Privacy Policy
Last updated July 27, 2026
Scope
This Policy describes how MedAestheticsOS ("we") handles information from Clinics, their staff, and their patients. When we process patient PHI on behalf of a Clinic, we act as a HIPAA Business Associate under a signed BAA; the Clinic is the Covered Entity and its Notice of Privacy Practices governs uses and disclosures to patients.
Information We Collect
Account info (name, email, role), Clinic settings, appointments and clinical notes entered by staff, patient contact and history entered by staff or the patient portal, billing/payment metadata (payment card data is handled by our PCI-compliant processor and not stored on our servers), device and log data (IP, user agent, timestamps), and content of communications routed through the Service.
How We Use It
To provide and operate the Service, secure the platform, prevent fraud, support customers, comply with law, and improve product features. We do NOT sell personal information. We do NOT use PHI to train third-party AI models.
Sharing
We share limited data with sub-processors (hosting, database, email, SMS, payments, AI inference) bound by written contracts and, for PHI, by Business Associate Agreements. A current sub-processor list is available on request.
Security
TLS 1.2+ in transit, AES-256 at rest, row-level access controls, tenant isolation, immutable audit logging of PHI access, MFA-eligible admin accounts, and least-privilege internal access. Report suspected incidents to support@medaestheticsos.io.
Retention
We retain Clinic data for the life of the account plus a 30-day export window, then delete per schedule. Audit logs are retained for at least 6 years to satisfy HIPAA §164.316(b)(2).
Your Rights
Patients: contact your Clinic first — they control your record. You may also email support@medaestheticsos.io. Residents of California, Colorado, Virginia, and other US states with comprehensive privacy laws have rights to access, correct, delete, and appeal, subject to HIPAA exceptions. EU/UK residents: we act only as a processor at the Clinic's direction.
Children
The Service is not directed to children under 13. Minors under 18 may only appear in the Service as patients of a Clinic where a parent or guardian has consented in-clinic.
International Transfers
Servers are located in the United States. By using the Service you consent to processing in the US.
Third-Party Social & Video Platform Integrations
Clinics and MedAestheticsOS staff may connect third-party social, messaging, and video platforms (including YouTube, Google Business Profile, Meta/Facebook/Instagram, TikTok, LinkedIn, X, and others) to publish marketing content and read basic analytics. When you authorize a connection via OAuth, we receive and store only the access and refresh tokens and the minimum profile identifiers required to publish on your behalf. Tokens are encrypted at rest (AES-256-GCM) and are used solely to perform actions you initiate or schedule inside MedAestheticsOS. We do not sell, share, or use this data for advertising, and we do not use it to train AI models.
YouTube API Services Disclosure
The YouTube integration is built using YouTube API Services. By connecting a YouTube channel to MedAestheticsOS you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms) and acknowledge that Google's Privacy Policy (https://policies.google.com/privacy) applies to Google's handling of your data. MedAestheticsOS accesses YouTube API Services only to (a) upload videos you or your staff create or approve inside the app, (b) manage those uploads' titles, descriptions, thumbnails, privacy status, and captions, and (c) read basic channel and video metrics (views, likes, comments, subscriber counts) to display in your dashboard. We store the minimum data required for these functions. You may revoke MedAestheticsOS's access to your YouTube data at any time via Google's security settings at https://myaccount.google.com/permissions, and you may request deletion of any YouTube-derived data we hold by emailing support@medaestheticsos.io. Data obtained through YouTube API Services is not shared with third parties for advertising, not used for automated decisioning, and not used to train generalized AI/ML models.
Changes
Material changes will be posted with 30 days' notice by email to account owners.
Contact
support@medaestheticsos.io
This document is provided for informational purposes and is not legal advice. Clinics should have counsel review before onboarding.