Privacy Policy

Last updated: October 21, 2026

This Privacy Policy is pending legal review and may change.

This Privacy Policy describes how GlowEngine, LLC (“GlowEngine,” “we,” “us,” or “our”) collects, uses, and shares information about you when you use the GlowEngine platform, including our web application, iOS app, Android app, and public booking pages (collectively, the “Service”).

1. Who We Are

GlowEngine is a practice management and booking platform for licensed medical spa and aesthetic practices. If you have questions about this policy, contact us at support@glowengine.ai.

2. Practitioners and Patients

GlowEngine serves two distinct groups:

Practitioners (our customers) are licensed practices and their staff who subscribe to GlowEngine to manage appointments, patients, billing, and communications. Practitioners control the data stored in their GlowEngine account.

Patients are the clients of those practices who may interact with GlowEngine through a practice’s public booking page, appointment reminders, or the practice’s use of the GlowEngine app. Patients are the customers of the practicing business, not of GlowEngine directly.

Under GDPR and similar frameworks, GlowEngine acts as a data processor (and the practice acts as the data controller) with respect to patient personal data that practices upload or collect through the Service. Practitioners are responsible for having a lawful basis to collect and process their patients’ data and for providing their patients with any required disclosures.

3. Information We Collect

3a. Information Practitioners Provide

When a practice or provider creates a GlowEngine account, we collect:

• Account information: name, email address, phone number, practice name, and professional role.
• Authentication credentials: passwords (stored as hashed values, never in plaintext) or account identifiers from Google Sign-In, Sign in with Apple, or Facebook Login. If you sign in with Facebook, we receive your name, email, and public profile information as permitted by the email and public_profile permissions.
• If a practice connects an Instagram account, the access token and account identifiers needed to publish posts and to receive and send direct messages on the practice’s behalf.
• Payment and billing data for the practice’s GlowEngine subscription. Card numbers are processed directly by Stripe; we do not store full card numbers.
• Stripe Connect onboarding data (bank account and identity information entered during Stripe Connect setup). This data is collected and stored by Stripe, not by GlowEngine.
• Profile photos and practice branding assets uploaded to the platform.

3b. Information About Patients

Practitioners enter or import patient data into GlowEngine on behalf of their practice. This data may include:

• Contact information: name, email address, phone number.
• Appointment and booking records: service type, date, time, assigned provider, appointment status, and notes.
• Health-related and treatment data: treatment notes, service histories, consent form responses, and visit photographs. This data may qualify as protected health information (PHI) in jurisdictions that recognize that concept, including under HIPAA in the United States. See Section 7 (HIPAA) below.
• Patient contact data imported via device contacts (iOS and Android): name, phone number, and email address, captured only when a practitioner explicitly selects contacts using the system contacts picker.
• SMS message content sent between the practice and the patient, and SMS consent records.
• Instagram direct messages between the practice and people who message its connected Instagram account, and the sender’s Instagram name, username and profile picture.
• Invoice and payment records for patient appointments.

3c. Information We Collect Automatically

When you use the Service, we collect:

• Log data: IP address, browser type, operating system, app version, and the pages you visit and requests you make.
• Device information: device model, operating system version, and unique device identifiers (on mobile).
• Usage data: features used and actions taken, recorded in our server logs and account records.
• Crash reports from our mobile apps, which include the device model, operating system version, app version, and technical details of the error.
• Session credentials: on the web, an HttpOnly session cookie; on iOS, the device keychain; on Android, encrypted app storage.

3d. Public Booking Page

When a patient books an appointment through a practice’s public booking page, we collect the information the patient submits: name, phone number, email address, the selected service and time slot, and the patient’s SMS consent choices. If the practice requires a card on file or a deposit, the patient’s card details are entered into a Stripe payment form and are collected and stored by Stripe, not by GlowEngine. This information is associated with the practice’s GlowEngine account.

4. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Service.
• Authenticate users and maintain account security.
• Process payments for practice subscriptions via Stripe.
• Route patient payment transactions through the practice’s Stripe Connect account, including deposits and fees charged to a card the patient saved at booking under the practice’s policies.
• Send appointment confirmation and reminder messages, and marketing and automated messages sent at the practice’s direction, to patients on behalf of practices by SMS (Twilio).
• Send account emails to practitioners and staff, such as email verification and password reset messages, through AWS SES.
• Enable practitioners to manage patient records, appointments, invoices, and consent forms.
• Receive, display and reply to Instagram direct messages in the practice’s Inbox, and publish posts through the practice’s connected Instagram account, when the practice connects one.
• Monitor service health and investigate errors and security incidents.
• Comply with legal obligations.

We do not sell personal data. We do not use patient health or treatment data for advertising. We do not use information obtained through Facebook Login for advertising.

5. Sub-Processors and Third Parties

We share data with the following service providers as necessary to operate the Service:

We do not use Apollo Client Cloud or any third-party GraphQL analytics service; the Apollo SDK is used only for client-side network transport.

No mobile information, including phone numbers and SMS opt-in data and consent, will be shared with third parties or affiliates for their marketing or promotional purposes. The sub-processors above receive this information only to operate the Service.

We may share information if required by law, legal process, or to protect the rights and safety of GlowEngine, our customers, or the public.

6. Data Retention and Deletion

6a. Deleting your account

You can delete your account at any time from within the app. Open Operations and choose Delete Account. This is available in the web, iOS, and Android apps.

Deleting your account removes your ability to sign in and anonymizes your user profile (your name, email address, phone number, password, and profile photo). This cannot be undone. Some identifiers may remain in our records after deletion, such as the account identifier and email address associated with a linked sign-in provider and your practitioner profile details, as well as in our backups. To ask us to remove these as well, email support@glowengine.ai.

Some records are retained after an account is deleted. Practices that use GlowEngine are healthcare providers with obligations to retain patient clinical records (such as appointments, treatment notes, and consent records) for a period required by applicable law. These practice-owned records are retained by the practice and are not removed when an individual account is deleted. If you need a copy of records associated with your practice, email us at support@glowengine.ai and we will assist you.

If you are the sole owner of a practice, deleting your account closes the practice: it signs out all staff, takes down the practice’s public booking page, and disables payments. Patient records are retained as described above. This cannot be undone.

6b. Facebook data deletion

If you signed in with Facebook, deleting your account in the app, as described above, also disconnects your Facebook identity from GlowEngine.

If you remove GlowEngine from your Facebook settings (under “Settings & privacy” and then “Apps and websites”), we disconnect your Facebook login from GlowEngine right away, and Facebook gives you a confirmation code. This does not by itself delete the name and email address we received from Facebook. To delete that information, delete your account in the app as described above, or email support@glowengine.ai (include your confirmation code if you have one, which you can also use to ask about the status of your request). We respond to emailed deletion requests within 30 days.

6c. Retention periods

We keep practice data while the subscription is active and for at least 90 days after cancellation, during which a practice can request a copy of its data. On request, GlowEngine will provide an export of the practice’s data. After that period, we delete or return practice data on request, subject to the medical records retention described below. Copies may persist in our backups for a limited period after deletion.

Patient appointment records, treatment notes, consent forms, and visit photographs are subject to medical records retention requirements that vary by state (typically 7 to 10 years for adults and longer for minors). Practices are responsible for ensuring their data retention and deletion practices comply with applicable law. GlowEngine will retain this data for at least the duration of the practice’s active subscription.

7. HIPAA

GlowEngine may operate as a HIPAA Business Associate when the Service is used by a HIPAA-covered entity (such as a medical practice) to process protected health information. In that case, a Business Associate Agreement (BAA) is available upon request. Practices that are HIPAA-covered entities should request a BAA before uploading PHI to the Service.

GlowEngine uses administrative, technical, and physical safeguards to protect PHI, including encryption of stored data (AWS-managed encryption for our database and AES-256 server-side encryption for file storage, which also blocks public access), encryption of data in transit (TLS 1.2 or higher), and access controls that limit each user to the practices they belong to. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: request that we correct inaccurate data.
• Deletion: request that we delete your data, subject to legal retention requirements.
• Portability: request a copy of your data in a machine-readable format, which we will provide on request.
• Opt-out of sale: we do not sell personal data, so this right does not apply.
• CCPA rights: California residents may exercise the rights described above and may designate an authorized agent to make requests on their behalf.
• GDPR rights: EEA and UK residents have the above rights plus the right to lodge a complaint with a supervisory authority.

Patients who wish to exercise these rights should contact the practice that holds their records. Practices can contact us at support@glowengine.ai for assistance.

9. Cookies and Tracking

The web application uses a session cookie to maintain login state, and stores a few interface preferences (such as your light or dark theme choice) in your browser’s local storage. Booking and payment pages load Stripe’s payment software, which sets Stripe’s own fraud-prevention cookies. We do not use third-party advertising cookies or cross-site tracking on any GlowEngine page. We do not participate in cross-context behavioral advertising. Our web pages load fonts from Google Fonts, which receives your IP address as described in Section 5.

10. Children

The Service is not directed at individuals under the age of 13 (or 16 for users in the EEA). We do not knowingly collect personal information from children. Practices that treat minor patients are responsible for obtaining any required parental consent for data processing.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify practitioners via email or a prominent notice in the app at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

12. Contact

For questions about this Privacy Policy or to exercise your rights, contact us:

GlowEngine
Email: support@glowengine.ai