Your information, in plain English.

What this policy covers, and what the site collects

This policy applies to quawellness.com and to the tools built into it: the concierge page at /book, the Ask Qua assistant, and the email sign-up in the footer. It does not apply to the other websites we link to, such as Square, the 360 tour on tourmkr.com, Instagram, Facebook or Google Maps.

It also does not cover what happens inside the practice. Your clinical records as a patient live in our electronic health record, eClinicalWorks. Those are governed by HIPAA and described in our Notice of Privacy Practices. The website is not connected to that record.

The website is hosted by Vercel. The small programs that handle appointment requests and Ask Qua run on Vercel's servers in the United States. Like any host, Vercel may keep short-lived technical logs, such as the address your device connects from, to run and protect the service. Our own functions also hold that address in memory for up to an hour, to limit repeated requests, and then discard it.

We set no cookies of our own. The site uses your browser's storage for two things only. One is a flag that you have seen the opening animation. The other is your pending request on the booking page, held until the deposit is confirmed: the reference, the treatment, the time you asked for, your first name and how you prefer to be contacted. Both stay on your device, and you can clear them in your browser settings at any time.

We use Google Analytics 4 on quawellness.com. It records page views, clicks and booking steps: the step reached, whether a request was sent and whether a deposit was paid. It never records which treatment you asked about or anything you type into a form, and page addresses are sent to it without the part after the question mark. It is Google's tool, it may use Google's own cookies or identifiers to tell one visit from another, and it runs under Google's privacy policy. We use what it shows us to see which pages help visitors and which do not.

This website does not collect biometric identifiers or precise location, and it never asks for your card number. It is not directed to children, and we do not knowingly collect information from anyone under 18 through it. If you believe a child has sent us information through the site, email us and we will delete it.

Requesting an appointment

On the concierge page you request an appointment. You do not book one outright. The form asks for your first and last name, mobile phone, email, whether you have visited us before, how you prefer to be contacted, the treatment you are interested in, a preferred date and time, an optional second choice of time, and an optional scheduling note. You also tick a box agreeing that we may contact you about the request. Please do not put medical details in the note. It is for scheduling, and it travels through systems that are not built for health information.

Your request reaches us only once the $50 deposit is paid. The deposit is taken on Square's checkout page. Card details are entered there, never on our website. Your request details are attached as the note on that Square payment, so we can match the payment to the request. We also pass your email address to Square so its checkout can be prefilled. If the deposit page cannot be opened, for example when Square is unavailable, your request is sent to us straight away by the same channels, so we can call you to take the deposit by phone.

When the payment completes, we receive an email through Resend at info@quawellness.com with your request details. The team also gets a push notification through ntfy.sh, and a text message through Twilio if that is switched on. Both carry the treatment, the time and the request reference only. Nothing is stored on the website's own servers. Our team confirms every appointment personally.

The deposit goes toward your visit. If we cannot confirm the time you asked for, it is returned in full. Our Terms page sets out the deposit terms.

Ask Qua, and notes from Dr. Abboud

Ask Qua answers general questions about the practice. When you type a question, the text of that question and the conversation so far are sent to an AI model through the Vercel AI Gateway, which produces the answer. Please do not share private health details in Ask Qua. It is not a patient portal, and no clinician reads it as you type.

The text of each question, the page you asked it from and the time are saved in the website's storage on Vercel, without your name, contact details or address. Anything that looks like an email address or a phone number is blanked before the text is saved. Once a week the practice receives an email listing those questions so we can improve the answers. Answers from Ask Qua are general information, not medical advice, and they do not create a patient relationship with the practice. If you have a question about your own health, the right place is a visit.

If you use the Leave a number button inside Ask Qua, your name, the contact detail you give and your question are emailed to the practice through Resend so a person can follow up. The push notification, and text if enabled, says only that a visitor asked for a personal answer.

The sign-up in the footer collects one thing, your email address, so we can send occasional notes from Dr. Abboud. The list is stored with Resend, the service that sends the emails. Every email carries an unsubscribe link. We do not add you to the list when you request an appointment or use Ask Qua.

How long we keep it, and who handles it for us

Your appointment request is not stored on the website's own servers. What does persist sits with the services that handle it: the request note on the Square payment, the request email in our practice inbox, the handoff email if you left a number in Ask Qua, and, if you signed up, your email address with Resend. The Ask Qua log on Vercel holds the question text without identifying details.

We keep appointment request emails, Ask Qua handoff emails, the Ask Qua question log and payment records for as long as we need them to run the practice and to meet record-keeping rules for payments [retention periods to be confirmed at legal review]. We keep your email address on the notes list until you unsubscribe or ask us to remove it. We may also disclose information when the law requires it, for example in response to a valid subpoena, or to protect the practice, our patients or the public from harm.

We do not sell your information, and we do not share it with anyone for their own marketing. The companies below process it on our behalf.

• Vercel: hosts the website, runs the appointment request and Ask Qua functions in the United States, stores the Ask Qua question log, and provides the AI Gateway through which Ask Qua reaches the AI model.
• Square: takes the $50 deposit, receives your email address to prefill its checkout, and holds your request details as the note on the payment.
• Resend: delivers the appointment request, handoff and weekly Ask Qua emails to the practice and stores the email sign-up list.
• ntfy.sh: sends the team a push notification with the treatment, time and request reference only.
• Twilio, if enabled: sends the team a text message with the treatment, time and request reference only.
• Google Analytics 4: page views, clicks and booking steps only, never the treatment and never form contents.
• The AI model behind Ask Qua, reached through the Vercel AI Gateway: receives your question and the conversation so far.

Contact, changes and your choices

Questions about this policy, or about your information, go to Qua Wellness and Med Spa, 430 Village Center Drive, Burr Ridge, IL 60527. Call (630) 561-0590 or email info@quawellness.com. Please do not email medical details. If you need to discuss your care, request a visit or call the front desk.

We may update this policy as the website changes. The current version will always be on this page, with its effective date. Effective date: [to be set at legal review].

You can use most of this website without giving us anything. Ask Qua and the sign-up are optional, and you can call us instead of using the request form. Your choices, in short:

• Analytics: block or clear cookies in your browser and Google Analytics will not follow your visit.
• Browser storage: clear this site's data in your browser settings to remove the animation flag and any pending request held for the deposit.
• Emails: click unsubscribe in any note from Dr. Abboud, or email info@quawellness.com.
• Your request: to correct a detail or ask us to delete a request, email or call us. We will remove what we hold and ask our providers to do the same, as far as record-keeping rules for payments allow.
• Ask Qua: do not type anything you would not want kept, and use the Leave a number button if you would rather a person called you.