This Privacy Policy describes how CG Cosmetic Surgery, operating as Coral Gables Cosmetic Center® (“CG Cosmetic,” “we,” “us,” or “our”), collects, uses, shares, retains, and deletes information in connection with CG-Suite — our internal customer-relationship-management and marketing platform and the software application of the same name registered with Meta and other platform providers. CG-Suite is owned and operated by CG Cosmetic Surgery, a cosmetic and plastic surgery practice located in Miami, Florida, United States.
CG-Suite is the proprietary platform of CG Cosmetic Surgery (Coral Gables Cosmetic Center®). We use CG-Suite to manage prospective and existing patient inquiries, conversations, appointments, marketing campaigns, and advertising performance across the communication and advertising channels our practice uses. This policy applies to the CG-Suite application and any data CG-Suite processes on our behalf, including data we access through connected provider accounts such as Meta (Facebook and Instagram), WhatsApp Business, TikTok, and Google.
Our business and the owner of the CG-Suite application is:
CG Cosmetic Surgery (Coral Gables Cosmetic Center®)This policy covers the CG-Suite platform: a private, staff-facing business application used by authorized CG Cosmetic personnel. CG-Suite is not a consumer product and does not offer public sign-ups. It processes information about people who contact our practice or interact with our advertising, business pages, messaging accounts, and forms. Information collected through our public website is additionally governed by the CG Cosmetic Surgery website Privacy Policy.
We collect the following categories of information through CG-Suite:
With the proper authorizations granted by our practice, CG-Suite connects to third-party provider accounts that we own or control and processes data those providers make available to us. We request only the access needed to operate our business. Specifically:
| Provider | What CG-Suite accesses |
|---|---|
| Meta — Facebook & Instagram | Page and profile messages and comments, Lead Ads form submissions, advertising insights/metrics, and basic Page/account identity for the business assets we manage. Accessed via the Meta Graph API. |
| WhatsApp Business | Business messaging conversations and message metadata for our WhatsApp Business numbers. |
| TikTok | Lead Ads submissions, advertising insights, and organic comments on our business content. |
| Google Ads performance metrics and Google Business Profile reviews for our locations. | |
| Telephony & SMS | Call records, recordings/transcripts, and SMS content handled through our telephony and messaging providers. |
| CRM / automation | Contact, conversation, and opportunity records synchronized with our CRM and automation tooling. |
WhatsApp Business and Instagram are products of Meta Platforms, Inc. Data accessed through WhatsApp Business and Instagram is governed by the Meta Platform Terms and Developer Policies in addition to this policy, just as Facebook data is.
To operate the features above, CG-Suite may request the following Meta (Graph API) permissions, each used only for the stated purpose and only for the business assets our practice owns:
| Permission | Why we request it |
|---|---|
pages_show_list, pages_read_engagement, pages_manage_metadata | Identify and manage the Facebook Pages our business owns and read engagement on them. |
pages_messaging | Send and receive messages with people who contact our Pages. |
leads_retrieval | Retrieve Lead Ads form submissions from our advertising. |
ads_read | Read advertising performance metrics for the ad accounts we own. |
business_management | Manage the business assets (Pages, ad accounts) we own through Meta Business. |
read_insights | Read aggregated Page and post insights for performance reporting. |
instagram_basic, instagram_manage_comments, instagram_manage_messages | Manage comments and messages on the Instagram professional accounts we own. |
whatsapp_business_messaging, whatsapp_business_management | Send and receive WhatsApp Business messages and manage our WhatsApp Business account. |
We use, store, and share platform data only as described in this policy and in accordance with each provider’s platform terms and developer policies, including the Meta Platform Terms and Developer Policies.
Where CG-Suite uses artificial-intelligence features (for example, to summarize conversations or suggest replies), those features operate on the data above to assist our staff. We do not use platform data to build profiles for unrelated purposes, and we do not sell it.
Where applicable law (such as the EU/UK GDPR) requires a legal basis, we rely on: your consent (e.g., when you submit a form or opt in to messaging); our legitimate interests in operating and promoting our practice and securing our systems; performance of a contract or steps taken at your request; and compliance with legal obligations.
We share information only as needed and with appropriate safeguards:
We do not sell your personal information for money, and we do not share it for cross-context behavioral advertising in a manner that would require an opt-out under applicable U.S. state law. We honor recognized opt-out preference signals, including the Global Privacy Control (GPC), where required.
We do not share any medical, health-condition, treatment, or diagnosis information with advertising platforms. Procedure interest you voluntarily share with us is used only to respond to your inquiry and to provide the services you request.
We retain information only as long as necessary for the purposes described in this policy. Our standard retention periods are:
| Data category | Retention period |
|---|---|
| Contact & lead records | For the duration of the relationship and up to 7 years after the last interaction, then deleted or de-identified. |
| Conversations & messages (SMS, WhatsApp, social, email) | Up to 7 years from the date of the message. |
| Call recordings & transcripts | Up to 24 months, unless required longer for a specific legal or quality-assurance purpose. |
| Advertising performance metrics | Retained in aggregated / de-identified form for historical reporting. |
| Technical & access logs | Up to 12 months. |
We may retain information for a longer period where required by law, to resolve disputes, or to enforce our agreements. Platform data is also removed in accordance with the relevant provider’s requirements and your deletion requests (see Data deletion).
CG-Suite is a restricted, authenticated business application. We use administrative, technical, and organizational safeguards — including access controls, encryption in transit, and role-based permissions — designed to protect information. No method of transmission or storage is completely secure, but we work to protect your information and to limit access to authorized personnel.
Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, to opt out of certain processing, and to be free from discrimination for exercising these rights. These include rights under the California Consumer Privacy Act (CCPA/CPRA), the Florida Digital Bill of Rights, and the EU/UK GDPR, where applicable.
To exercise any right, contact us at [email protected]. We will verify your request and respond within the timeframe required by applicable law. You may use an authorized agent where the law permits.
You may request deletion of personal information we hold about you, including data obtained through Meta (Facebook/Instagram), WhatsApp, TikTok, or Google in connection with CG-Suite. A standalone copy of these instructions is published at https://api.cg-suite.com/legal/data-deletion.
If you interacted with us through Facebook or Instagram and wish to revoke CG-Suite’s access, you can also remove the connection from your Meta account’s Settings → Apps and Websites. To request deletion of data we obtained through that connection, follow the steps above.
CG-Suite is the application operated by CG Cosmetic Surgery and submitted for review with Meta. We comply with the Meta Platform Terms and Developer Policies. We access Meta Platform Data only for the legitimate business purposes described in this policy, retain it only as long as necessary, do not sell it, do not transfer it to data brokers, and provide the data-deletion mechanism described above. Our use of information received from Meta APIs adheres to Meta’s Limited Use requirements.
CG-Suite’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google user data only to provide and improve the features described in this policy, do not transfer it to others except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger or acquisition, do not use it for serving advertising, and do not allow humans to read it except with your affirmative consent, where necessary for security or to comply with applicable law, or where the data has been aggregated and de-identified.
Our access to and use of TikTok data complies with the TikTok Developer Terms of Service and related TikTok developer policies. We use TikTok data only for the purposes described in this policy, retain it only as long as necessary, and do not sell it.
CG-Suite is an authenticated staff application and uses only the cookies and local storage necessary to operate (such as keeping you signed in and storing your interface preferences). Marketing and analytics cookies used on our public website are described in the CG Cosmetic Surgery website Privacy Policy.
CG-Suite is intended for use by our authorized staff and is not directed to children. We do not knowingly collect personal information from children under 13 (or the minimum age required by local law). If you believe a child has provided us information, contact us and we will delete it.
CG Cosmetic Surgery operates from the United States and is subject to U.S. law. If you access our services from outside the United States, you understand that your information may be processed in the United States, where data protection laws may differ from those in your country.
Where we transfer personal data of individuals in the European Economic Area, the United Kingdom, or Switzerland to the United States or to our sub-processors, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) (and the UK Addendum, where applicable), together with supplementary measures as needed. Our sub-processors are bound by contractual data-protection obligations and may process personal data only on our instructions. EU/UK/Swiss users may contact us at [email protected] to obtain information about these transfer mechanisms or to reach our privacy contact for GDPR matters.
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above. Material changes will be communicated as required by applicable law.
For privacy questions, requests, or concerns, contact us:
CG Cosmetic Surgery (Coral Gables Cosmetic Center®)