Privacy Policy
Last updated July 22, 2026
Scope
This Policy describes how MedAestheticsOS ("we") handles information from Clinics, their staff, and their patients. When we process patient PHI on behalf of a Clinic, we act as a HIPAA Business Associate under a signed BAA; the Clinic is the Covered Entity and its Notice of Privacy Practices governs uses and disclosures to patients.
Information We Collect
Account info (name, email, role), Clinic settings, appointments and clinical notes entered by staff, patient contact and history entered by staff or the patient portal, billing/payment metadata (payment card data is handled by our PCI-compliant processor and not stored on our servers), device and log data (IP, user agent, timestamps), and content of communications routed through the Service.
How We Use It
To provide and operate the Service, secure the platform, prevent fraud, support customers, comply with law, and improve product features. We do NOT sell personal information. We do NOT use PHI to train third-party AI models.
Sharing
We share limited data with sub-processors (hosting, database, email, SMS, payments, AI inference) bound by written contracts and, for PHI, by Business Associate Agreements. A current sub-processor list is available on request.
Security
TLS 1.2+ in transit, AES-256 at rest, row-level access controls, tenant isolation, immutable audit logging of PHI access, MFA-eligible admin accounts, and least-privilege internal access. Report suspected incidents to support@medaestheticsos.io.
Retention
We retain Clinic data for the life of the account plus a 30-day export window, then delete per schedule. Audit logs are retained for at least 6 years to satisfy HIPAA §164.316(b)(2).
Your Rights
Patients: contact your Clinic first — they control your record. You may also email support@medaestheticsos.io. Residents of California, Colorado, Virginia, and other US states with comprehensive privacy laws have rights to access, correct, delete, and appeal, subject to HIPAA exceptions. EU/UK residents: we act only as a processor at the Clinic's direction.
Children
The Service is not directed to children under 13. Minors under 18 may only appear in the Service as patients of a Clinic where a parent or guardian has consented in-clinic.
International Transfers
Servers are located in the United States. By using the Service you consent to processing in the US.
Changes
Material changes will be posted with 30 days' notice by email to account owners.
Contact
support@medaestheticsos.io
This document is provided for informational purposes and is not legal advice. Clinics should have counsel review before onboarding.