Legal: Keeping a Secret

Collecting information about your clients, including health history and credit card numbers, is a routine part of the spa business. Safeguarding this information does more than protect your relationships. It can also save you a lawsuit.

If you release private information about clients, they have the right to sue you for a civil violation known as invasion of privacy. In part, privacy laws protect clients from a private disclosure of public facts. A privacy lawsuit might uphold in court even if the defendant can prove the facts disclosed are true, explains Legal Pad columnist Michael L. Antoline in the July issue of DAYSPA.

"[This law] refers to the dissemination of information about an individual to which a reasonable person would object," he writes. "The information subject to dissemination is generally factual, thus truth isn't a defense as in libel and slander cases."

To avoid costly litigation, make sure your employees adhere to a strict client confidentiality policy, Antoline suggests. Specifically stipulate a client's protection from the written or verbal disclosure of their private information. Make sure employees understand that they can't disclose this information under any circumstances, Antoline cautions. "Put a finer point on it by making it unacceptable for an employee to even discuss a client outside of the spa," he writes.

To ensure client confidentiality, make sure your computer system is equally safeguarded. A common way information is breached on computer systems is when employees (often ignorantly) download malicious software programs. To protect client databases and other confidential information, implement a policy that prohibits employees from modifying software in anyway, Antoline suggests. Also, consult with a computer expert to install a business-grade, hardware firewall system that protects confidential information.

Taking these precautions will help ensure clients that your spa does everything possible to safeguard their privacy. Telling clients about your polices will let them know that you respect their privacy, Antoline writes. Also, make them aware of every precautionary measure you take to protect their privacy. "Inform [clients] that all data is considered confidential and will never be disclosed unless required by law," Antoline suggests.