What this covers

This document describes the privacy/security posture of the general inquiry contact form only — not the full site privacy policy, and not any client intake, booking, or health-related data flow. Those are addressed separately.

​

Data collected through this form

• Name, email, phone (optional), service interest, and message text.

• No health or medical information is requested or should be entered — a disclaimer on the form asks visitors not to include it.

​

How it’s protected

• Submissions travel over HTTPS (encrypted in transit), standard on Wix-hosted sites.

• Wix applies its own platform-level security measures (encryption at rest, access controls, monitoring) to data stored on its servers.

• This is standard commercial-grade protection — appropriate for general contact information, not health records.

• Spam/bot protection (reCAPTCHA or honeypot) should be enabled to limit unwanted automated submissions.

​

Why no PHI here

This form intentionally sits outside any HIPAA-relevant data flow. Real client communication — including anything health-related — happens after first contact, through Spruce Health (calls/texts) or Pabau (once its messaging feature launches in October), both of which are governed by signed Business Associate Agreements.

​

For the site’s privacy policy

The existing site privacy policy should note that contact form submissions (name, email, phone, message) are collected via Wix and used only to respond to inquiries — not shared with third parties for marketing, and not used to store health information.