Privacy Policy

Effective Date: July 30, 2026  ·  Last Updated: July 30, 2026  ·  Version 1.0

LoopMD ("LoopMD," "we," "us," or "our") respects your privacy and is committed to being transparent about how we collect, use, disclose, retain, and protect personal information.

This Privacy Policy applies to the LoopMD website, including loopmd.io and pages that link to this Privacy Policy; our Fit Assessment and other online forms; our business-development communications; our AI-assisted website chat; scheduling pages; and other online services that we control and that link to this Privacy Policy (collectively, the "Site"). It is designed primarily for medical-spa owners, aesthetic-practice leaders, business contacts, prospective clients, clients, vendors, and other business users who interact with LoopMD.

1. Important scope limitations

The Site is a business website, not a patient-care portal

LoopMD provides growth strategy, technology implementation, automation, AI-supported communication, training, reporting, and related business services for medical spas and aesthetic practices. LoopMD does not provide medical care, diagnosis, treatment, emergency services, or clinical advice through this Site.

Do not use the Site, Fit Assessment, general contact forms, or LoopMD's public-facing AI chat to submit:

• Protected health information or patient records.
• Medical histories, diagnoses, medications, treatment details, or clinical photographs.
• Information about an identifiable patient.
• Urgent medical concerns or adverse-event information.
• Sensitive credentials, government identification numbers, or payment-card details unless requested through an approved secure payment page.

If you are a patient of a medical spa or aesthetic practice, contact that practice directly regarding your care. If you believe you are experiencing a medical emergency, call 911 or seek appropriate emergency care.

Information processed for LoopMD clients

LoopMD may separately process information on behalf of client practices when delivering contracted services. In those circumstances, the client practice generally determines why and how patient or consumer information is processed, and LoopMD processes the information under the applicable service agreement, data-processing terms, Business Associate Agreement when required, and the client's instructions. This public Privacy Policy does not replace a client practice's Notice of Privacy Practices and does not create a patient relationship with LoopMD.

2. Personal information we collect

The information we collect depends on how you interact with us.

A. Information you provide directly

• Contact information: name, business email address, telephone number, mailing address, and preferred contact method.
• Professional and business information: practice name, job title, role, website, practice location, practice type, number of providers, service categories, appointment capacity, current technology, membership model, business goals, and operational challenges.
• Fit Assessment information: responses used to evaluate whether a practice may be a fit for LoopMD, including revenue ranges, advertising activity, growth readiness, staffing, training readiness, investment readiness, and anticipated launch timing.
• Scheduling information: preferred meeting times, calendar selections, meeting details, rescheduling information, and appointment status.
• Communications: messages, email correspondence, SMS replies, call notes, chat transcripts, requests, questions, feedback, and records of consent or communication preferences.
• Proposal and contracting information: company details, authorized signer information, proposal status, agreement status, signature details, and onboarding responses.
• Transaction information: fees, invoice status, payment status, transaction identifiers, billing contact information, and limited payment-related information supplied by our payment processor. LoopMD generally does not receive complete payment-card numbers.
• Training and portal information: course access, lesson progress, quiz responses, completion status, login events, and support requests.
• User-submitted content: files, screenshots, documents, testimonials, comments, or other information you choose to provide.

B. Information collected automatically

When you use the Site, we and our service providers may automatically collect: IP address; browser type and version; device type and operating system; device identifiers; approximate location derived from IP address; referring URL and pages viewed; date and time of visits; clicks, scrolling, navigation, and interaction data; form starts, submissions, and abandonment events; advertising and campaign attribution information; cookie identifiers, pixels, local storage, and similar technology data; and security, diagnostic, performance, and error-log information.

C. Information from third parties

We may receive information from advertising and social-media platforms; analytics providers; referral partners; publicly available business websites and professional directories; calendar, video-meeting, email, SMS, CRM, payment, and electronic-signature providers; client practices, where permitted and relevant to our services; and other people at your organization.

D. Inferences

We may derive business-related inferences from information you provide, such as whether a practice appears ready for implementation, which services may be relevant, likely business priorities, and appropriate follow-up timing. We do not intend to use the public Site to create medical, health, or patient profiles.

3. How we use personal information

We may use personal information to: operate, maintain, secure, and improve the Site; process Fit Assessments and evaluate potential business fit; respond to inquiries and communicate about LoopMD; schedule, confirm, reschedule, and conduct Strategy Calls or other meetings; personalize business-development communications; prepare proposals, contracts, invoices, onboarding materials, and training access; deliver services to clients; operate Luna, LoopMD's B2B AI concierge, and provide human follow-up; authenticate users and administer client or training portals; provide customer support and troubleshoot technical issues; send service, administrative, security, and account notices; send marketing communications where permitted by law and consistent with your preferences; measure website, campaign, and communication performance; understand how visitors find and use the Site; conduct internal analytics, research, quality assurance, and product development; detect, prevent, investigate, and respond to fraud, misuse, security incidents, or unlawful activity; enforce our agreements, policies, and legal rights; comply with legal obligations and respond to lawful requests; and complete a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar business transaction.

4. How we disclose personal information

We may disclose personal information to the following categories of recipients for the purposes described in this Policy.

Service providers and processors

We use service providers that may process personal information on our behalf, including: website hosting and content-delivery providers; CRM, automation, and form providers; email and SMS communication providers; calendar and video-meeting providers; AI and conversational-technology providers; cloud hosting and data-storage providers; analytics and performance-monitoring providers; advertising and social-media platforms; payment processors and invoicing providers; electronic-signature and contract-management providers; training and client-portal providers; and IT, cybersecurity, professional-services, and customer-support vendors.

Business partners and referral sources

We may disclose information to a referral or implementation partner when necessary to respond to your request, with your direction, or as otherwise permitted by law.

Your organization

If you interact with LoopMD on behalf of a practice or other business, we may disclose relevant communications, proposals, training status, contracting information, or account activity to authorized people at that organization.

Professional advisers

We may disclose information to attorneys, accountants, insurers, auditors, consultants, and other advisers who assist with legitimate business and compliance functions.

Legal, safety, and enforcement purposes

We may disclose information when we reasonably believe disclosure is necessary to comply with law, regulation, subpoena, court order, or other legal process; protect the rights, safety, security, or property of LoopMD, our clients, users, or others; detect or prevent fraud, security threats, abuse, or unlawful conduct; or enforce applicable terms, contracts, or policies.

Business transfers & your consent

Information may be disclosed or transferred as part of a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, due diligence, or similar corporate transaction. We may also disclose information for another purpose that we explain at the time or that you direct or authorize.

5. Cookies, analytics, advertising, and similar technologies

The Site may use cookies, pixels, web beacons, local storage, tags, scripts, and similar technologies. Essential technologies are used for functions such as security, fraud prevention, page delivery, load balancing, form operation, preference storage, and basic website functionality. Analytics technologies help us understand traffic, page usage, device information, site performance, and how visitors interact with the Site. Advertising technologies, if enabled, may help us measure campaigns, attribute applications, create audiences, limit ad repetition, or deliver advertising on other websites and services.

Where required, we will request consent before placing non-essential analytics or advertising technologies. You can manage available choices through the cookie banner or the Cookie Settings link in the Site footer. Browser settings may also allow you to block or delete cookies; blocking cookies may affect Site functionality.

6. Sale, sharing, and targeted advertising

LoopMD does not sell personal information in exchange for money. Some privacy laws define "sale," "sharing," or "targeted advertising" broadly. If LoopMD uses advertising pixels, cross-site analytics, audience tools, or similar technologies, certain disclosures may be considered a sale, sharing, or processing for targeted advertising under those laws even when no money is exchanged.

Where applicable, you may opt out by selecting Your Privacy Choices in the Site footer; adjusting Cookie Settings; submitting a request through loopmd.io/privacy-choices; or enabling a legally recognized browser-based opt-out preference signal, such as Global Privacy Control, where applicable. We do not knowingly sell or share the personal information of individuals under 18.

7. Artificial intelligence and automated tools

LoopMD may use artificial intelligence, automated workflows, and conversational tools to support website chat, qualification, scheduling, communication, content organization, and internal analysis.

Luna

Luna is LoopMD's B2B AI concierge. Luna may answer general questions, assist with scheduling, provide high-level information about LoopMD, and route conversations to Sean or another human representative. When you use an AI-enabled feature: your messages may be processed by automated systems and service providers; conversations may be recorded, stored, analyzed, and reviewed by authorized personnel for quality, security, training, and follow-up; AI-generated responses may be incomplete or inaccurate; and you should not submit patient information, protected health information, confidential clinical information, account passwords, or other highly sensitive information.

LoopMD does not use the public website AI chat to provide medical advice, determine medical candidacy, make clinical decisions, or provide emergency support. LoopMD does not intend to make decisions that produce legal or similarly significant effects about individuals solely through automated processing on the public Site. Qualification results may be reviewed or overridden by an authorized person.

8. Email, telephone, and text communications

Service-related communications. When you submit an inquiry, schedule a meeting, request information, enter into an agreement, or create an account, we may contact you about that request, meeting, account, transaction, training, or service.

Marketing email. We may send business and marketing email where permitted. You may unsubscribe using the link in an email or by contacting us. Even after opting out of marketing email, you may continue to receive necessary service, transactional, legal, or security communications.

Text messages. We send automated or recurring marketing text messages only where we have the consent required by applicable law. Consent to receive marketing text messages is not a condition of purchasing services. Message frequency varies. Message and data rates may apply. Reply STOP to opt out and HELP for help. We may also honor other reasonable revocation requests. Please allow a reasonable period for preferences to be processed.

9. Payment processing

Payments may be processed by Stripe or another payment processor. Payment processors collect and process payment information under their own privacy notices and contractual terms. LoopMD generally receives transaction status, billing contact details, payment method type, limited card information such as the last four digits, and transaction identifiers, but not complete payment-card numbers.

10. Data retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide requested services, maintain business and transaction records, comply with legal obligations, resolve disputes, prevent fraud, enforce agreements, and protect our rights. Our anticipated retention approach is:

We may retain information longer when reasonably necessary for litigation, investigations, legal holds, security incidents, or regulatory obligations. We may retain de-identified or aggregated information that can no longer reasonably identify you.

11. Security

We use administrative, technical, and physical safeguards designed to protect personal information in light of the nature of the information, the systems involved, and the risks presented. Safeguards may include access controls, multifactor authentication, role-based permissions, encryption supported by our platforms, audit logs, secure vendor configurations, workforce confidentiality obligations, data minimization, security monitoring, backups, and incident-response procedures. No website, transmission, or storage system is completely secure, and we cannot guarantee absolute security. You are responsible for using secure devices, protecting credentials, and notifying us promptly if you suspect unauthorized access.

12. HIPAA and protected health information

LoopMD's public Site is not intended to collect protected health information and is not a substitute for a HIPAA Notice of Privacy Practices. When LoopMD provides services to a client practice that is a HIPAA Covered Entity or Business Associate and LoopMD creates, receives, maintains, or transmits protected health information on the client's behalf, the parties will address HIPAA responsibilities through the applicable service agreement and Business Associate Agreement. HIPAA-enabled configurations, Business Associate Agreements, access controls, AI boundaries, tracking-technology restrictions, and other safeguards must be reviewed and activated before protected health information is processed through a client implementation. Do not assume that every LoopMD webpage, form, chat, advertising pixel, or third-party integration is appropriate for protected health information merely because a HIPAA-related agreement exists.

13. Your privacy rights

Depending on your state or country of residence and whether an applicable law covers LoopMD's processing, you may have rights concerning your personal information, such as the right to: confirm whether we process your personal information; access or obtain a copy of it; correct inaccuracies; delete it; obtain certain information in a portable format; opt out of targeted advertising; opt out of the sale or sharing of personal information; opt out of certain profiling; limit certain uses of sensitive personal information; withdraw consent where processing is based on consent; object to or restrict certain processing; appeal a decision concerning a privacy request; and receive equal service without discrimination for exercising a privacy right. These rights are subject to legal exceptions and may not apply in every circumstance, including when information relates to your role at a business and the applicable law excludes that context.

How to submit a request

Submit a request through: Online: loopmd.io/privacy-choices  ·  Email: [email protected] with the subject "Privacy Request"  ·  Mail: LoopMD, Attn: Privacy, 7861 Locust Wood Rd, Severn, MD 21144. Please describe the right you wish to exercise and provide enough information for us to locate relevant records. We may need to verify your identity and authority before completing a request.

Authorized agents & appeals

Where permitted, an authorized agent may submit a request for you; we may request evidence of authorization and verify your identity directly. If we deny a request and applicable law provides an appeal right, you may appeal by emailing [email protected] with the subject "Privacy Appeal" within 45 days after our decision.

Global Privacy Control

Where required by applicable law, we will treat a recognized Global Privacy Control signal as a request to opt out of sale, sharing, or targeted advertising for the browser or device sending the signal. If you clear cookies, change devices, or use another browser, you may need to renew your preference.

14. California privacy notice

This section supplements the remainder of this Policy for California residents where the California Consumer Privacy Act, as amended, applies. During the preceding 12 months, we may have collected the following categories:

We do not use sensitive personal information to infer characteristics about you. Where applicable, California residents may request access, correction, deletion, information about collection and disclosure, or portability, and may opt out of sale or sharing. LoopMD does not sell personal information for money; if advertising or analytics practices constitute sale or sharing under California law, use Your Privacy Choices or a recognized Global Privacy Control signal to opt out. LoopMD does not currently offer a consumer financial-incentive program through the public Site.

15. International visitors

LoopMD is based in the United States and the Site is primarily directed to U.S. business users. If you access the Site from another country, your information may be transferred to and processed in the United States and other countries where our service providers operate. Where the European Economic Area, United Kingdom, or another jurisdiction's data-protection law applies, our legal bases may include taking steps at your request before entering into a contract; performing a contract; pursuing legitimate interests such as responding to inquiries, operating and securing the Site, improving services, preventing fraud, and conducting appropriate B2B marketing; compliance with legal obligations; and consent, where required.

16. Children

The Site is intended for business professionals and is not directed to children. You must be at least 18 years old to submit a Fit Assessment, enter into a contract, or use a client portal. We do not knowingly collect personal information from children under 13 through the Site. If you believe a child has provided personal information, contact us so we can review and take appropriate action.

17. Third-party websites and services

The Site may link to third-party websites, social-media platforms, payment pages, calendars, video-meeting services, or other services. Their privacy practices are governed by their own notices. LoopMD is not responsible for the privacy, security, content, or practices of services we do not control.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted with a revised "Last Updated" date. If changes materially affect how we use personal information, we may provide additional notice where required.

19. Contact us

Questions, concerns, or privacy requests may be sent to:

LoopMD
Attn: Privacy
7861 Locust Wood Rd, Severn, MD 21144
Email: [email protected]