SMS/Text Message & Email Privacy Policy

This SMS/Text Message and Email Privacy Policy (“Policy”) describes how Aestheticx MD LLC, doing business as Elysium Aesthetics and Longevity (“Elysium,” “we,” “us,” or “our”), collects, uses, discloses, protects, and retains information in connection with our text message (SMS/MMS) and email communications programs.

This Policy supplements — and does not replace — our general Website Privacy Policy, our Terms of Service, and our Notice of Privacy Practices (“NPP”) issued under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”). Where this Policy conflicts with our Notice of Privacy Practices with respect to Protected Health Information, the Notice of Privacy Practices controls.

Our contact information:

Legal entity: Aestheticx MD LLC
Practice address: 520 W. Erie Street, Suite 110, Chicago, IL 60654
Telephone: (312) 888-9361
Email: elysium@elysiumchicago.com
Website: elysiumchicago.com

For the avoidance of doubt, and as a standalone statement of our practices:

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors in support services, such as customer service and appointment scheduling, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We do not sell, rent, lease, or trade your mobile telephone number, SMS consent, or email address to any third party.

We do not share your text messaging opt-in data or consent with any third party for that party’s own marketing purposes, under any circumstance.

In connection with our messaging programs, we may collect:

a. Contact and identity information. Your name, mobile telephone number, email address, mailing address, and preferred method of contact.

b. Consent and preference records. The date, time, method, IP address, web page or form, and specific language of the disclosure through which you provided consent to receive messages; your message-type preferences; and the date and method of any revocation of consent.

c. Messaging metadata. Message delivery status, timestamps, carrier information, and, for email, open and click activity where you have not disabled such tracking in your email client.

d. Appointment and account information. Appointment dates, times, service location, provider assignment, and confirmation/cancellation status.

e. Health information. Information you provide to us or that we generate in the course of providing care, which may constitute Protected Health Information (“PHI”) under HIPAA. We limit the health information contained in SMS and email to the minimum necessary and, as described in Section 7, do not transmit detailed clinical information over unencrypted channels absent your specific direction.

f. Information you send us. The content of any message you send to us by SMS or email, including photographs you elect to transmit.

We do not collect or use device geolocation, contact lists, or mobile advertising identifiers for our messaging programs.

4.1 Two Distinct Message Categories

We operate our messaging in two separate categories, with separate consent:

(i) Care and Transactional Messages. Appointment confirmations, reminders, rescheduling and cancellation notices, pre-treatment and post-treatment care instructions, prescription and pharmacy notifications, follow-up check-ins, intake form and consent form links, billing and payment notifications, and responses to messages you initiate. These are sent in furtherance of your treatment and our health care operations.

(ii) Marketing and Promotional Messages. Announcements of new services or devices, event invitations, membership and package offers, seasonal promotions, and educational content promoting our services.

Consent to Category (i) does not constitute consent to Category (ii). Marketing and promotional text messages are sent only to individuals who have provided separate, affirmative, express written consent, and — where the message constitutes “marketing” under 45 C.F.R. § 164.501 — only pursuant to a valid HIPAA marketing authorization under 45 C.F.R. § 164.508(a)(3).

4.2 How You Opt In

You may consent to receive text messages from Elysium by:

Checking an unchecked, non-mandatory consent box on a form on our website, patient intake portal, or booking flow;

Providing your mobile number and consent in person on a paper or electronic intake or consent form at our practice;

Texting a designated keyword (for example, START or JOIN) to our messaging number; or

Verbally providing consent to a staff member, which we document in your record.

At the point of opt-in, we disclose: the name of our program, the categories of messages you will receive, the expected message frequency, that message and data rates may apply, the STOP and HELP instructions, and links to this Policy and our Terms of Service.

Consent to receive marketing text messages is never a condition of purchase, of scheduling an appointment, or of receiving any treatment or service from Elysium.

4.3 Message Frequency

Message frequency varies based on your appointment activity and stated preferences.

Care and transactional messages: frequency varies; typically 1–5 messages per appointment episode.

Marketing and promotional messages: typically up to 4 messages per month, unless otherwise disclosed at the point of opt-in for a specific program.

4.4 Cost

Message and data rates may apply. Elysium does not charge you for text messages, but your mobile carrier’s standard messaging and data charges apply according to your plan. Please contact your wireless provider for details.

4.5 How to Opt Out (STOP)

You may cancel text messages at any time by replying STOP, END, QUIT, CANCEL, UNSUBSCRIBE, or REVOKE to any message from us. After you send one of these keywords, we will send a single confirmation message acknowledging your request, and you will receive no further text messages from that program.

Consistent with 47 C.F.R. § 64.1200(a)(10), we honor requests to revoke consent made through any reasonable means, including but not limited to: replying with any word or phrase that reasonably conveys your intent to stop receiving messages; calling us at (312) 888-9361; emailing us at elysium@elysiumchicago.com; telling any Elysium staff member in person; or submitting a request through our website. We process revocation requests as soon as practicable and in no event later than ten (10) business days after receipt.

If you revoke consent for marketing messages, we will continue to send care and transactional messages relating to your treatment unless you separately ask us to stop those as well. If you ask us to stop all text messages, you remain responsible for confirming appointments by telephone, email, or through our patient portal.

Please note: Opting out of text messages does not remove your information from your medical record, does not withdraw your consent to treatment, and does not opt you out of email communications. Email preferences are managed separately (see Section 5).

4.6 Help (HELP)

For assistance, reply HELP to any message from us, call (312) 888-9361, or email elysium@elysiumchicago.com. Replying HELP returns our practice name, support contact information, and opt-out instructions.

4.7 Carrier Disclaimer

Carriers are not liable for delayed or undelivered messages. Message delivery is subject to effective transmission by your wireless carrier and is not guaranteed. We are not responsible for messages that are delayed, undelivered, or delivered to an incorrect number where you have provided or failed to update that number.

4.8 Supported Carriers and Number Changes

Our messaging programs are supported on major U.S. wireless carriers. You agree to notify us promptly if your mobile telephone number changes or is reassigned. You represent that you are the subscriber to, or the customary user of, the mobile telephone number you provide, and that you are authorized to consent to receive messages at that number.

4.9 Age Restriction

Our messaging programs are intended for individuals 18 years of age or older. Where we provide services to a minor patient, messages are directed to the parent or legal guardian who has provided consent.

4.9 Age Restriction

Our messaging programs are intended for individuals 18 years of age or older. Where we provide services to a minor patient, messages are directed to the parent or legal guardian who has provided consent.

5.1 Categories of Email

We send two categories of email, mirroring the SMS categories described in Section 4.1: care and transactional email (appointment confirmations and reminders, forms, care instructions, receipts, statements, and replies to your inquiries) and marketing and promotional email.

5.2 Opt-In and Opt-Out

You may subscribe to marketing email through our website, intake forms, event registrations, or in person. Every marketing email we send includes a functioning unsubscribe link and our physical mailing address, as required by the CAN-SPAM Act, 15 U.S.C. § 7701 et seq. We process unsubscribe requests within ten (10) business days and do not require you to log in, pay a fee, or provide information beyond your email address and your preferences in order to unsubscribe.

Transactional and relationship email regarding your care, appointments, or account is not subject to unsubscribe, though you may ask us to change your preferred method of contact at any time.

5.3 Email Tracking

Our marketing email may contain pixels or tracking links that record whether a message was opened and which links were clicked, so that we can measure engagement and reduce unwanted messages. You can prevent open tracking by disabling remote image loading in your email client. We do not use email tracking on messages that contain health information, and we do not deploy third-party advertising trackers on our patient portal, booking flow, or intake forms.

We use the information described in Section 3 to:

1. Schedule, confirm, remind, and follow up on appointments;
2. Deliver treatment instructions and clinical follow-up;
3. Send billing, payment, and account communications;
4. Respond to your questions and requests;
5. Send marketing and promotional communications where you have consented and, where required, authorized;
6. Maintain records of your consent, preferences, and revocations as required by the Telephone Consumer Protection Act, 47 U.S.C. § 227 (“TCPA”), and CAN-SPAM;
7. Operate, secure, troubleshoot, and improve our messaging systems; and
8. Comply with legal, regulatory, accreditation, and professional obligations.

Elysium is a covered entity under HIPAA. Our full obligations are described in our Notice of Privacy Practices, provided to you at your first visit and available on request at our front desk or by emailing elysium@elysiumchicago.com.

Standard SMS and standard email are not encrypted in transit and are not secure methods of communication. Messages may be intercepted, may be viewed by anyone with access to your device or email account, and are stored by your carrier and email provider outside our control.

By providing your mobile number or email address and consenting to receive messages, you acknowledge these risks and authorize us to communicate with you by SMS and unencrypted email regarding your care. We limit the content of such messages to the minimum necessary — for example, “You have an appointment Thursday at 2:00 PM” rather than a description of the treatment to be performed.

You may withdraw this authorization and request an alternative means or location of communication at any time under 45 C.F.R. § 164.522(b), by contacting us at (312) 888-9361 or elysium@elysiumchicago.com. We will accommodate reasonable requests.

Marketing. Under 45 C.F.R. § 164.508(a)(3), we obtain your written authorization before using or disclosing PHI to send you marketing communications, except where an exception applies (such as face-to-face communications or promotional gifts of nominal value). Your authorization is revocable in writing at any time.

Photographs. Any before-and-after or clinical photograph is used for marketing only under a separate, specific, written authorization identifying the media in which it may appear. A consent to treat is not a marketing authorization.

We share information only as described below.

a. Service providers and business associates. We use vendors to operate our practice and messaging programs, including our practice management and booking platform (Mindbody), our email and SMS marketing platform (Klaviyo), and our telecommunications and messaging carriers and aggregators. These vendors process information solely on our instructions and for the purpose of providing services to us. Where a vendor creates, receives, maintains, or transmits PHI on our behalf, we execute a Business Associate Agreement as required by 45 C.F.R. §§ 164.502(e) and 164.308(b).

Text messaging consent carve-out. Notwithstanding anything in this Section, mobile opt-in data and consent are never shared with, sold to, or disclosed to any third party for that party’s marketing or promotional purposes. Disclosure of a mobile number to a subcontractor is limited to what is strictly necessary for that subcontractor to deliver the message you asked to receive.

b. Treatment, payment, and health care operations. We disclose PHI as permitted by HIPAA — for example, to a pharmacy, a referring or consulting physician, or a payment processor.

c. Legal and safety. We disclose information where required by law, subpoena, court order, or governmental request, or where necessary to protect the rights, property, or safety of Elysium, our patients, or the public.

d. Business transfer. In connection with a merger, acquisition, financing, or sale of assets, information may be transferred to the successor entity, subject to the terms of this Policy and applicable law.

We do not share information with data brokers, lead generators, affiliate marketers, or advertising networks.

We retain messaging consent records, opt-out records, and message logs for a minimum of five (5) years following the last message sent or the date consent was revoked, whichever is later, in order to demonstrate compliance with the TCPA and CAN-SPAM. Medical records, including communications that form part of the designated record set, are retained in accordance with Illinois law and applicable professional standards. Marketing engagement data is retained for no longer than necessary for the purposes described in Section 6.

When information is no longer required, we destroy or de-identify it using methods appropriate to its sensitivity.

We maintain administrative, physical, and technical safeguards designed to protect your information, including access controls and role-based permissions, multifactor authentication on messaging and practice management platforms, encryption of data at rest and in transit within our systems, workforce training, vendor risk assessment, and incident response procedures.

No method of transmission or storage is completely secure. As stated in Section 7, SMS and standard email are inherently unencrypted in transit.

Breach notification. If your unencrypted personal information is compromised, we will notify you in the most expedient time possible and without unreasonable delay, and will notify the Illinois Attorney General where required, in accordance with the Illinois Personal Information Protection Act, 815 ILCS 530.

Biometric information. We do not currently collect, capture, purchase, receive, or store biometric identifiers or biometric information — including scans of face geometry — as those terms are defined by the Illinois Biometric Information Privacy Act, 740 ILCS 14. Should that change, we will first obtain your informed written release, publish a written retention and destruction schedule, and provide the other disclosures BIPA requires. We do not and will not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information.

Medical records. You may request copies of your records in accordance with 735 ILCS 5/8-2001 and 45 C.F.R. § 164.524.

You may at any time:

• Opt out of text messages (Section 4.5) or marketing email (Section 5.2);
• Change your preferred method or location of contact;
• Request access to, or an amendment of, your PHI under 45 C.F.R. §§ 164.524 and 164.526;
• Request an accounting of certain disclosures under 45 C.F.R. § 164.528;
• Request restrictions on uses and disclosures under 45 C.F.R. § 164.522;
• Revoke a HIPAA marketing authorization in writing; and
• File a complaint with us at
  elysium@elysiumchicago.com
  or with the U.S. Department of Health and Human Services, Office for Civil Rights.
  We will not retaliate against you for filing a complaint or exercising any right described in this Policy.

Our website, messaging programs, and services are not directed to children under 13, and we do not knowingly collect personal information from children under 13 for messaging purposes. Communications concerning a minor patient are directed to the parent or legal guardian.

We may update this Policy from time to time. The “Last Updated” date above reflects the most recent revision. Material changes affecting how we use or share your mobile information will be posted on this page and, where required by law, communicated to you directly. Your continued participation in our messaging programs after the effective date of a change constitutes acceptance of the revised Policy.

If you have questions about these Terms of Service, please contact us at:

Elysium Aesthetics + Longevity Chicago
Email: info@elysiumchicago.com
Website: elysiumchicago.com

HIPAA Privacy Official: Dr. Ishmeet Singh, Medical Director

© 2026 Aestheticx MD LLC d/b/a Elysium Aesthetics and Longevity. All rights reserved.
This policy is provided for informational purposes and does not constitute legal advice.