Effective Date: September 1, 2026
Entity: Apex Formula LLC (“Company”, “Apex Formula”)
Platform Name: Apex Formula Dashboard
Apex Formula LLC functions as a Business Associate (BA) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) when providing digital marketing, lead management, and CRM services to medical spas and covered healthcare providers (Covered Entities).
To maintain legal compliance and safeguard Protected Health Information (PHI), Apex Formula LLC executes a formal Business Associate Agreement (BAA) with each medical spa client prior to onboarding or processing any patient data.
Apex Formula LLC utilizes a private-labeled platform, branded and operated as the Apex Formula Dashboard.
HIPAA-Compliant Hosting Subscriptions: Apex Formula LLC operates on dedicated HIPAA-compliant architecture.
Upstream Business Associate Agreement: Apex Formula LLC application host operates as an upstream Business Associate to Apex Formula LLC, providing an underlying BAA that covers database storage, processing, and system infrastructure.
Data Encryption: All Protected Health Information (PHI) and ePHI stored within or transmitted through the Apex Formula Dashboard are encrypted using industry-standard AES-256 bit encryption at rest and TLS 1.2/1.3 encryption in transit.
Access Control & Auditing: The Apex Formula Dashboard enforces Role-Based Access Control (RBAC), multi-factor authentication (MFA), session timeouts, and comprehensive audit logging to track user access to lead and patient records.
When executing advertising campaigns on Meta platforms (Facebook & Instagram) for medical spas, Apex Formula LLC enforces strict data separation guidelines to ensure Meta does not receive unauthorized PHI or health-related identifier data.
Leads collected through Meta Instant Forms transmit submission data directly into the Apex Formula Dashboard via secure API integrations.
Lead information (Name, Email, Phone Number, Consultation Request) enters the HIPAA-compliant environment of the Apex Formula Dashboard immediately upon capture.
No Unencrypted PHI Transmission: Meta Pixels and CAPI setups on landing pages managed by Apex Formula LLC strictly exclude any PHI, sensitive medical questionnaires, or treatment selection data.
Standard Web Events Only: Tracking is limited to non-sensitive engagement metrics (e.g., page views, form submission confirmations) using standard hashed parameter identifiers permitted by Meta guidelines.
Landing Page Isolation: Online booking engines, medical intake forms, and health questionnaires are hosted on HIPAA-compliant endpoints separated from basic advertising tracking pixels.
The Apex Formula Dashboard facilitates patient and prospect communications via automated SMS, email, and phone workflows.
Patient Opt-In & Consent: All lead forms and booking flows managed by Apex Formula LLC require explicit, documented consent from the individual authorizing automated text and email communications.
Minimum Necessary Standard: Automated notification messages (SMS/Email) sent via the Apex Formula Dashboard follow the HIPAA "Minimum Necessary" standard—avoiding specific medical terms, diagnosis information, or treatment specifics in unencrypted channels.
Business Associate Telephony & Email: Integrated communication APIs (e.g., LeadConnector / Twilio / LC Mail) utilized within the dashboard operate under compliant HIPAA settings with active BAAs where applicable.
Apex Formula LLC maintains internal administrative procedures to protect client data integrity:
Staff Training: All Apex Formula LLC employees and contractors handling client accounts undergo annual HIPAA security awareness training.
Least Privilege Access: Internal access to client instances within the Apex Formula Dashboard is restricted exclusively to personnel actively managing or supporting the account.
Incident Response Plan: Apex Formula LLC maintains an internal breach notification protocol to notify affected Covered Entities without unreasonable delay in the event of any suspected security incident.
This document provides an operational and technical compliance overview of how Apex Formula LLC structures its software and marketing infrastructure. This document does not constitute legal counsel. Medical spa clients are advised to consult their own healthcare legal advisors to ensure their complete marketing and intake workflows adhere to local, state, and federal regulations.