We safeguard your consultation records and clinical data with complete statutory transparency.

Effective Date & Notice Scope

This Privacy Policy took effect on October 17, 2026 (2026-10-17) and governs all personal information collected through velviques.click and during clinical consultation intake at our Denver aesthetic studio.

Data Controller Identity

The data controller responsible for personal information processed on this website is Velviques, trading at velviques.click, with our clinical studio located at 300 East 17th Avenue, Denver, Colorado 80203, Denver, Colorado, United States. You may contact our clinical privacy coordinator directly by email at office@velviques.click or by calling our studio desk at +1 (307) 555-3072.

Categories of Data Collected

Velviques records only the data required to facilitate clinical consultations, uphold sanitation and procedural safety, and verify digital inquiries. We do not maintain user accounts, passwords, or stored credit card data:

• Inquiry Form Records: When you complete our consultation request form (mozo54e.php), we receive your legal name, telephone number, email address, physical address or Denver postal code, desired procedure category, requested anatomical treatment specifications, general skin notes, and consent confirmation.
• Clinical Support Chat: Messages transmitted through our support chat (jiha834.php), including conversation transcripts, associated contact details, and a local browser session token allowing you to return to the active dialogue.
• Automated Diagnostic Metadata: The exact timestamp when an inquiry was rendered and transmitted, your Internet Protocol (IP) address, browser user-agent string, and HTTP referring URL.
• Consent Choice: Your cookie preference stored locally in your browser under the key site_consent_v2.
• Advertising Click Identifiers: Marketing parameters appended to incoming URLs by paid ad networks, including gclid from Google Ads, msclkid from Microsoft Advertising, and fbclid from Meta Ads.

Purposes of Data Processing

We process personal data for clear, legitimate operational requirements:

1. To evaluate clinical skin history, determine procedural suitability (e.g. skin phototype calibration for chemical peels or contraindications for RF microneedling), and schedule in-person consultations at our Denver practice.
2. To deliver administrative correspondence, appointment confirmations, pre-treatment preparation guidelines, and post-procedure barrier care instructions.
3. To protect our server systems against automated spam, credential stuffing, and brute-force form exploitation.
4. To measure the aggregate return and geographic conversion performance of digital marketing campaigns across Google, Microsoft, and Meta advertising networks.

Lawful Bases for Processing

Under applicable statutory frameworks, including European GDPR standards and US privacy principles, Velviques processes your personal data under the following legal bases:

• Consent: When you submit a consultation request, engage in our intake chat, or accept measurement cookies through our consent banner, you grant explicit consent for that designated processing.
• Performance of a Contract: Taking necessary steps at your request prior to entering into a clinical aesthetic service contract, including facial mapping and preparation schedules.
• Legitimate Interests: Protecting practice server security, preventing automated abuse, logging infrastructure uptime, and defending clinical records against malpractice or dispute claims.

Advertising Platforms & Click Identifiers

Velviques runs paid traffic campaigns to connect Denver adults with licensed aesthetic treatments. Google Ads, Microsoft Advertising, and Meta Ads send traffic directly to this domain. When you click a sponsored link, the respective platform appends a unique click identifier to the landing URL:

• gclid — Google Click Identifier, generated by google ads to attribute conversions.
• msclkid — Microsoft Click Identifier, appended by microsoft advertising to track ad engagement.
• fbclid — Meta Click Identifier, generated by Meta Platforms for audience measurement.

We do not claim that any advertising platform has reviewed, approved, or verified our clinical procedures. Identifiers are parsed exclusively for campaign performance analytics and attribution.

Consent Mode v2 Architecture

To maintain strict compliance with global privacy standards, velviques.click implements Google Consent Mode v2. By default, prior to any user interaction with our cookie banner, the four foundational tracking signals are held strictly denied:

• ad_storage: denied
• ad_user_data: denied
• ad_personalization: denied
• analytics_storage: denied

Only when a visitor actively clicks "Accept Storage" on our consent banner are these parameters updated to granted. If you decline storage or later adjust your settings, all four signals are returned immediately to denied, halting subsequent cookie-based transmission.

Third-Party Data Processors

Velviques transfers personal and technical data to vetted infrastructure processors strictly under binding data processing agreements:

• Microsoft Advertising: Handled by Microsoft Ireland Operations Ltd / Microsoft Corporation. Their independent privacy practices are detailed at privacy.microsoft.com.
• Google Ads & Analytics: Operated by Google LLC / Google Ireland Ltd for keyword attribution and conversion tracking.
• Meta Ads: Managed by Meta Platforms Ireland Ltd for demographic ad delivery.
• Web Hosting Infrastructure: Protected virtual server hosting provider located within the United States, maintaining encrypted NVMe storage for form transmissions and database records.
• Transactional Mail Routing: Encrypted SMTP mail transport provider delivering notification alerts of incoming consultation inquiries to our clinical desk.

International Data Transfers

While Velviques operates exclusively in Denver, Colorado, technical data processed through cloud partners (such as Google or Microsoft) may be routed through servers in the United States, European Economic Area, or other jurisdictions. All cross-border data flows rely on Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent adequacy decisions, ensuring an unbroken standard of encryption and data security.

Data Retention Periods

We retain personal data strictly for defined operational, clinical, and regulatory periods:

Security Safeguards & Storage Protocols

Velviques enforces administrative, technical, and physical safeguards designed to prevent unauthorized alteration, disclosure, or destruction of personal records. All data in transit across velviques.click is protected via TLS 1.3 encryption with modern cipher suites and Strict-Transport-Security (HSTS). Server databases holding consultation forms sit behind hardened firewall boundaries with role-based access controls limited strictly to licensed clinical personnel.

Rights for European Visitors (GDPR)

For visitors accessing our catalogue from the European Economic Area, the General Data Protection Regulation (gdpr) affords you comprehensive rights regarding your personal information:

• Right of Access: You may request an itemized copy of all personal records we hold regarding your inquiries.
• Right to Rectification: You may require us to correct outdated or inaccurate personal details.
• Right to Erasure ("Right to be Forgotten"): You may request total deletion of your inquiry data, subject to legal recordkeeping obligations.
• Right to Restriction: You may limit the processing of your data while a dispute is adjudicated.
• Right to Data Portability: You may receive your records in a structured, machine-readable format.
• Right to Object: You may object at any time to processing grounded in legitimate interest.
• Right to Withdraw Consent: You have the absolute right to revoke consent at any time without retroactive penalty.

United States & State Privacy Rights (CPA & CCPA)

Velviques complies fully with the Colorado Privacy Act (CPA) and extends equivalent protections to residents of California under the California Consumer Privacy Act (ccpa) / CPRA, Virginia, Connecticut, and other states with active consumer privacy enactments:

• Right to Know & Access: You may confirm whether Velviques processes your personal data and obtain a copy of specific pieces collected.
• Right to Correct: You may correct inaccuracies in your clinical intake history.
• Right to Delete: You may direct Velviques to delete personal data provided by or obtained about you.
• Right to Opt Out of Sale / Targeted Advertising: Velviques does not sell personal information for monetary compensation. You may opt out of cross-context behavioral advertising at any time using our cookie preference controls.
• Freedom from Discrimination: We will never deny service, charge different fee rates, or alter clinical treatment quality because you exercise statutory privacy rights.

Global Privacy Control (GPC)

Our website recognizes and respects the global privacy control (GPC) browser signal. When your browser transmits the Sec-GPC: 1 header, our consent framework automatically treats this transmission as an affirmative, universal opt-out request for non-essential measurement and advertising tracking, disabling those tags without requiring you to manually dismiss the cookie banner.

Age Requirement & Protection of Minors

Velviques is a specialized aesthetic skincare clinic offering cosmetic procedures strictly restricted to adults aged 18 and older. We do not knowingly solicit, collect, or maintain personal information from individuals under the age of 18. If a parent or guardian discovers that a minor has submitted consultation details through velviques.click, please notify our office immediately at office@velviques.click; we will promptly purge the corresponding record from our database.

Regulatory Complaints & Supervisory Authorities

If you believe Velviques has failed to uphold statutory privacy obligations, you have the right to lodge a formal complaint with the relevant regulatory agency:

• Colorado Residents: Office of the Colorado Attorney General, Consumer Protection Section, Ralph L. Carr Colorado Judicial Center, 1300 Broadway, 10th Floor, Denver, CO 80203.
• California Residents: California Privacy Protection Agency (CPPA) or Office of the California Attorney General.
• European Visitors: The national Data Protection Authority (DPA) in your country of residence.

Submitting a Data Subject Access Request (DSAR)

To exercise your rights of access, correction, portability, or deletion, please transmit your request in writing to our clinical data desk at office@velviques.click or submit our formal Data Request Form. To protect client confidentiality, we verify identity using your matching email address or phone record. We will confirm receipt and provide a complete response within 10 days, without administrative fee.

Revisions to This Privacy Notice

Velviques reserves the right to amend this Privacy Policy to reflect evolving clinical offerings, statutory mandates, or advertising network standards. Any modifications will be posted directly to velviques.click with an updated effective date displayed prominently at the head of the document.

Contacting Our Clinical Office

For any questions regarding this Privacy Notice, clinical intake security, or our handling of procedural notes, please contact our Denver studio: