Privacy Policy
Clinics trust us with some of the most personal information their clients share: their concerns, their treatments and their photos. This policy explains what we collect, why, and the limits we hold ourselves to.
Who this policy covers
This policy covers two groups. Clinics and their staff who use our clinic CRM, and the clients of those clinics whose details are entered into it. For client data, the clinic decides what is collected and why. We process it on the clinic's behalf and only on its instructions.
Data from this website
When you fill in our signup or contact form, we receive the details you type and use them to set up your trial or reply to you. We do not run advertising trackers on this website.
Before-and-after photos
- Photos can be taken only after the client signs a photo consent inside the Service.
- Photos are encrypted in transit and at rest.
- Only clinic staff with a role that allows photo access, and the client, can view them.
- Every view and download is recorded in an access log the clinic can review.
- Photos are never used for marketing, by the clinic or by us, unless the client signs a separate marketing consent.
Messages and opt-out
Reminders and follow-ups are sent only to clients the clinic has marked as having agreed to receive them. Every client can stop messages by replying with the opt-out word, and the opt-out applies across all branches of that clinic.
How AI is used
The AI Follow-up Assistant reads appointment and package data to decide when a reminder or reschedule message is due and fills in templates the clinic has written. It does not diagnose, recommend treatments or make claims about results. Client data is not used to train models outside the clinic's own account.
What we never do
- We never sell client or clinic data.
- We never use client data to advertise to clients.
- We never share photos with third parties except the storage provider that hosts them in encrypted form.
Service providers
We use carefully chosen providers for hosting, encrypted storage, email delivery and messaging. They process data only to run the Service and are bound by confidentiality and data protection terms.
Retention and deletion
Clinic data is kept while the account is active. When a clinic closes its account it can export its data, after which we delete it from active systems within 30 days and from backups within 90 days. A clinic can delete an individual client's record and photos at any time on that client's request.
Your rights
Clients who want to see, correct or delete their data should contact their clinic, which controls the record. Clinic staff and website visitors can write to us through the contact page to access, correct or delete their own account details.
Security
We use encryption, role-based access, access logs and regular backups. No system is perfectly secure, and if a breach affects a clinic's data we will inform the clinic without undue delay.
Contact
Questions about this policy can be sent through our contact page.