy

Eureka Body Care & Spa

Effective Date: November 4, 2026

1. Introduction

Eureka Body Care & Spa (“Eureka,” “we,” “our,” or “us”) respects the privacy of our clients and website visitors and is committed to handling personal information responsibly.

This Privacy Policy explains how we collect, use, store, protect, disclose, and otherwise process information obtained through our website, appointment booking systems, consultations, purchases, communications, and services.

Our website is located at:

Eureka Body Care and Spa – NYC Body Contouring Center

This policy applies to individuals who visit our website, inquire about services, schedule appointments, purchase products or packages, subscribe to communications, or otherwise interact with our business.

Certain health-related information may be subject to additional federal and New York privacy requirements. Where applicable, a separate Notice of Privacy Practices will govern protected health information.

We encourage you to review this policy to understand our privacy practices and available choices.

2. Information We Collect

Depending on your interactions with Eureka, we may collect the following categories of information.

Personal and Contact Information

Full name and preferred name.
Telephone number and email address.
Mailing and billing address.
Date of birth or age, when necessary.
Appointment and communication preferences.
Emergency contact information, when appropriate.

Appointment and Service Information

Appointment dates, times, and locations.
Requested and completed services.
Treatment preferences and consultation notes.
Service packages, memberships, and gift certificate information.
Appointment cancellations and rescheduling history.
Customer service inquiries and feedback.

Health and Treatment Information

Certain services may require the collection of health-related information to evaluate treatment suitability and provide appropriate care.

This information may include:

Medical history and relevant health conditions.
Allergies and medication information.
Previous cosmetic procedures or treatments.
Skin conditions and treatment concerns.
Pregnancy or breastfeeding information when relevant.
Contraindications and treatment eligibility information.
Signed consultation and informed consent forms.
Treatment records, progress notes, and photographs.
Information concerning adverse reactions or complications.

Health information will be collected and used only as permitted by applicable law and professional requirements.

Payment and Transaction Information

When you purchase services or products, we may collect transaction details, billing information, purchase history, payment status, and refund information.

Payments may be processed through authorized third-party payment providers, including Square or other platforms used by Eureka.

Payment card details may be collected and processed directly by those providers. Eureka’s access to complete card information depends on the payment system and applicable security controls.

Website and Technical Information

When you visit our website, certain information may be collected automatically, including:

IP address.
Browser and device information.
Operating system.
Website pages visited.
Referring websites.
Approximate geographic location derived from technical information.
Website interaction and usage information.
Cookies and similar identifiers.

We may use this information to operate, secure, maintain, and improve our website.

3. How Information Is Collected

We may obtain information directly from you when you:

Complete an appointment or consultation form.
Schedule or modify a booking.
Purchase a treatment, package, membership, or product.
Contact us by telephone, email, text, or website form.
Subscribe to newsletters or promotions.
Participate in a referral program.
Submit a review, testimonial, or feedback.
Provide information during an in-person visit.
Sign treatment or medical consent documentation.

We may also receive information from authorized booking providers, payment processors, website service providers, and other third parties where permitted by law.

Information may be collected automatically through website functionality, security systems, cookies, and analytics technologies.

4. How We Use Personal Information

Eureka may process personal information for legitimate business, operational, contractual, safety, and legal purposes.

These purposes may include:

Scheduling, confirming, and managing appointments.
Providing requested treatments and services.
Reviewing treatment suitability and relevant health information.
Maintaining appropriate client and treatment records.
Processing purchases, payments, credits, and refunds.
Responding to questions and customer service requests.
Sending appointment confirmations and reminders.
Providing necessary pre-treatment and aftercare information.
Managing memberships and prepaid service packages.
Improving website functionality and customer experience.
Evaluating business operations and service demand.
Preventing fraud and unauthorized activity.
Maintaining the security of our systems and premises.
Complying with legal, professional, and regulatory requirements.
Sending marketing communications where permitted by law and applicable consent.

We do not use personal information for purposes prohibited by applicable law.

5. Medical Records and Sensitive Health Information

Eureka recognizes that medical and treatment-related information may be particularly sensitive.

Such information may be collected when necessary for treatment screening, clinical evaluation, informed consent, service documentation, safety, and follow-up.

Access to sensitive information should be restricted to personnel and authorized professionals who require it for legitimate duties.

Where the Health Insurance Portability and Accountability Act (HIPAA) applies, protected health information will be used and disclosed in accordance with applicable HIPAA requirements and the relevant Notice of Privacy Practices.

Other health-related information may be protected under New York law and additional federal privacy requirements.

We will obtain authorization for uses or disclosures when required by law.

We do not treat a general website privacy acknowledgment as authorization for unrelated uses of protected health information.

6. Appointment Booking and Scheduling Platforms

Eureka may use third-party scheduling platforms to manage appointments, client profiles, reminders, and purchases.

These providers may process information necessary to deliver their services, including contact details, appointment information, transaction records, and other information submitted through the booking process.

Third-party platforms may maintain their own privacy policies and security practices.

Where required, Eureka will establish appropriate contractual protections governing the handling of personal or protected health information.

Clients should review the privacy notices presented by the relevant booking platform.

7. Payment Processing and Financial Information

Eureka may use Square and other authorized payment processors to facilitate transactions.

Payment providers may collect and process payment card information, billing details, transaction identifiers, and fraud-prevention information.

Payment processing is subject to the applicable provider’s terms, privacy practices, and security standards.

Eureka takes reasonable steps to limit access to payment information and uses transaction records for accounting, customer service, refunds, fraud prevention, and legal compliance.

We do not intentionally collect complete payment card information through ordinary email or public social media messages.

8. Cookies and Similar Technologies

Our website may use cookies, pixels, and similar technologies to support website functionality, understand visitor activity, remember preferences, and evaluate performance.

These technologies may be used for:

Essential website functionality.
Security and fraud prevention.
Website traffic measurement.
Performance improvements.
Remembering visitor preferences.
Advertising measurement and campaign analysis.

Some technologies may be provided by third-party services.

Visitors can manage certain cookies through browser settings or available website privacy controls.

Disabling cookies may affect the functionality of some website features.

Where required by law, we will provide applicable notice and choices before using nonessential tracking technologies.

9. Website Analytics and Advertising

Eureka may use analytics and advertising services, such as Google Analytics, Google Ads, Meta advertising technologies, or comparable providers, where implemented.

These tools may help us understand website usage, measure advertising effectiveness, and improve our online communications.

Depending on the technologies used, providers may receive technical identifiers and information about website interactions.

Eureka will not intentionally transmit protected health information or sensitive treatment details to advertising or analytics providers unless the disclosure is legally permitted and all required safeguards and authorizations are in place.

We recognize that information concerning visits to treatment-related pages, appointment activity, or medical services may require additional privacy protections.

Any advertising and tracking technologies must be configured in accordance with applicable privacy requirements.

10. Email Marketing and Newsletters

Clients and website visitors may have the opportunity to subscribe to Eureka’s promotional emails, newsletters, treatment announcements, and special offers.

Marketing emails will be sent in accordance with applicable law.

Where required, recipients will be provided with a clear method to unsubscribe.

Unsubscribing from marketing emails does not necessarily prevent essential service-related communications, such as appointment confirmations, payment receipts, or legally required notices.

Eureka does not condition access to medical treatment on consent to receive promotional emails.

11. Text Messages and SMS Communications

Eureka may use text messaging for appointment reminders, scheduling updates, customer service, and promotional offers.

Marketing text messages will be sent only when the required consent has been obtained.

Consent to receive marketing text messages is not a condition of purchasing services.

Message frequency may vary, and message and data rates may apply.

Recipients may generally opt out of marketing text messages by replying STOP, where supported by the messaging provider.

For assistance, clients may contact Eureka directly.

Service-related communications will be handled in accordance with applicable law and communication preferences.

Eureka will not assume that providing a telephone number automatically authorizes unrelated promotional text messages.

12. Social Media and Online Interactions

Eureka may maintain accounts on social media platforms, including Instagram, Facebook, and other services.

When you interact with these accounts, information may be processed by the relevant platform according to its own privacy policy.

Public comments, reviews, and social media posts may be visible to others.

Clients should avoid posting sensitive personal or medical information in public comments.

Eureka will take appropriate care when responding to publicly visible communications and will not intentionally disclose confidential treatment information without appropriate legal authorization.

13. Treatment Photographs and Video Recordings

Certain services may involve photographs or videos used for treatment planning, documentation, progress evaluation, or other appropriate purposes.

Treatment photographs may contain identifiable or sensitive information.

Eureka will obtain appropriate authorization before using identifiable treatment photographs or health-related images for advertising, testimonials, social media, or other promotional purposes when required by law.

Consent to clinical photography does not automatically authorize marketing use.

Clients may decline optional promotional photography without affecting access to services.

Withdrawal of authorization will be handled in accordance with applicable law and the terms of the authorization.

14. Client Reviews and Testimonials

Clients may choose to submit reviews or testimonials through our website, third-party review platforms, or social media.

Information submitted publicly may be accessible to other users.

Eureka may use testimonials in promotional materials where permitted by law and with any required authorization.

We will not intentionally disclose confidential medical information in responses to public reviews.

Client testimonials do not authorize unrestricted use of personal information.

15. Sharing Information With Service Providers

Eureka may disclose information to third parties when reasonably necessary for authorized business operations or as otherwise permitted by law.

Recipients may include:

Appointment scheduling providers.
Payment processors and financial service providers.
Website hosting and technical support providers.
Email and text messaging platforms.
Accounting and bookkeeping professionals.
Legal and compliance advisors.
Authorized healthcare professionals.
Security and fraud-prevention providers.
Analytics and advertising vendors, subject to applicable restrictions.
Government agencies or regulators where disclosure is legally required.

Third-party access should be limited to information reasonably necessary for the relevant purpose.

Where required, service providers will be subject to appropriate confidentiality, security, data processing, or business associate agreements.

16. Sale, Sharing, and Commercial Use of Information

Eureka does not intend to sell identifiable medical records or protected health information for unrelated commercial purposes.

Certain online advertising technologies may constitute a sale, sharing, or targeted advertising activity under applicable privacy laws, even when no money is exchanged for personal information.

Where applicable law requires disclosure, consent, or an opt-out mechanism for these practices, Eureka will provide the necessary information and controls.

We will not use or disclose protected health information for marketing in violation of applicable healthcare privacy laws.

Any statements concerning the sale or sharing of personal information must accurately reflect the technologies and business practices in use.

17. Legal Disclosures and Compliance

Eureka may disclose personal information when required or permitted by applicable law.

Examples may include responding to valid legal process, complying with regulatory requirements, protecting against fraud, or addressing legitimate safety concerns.

Requests involving medical records or other protected information will be reviewed under the applicable confidentiality and disclosure rules.

We will not interpret a general legal request as authorization to disclose information beyond what the law permits or requires.

18. Business Transfers and Organizational Changes

If Eureka undergoes a merger, acquisition, reorganization, sale, or other business transition, certain business information may be transferred as permitted by law.

Any transfer involving personal or health-related information will be subject to applicable privacy, confidentiality, and professional requirements.

Where required, affected individuals will receive appropriate notice or be given relevant privacy choices.

19. Data Retention

Eureka retains personal information for periods reasonably necessary to provide services, maintain business records, comply with legal obligations, resolve disputes, and fulfill other legitimate purposes.

Different categories of information may be subject to different retention requirements.

Medical and treatment records may need to be retained for specific periods under applicable New York professional rules and other laws.

Payment and transaction records may be retained for accounting, tax, and regulatory purposes.

Information that is no longer required will be deleted, securely destroyed, or de-identified when appropriate and consistent with applicable obligations.

Requests for deletion may be subject to legal recordkeeping requirements.

20. Data Security

Eureka recognizes the importance of protecting personal information against unauthorized access, misuse, loss, alteration, and disclosure.

We maintain or require appropriate administrative, technical, and physical safeguards based on the sensitivity of information and applicable legal requirements.

These measures may include access restrictions, secure service providers, staff confidentiality practices, and appropriate record-management procedures.

No electronic system, website, or method of transmission can be guaranteed to be completely secure.

Eureka will respond to suspected or confirmed data security incidents in accordance with applicable law, including any required investigation, mitigation, and notification obligations.

21. Your Privacy Rights and Choices

Depending on the information involved and applicable law, individuals may have rights to:

Request access to certain personal information.
Request correction of inaccurate information.
Update contact details and communication preferences.
Request deletion where legally permitted.
Withdraw certain previously provided consents.
Opt out of promotional emails or text messages.
Request information about applicable privacy practices.
Exercise rights concerning protected health information.

Certain requests may be restricted by legal retention requirements, healthcare privacy rules, or other lawful exceptions.

Eureka may need to verify identity or authority before processing a privacy request.

We will not unlawfully discriminate against individuals for exercising applicable privacy rights.

22. Medical Records Access and Corrections

Where applicable, clients may request access to their medical records or seek amendments to information maintained about them.

Requests will be handled under applicable federal and New York laws.

Certain records may be subject to specific access procedures, verification requirements, permitted fees, and response deadlines.

A request to delete a medical record may not be granted when retention is legally required.

Clients may contact Eureka to obtain information about the appropriate procedure for submitting a records request.

23. Children’s Privacy and Minors

Our website is intended primarily for adults seeking information about aesthetic, skincare, and wellness services.

Eureka does not knowingly collect personal information directly from children under 13 through its general website in violation of applicable law.

Certain services may be available to minors only when legally permitted and with any required parent or guardian consent.

Information concerning minors will be handled in accordance with applicable privacy, consent, confidentiality, and professional requirements.

Parents or guardians who believe information has been collected improperly may contact Eureka for assistance.

24. Third-Party Links and External Services

Our website may link to external websites, payment services, social media platforms, and booking providers.

These external services may have privacy practices different from ours.

Eureka does not control all aspects of independently operated websites.

Visitors are encouraged to review third-party privacy notices before providing personal or payment information.

Nothing in this section excludes responsibilities imposed on Eureka by applicable law.

25. International Website Visitors

Our business is located in New York, United States.

Information submitted through our website may be processed or stored in the United States or other locations where authorized service providers operate.

Privacy protections may differ between jurisdictions.

Where applicable international data protection laws apply to particular processing activities, Eureka will comply with the relevant requirements.

This policy does not represent that every international privacy framework applies to our operations.

26. Data Breaches and Unauthorized Access

Eureka takes the protection of client information seriously.

If personal information is involved in a security incident, we will evaluate the circumstances, take appropriate remedial action, and provide notifications where required by applicable law.

Notification requirements may vary depending on the nature of the information, the entities involved, and the applicable federal or state rules.

Eureka will not use this Privacy Policy to eliminate any legally required breach notification or security obligations.

27. Automated Communications and Technology

Eureka may use automated systems to support appointment scheduling, reminders, customer service, website functionality, and marketing operations.

Any automated processing of personal information will be subject to applicable privacy, consumer protection, and communications laws.

We will not treat the use of automated technology as permission to disclose protected medical information or send promotional messages without required consent.

28. Changes to This Privacy Policy

Eureka may revise this Privacy Policy to reflect changes in services, website functionality, technology, business practices, or legal requirements.

The updated policy will be published on our website with a revised effective date.

Where required, material changes will be communicated through appropriate notices or additional consent procedures.

Changes will not retroactively eliminate legal rights or authorize uses of information that require separate consent.

29. Contact Information and Privacy Requests

For questions about this Privacy Policy, personal information, privacy rights, or requests concerning your records, please contact:

Eureka Body Care & Spa

303 Fifth Avenue, 4th Floor, Suite 407
New York, NY 10016

Phone: (212) 858-0706
Text: (833) 255-9387
Email: info@eurekabodycareandspa.com
Website: https://eurekabodycareandspa.com/

Please include sufficient information for us to identify the nature of your request.

For your protection, do not send Social Security numbers, complete payment card information, or highly sensitive medical information through ordinary email unless you have been instructed to use an appropriate secure method.

30. Final Privacy Statement

Eureka Body Care & Spa is committed to respecting client privacy and handling personal information responsibly.

We recognize that clients may share sensitive information when seeking skincare, aesthetic, medical, and wellness services.

Our goal is to collect and use information for appropriate purposes, maintain reasonable safeguards, and honor applicable privacy rights.

This Privacy Policy describes our general practices and does not replace any legally required Notice of Privacy Practices, informed consent document, or other mandatory disclosure.

Nothing in this policy limits rights or protections established by applicable federal or New York law.

—