Privacy Policy

Last updated: May 2, 2026

This Privacy Policy describes how GlowEngine, LLC (“GlowEngine,” “we,” “us,” or “our”) collects, uses, and shares information about you when you use the GlowEngine platform, including our web application, iOS app, Android app, and public booking pages (collectively, the “Service”).

1. Who We Are

GlowEngine is a practice management and booking platform for licensed medical spa and aesthetic practices. If you have questions about this policy, contact us at support@glowengine.ai.

2. Practitioners and Patients

GlowEngine serves two distinct groups:

Practitioners (our customers) are licensed practices and their staff who subscribe to GlowEngine to manage appointments, patients, billing, and communications. Practitioners control the data stored in their GlowEngine account.

Patients are the clients of those practices who may interact with GlowEngine through a practice’s public booking page, appointment reminders, or the practice’s use of the GlowEngine app. Patients are the customers of the practicing business, not of GlowEngine directly.

Under GDPR and similar frameworks, GlowEngine acts as a data processor (and the practice acts as the data controller) with respect to patient personal data that practices upload or collect through the Service. Practitioners are responsible for having a lawful basis to collect and process their patients’ data and for providing their patients with any required disclosures.

3. Information We Collect

3a. Information Practitioners Provide

When a practice or provider creates a GlowEngine account, we collect:

• Account information: name, email address, phone number, practice name, and professional role.
• Authentication credentials: passwords (stored as hashed values, never in plaintext) or OAuth tokens from Google Sign-In, Apple Sign In, or Facebook Login.
• Payment and billing data for the practice’s GlowEngine subscription. Card numbers are processed directly by Stripe; we do not store full card numbers.
• Stripe Connect onboarding data (bank account and identity information entered during Stripe Connect setup). This data is collected and stored by Stripe, not by GlowEngine.
• Profile photos and practice branding assets uploaded to the platform.

3b. Information About Patients

Practitioners enter or import patient data into GlowEngine on behalf of their practice. This data may include:

• Contact information: name, email address, phone number.
• Appointment and booking records: service type, date, time, assigned provider, appointment status, and notes.
• Health-related and treatment data: treatment notes, service histories, consent form responses, and visit photographs. This data may qualify as protected health information (PHI) in jurisdictions that recognize that concept, including under HIPAA in the United States. See Section 7 (HIPAA) below.
• Patient contact data imported via device contacts (iOS and Android): name, phone number, and email address, captured only when a practitioner explicitly selects contacts using the system contacts picker.
• SMS and in-app message content sent between the practice and the patient.
• Invoice and payment records for patient appointments.

3c. Information We Collect Automatically

When you use the Service, we collect:

• Log data: IP address, browser type, operating system, app version, and the pages or screens you visit.
• Device information: device model, operating system version, and unique device identifiers (on mobile).
• Usage data: features used, actions taken, and time spent in the app.
• Session tokens stored in your device keychain (mobile) or browser session storage (web).

3d. Public Booking Page

When a patient books an appointment through a practice’s public booking page, we collect the information the patient submits: name, phone number, email address, and the selected service and time slot. This information is associated with the practice’s GlowEngine account.

4. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Service.
• Authenticate users and maintain account security.
• Process payments for practice subscriptions via Stripe.
• Route patient payment transactions through the practice’s Stripe Connect account.
• Send appointment confirmation and reminder messages to patients on behalf of practices via SMS (Twilio) and email (AWS SES).
• Enable practitioners to manage patient records, appointments, invoices, and consent forms.
• Monitor service health and investigate errors and security incidents.
• Comply with legal obligations.

We do not sell personal data. We do not use patient health or treatment data for advertising.

5. Sub-Processors and Third Parties

We share data with the following service providers as necessary to operate the Service:

We do not use Apollo Client Cloud or any third-party GraphQL analytics service; the Apollo SDK is used only for client-side network transport.

We may share information if required by law, legal process, or to protect the rights and safety of GlowEngine, our customers, or the public.

6. Data Retention

We retain practitioner account data for the life of the subscription plus a reasonable wind-down period (currently 90 days after account cancellation) to allow data export.

Patient appointment records, treatment notes, consent forms, and visit photographs are subject to medical records retention requirements that vary by state (typically 7 to 10 years for adults and longer for minors). Practices are responsible for ensuring their data retention and deletion practices comply with applicable law. GlowEngine will retain this data for at least the duration of the practice’s active subscription; practices may export their data at any time.

After the retention period, we delete or anonymize personal data.

7. HIPAA

GlowEngine may operate as a HIPAA Business Associate when the Service is used by a HIPAA-covered entity (such as a medical practice) to process protected health information. In that case, a Business Associate Agreement (BAA) is available upon request. Practices that are HIPAA-covered entities should request a BAA before uploading PHI to the Service.

GlowEngine implements administrative, technical, and physical safeguards consistent with HIPAA Security Rule requirements, including encrypted data storage (AES-256), encrypted data in transit (TLS 1.2+), access controls, and audit logging.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: request that we correct inaccurate data.
• Deletion: request that we delete your data, subject to legal retention requirements.
• Portability: receive your data in a machine-readable format.
• Opt-out of sale: we do not sell personal data, so this right does not apply.
• CCPA rights: California residents may exercise the rights described above and may designate an authorized agent to make requests on their behalf.
• GDPR rights: EEA and UK residents have the above rights plus the right to lodge a complaint with a supervisory authority.

Patients who wish to exercise these rights should contact the practice that holds their records. Practices can contact us at support@glowengine.ai for assistance.

9. Cookies and Tracking

The public booking page and web application use a session cookie to maintain login state. We do not use third-party advertising cookies or cross-site tracking on any GlowEngine page. We do not participate in cross-context behavioral advertising.

10. Children

The Service is not directed at individuals under the age of 13 (or 16 for users in the EEA). We do not knowingly collect personal information from children. Practices that treat minor patients are responsible for obtaining any required parental consent for data processing.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify practitioners via email or a prominent notice in the app at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

12. Contact

For questions about this Privacy Policy or to exercise your rights, contact us:

GlowEngine
Email: support@glowengine.ai