GlowPilot ("we," "our," or "us") provides practice management software for beauty and aesthetic clinics. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our website, accounts, and clinic management platform. This is an interim policy pending incorporation of the operating company and review by counsel.
GlowPilot is used by clinics. Privacy roles differ depending on whose information is involved:
- Website, demos, and clinic staff accounts: GlowPilot is the controller of personal data you provide as a visitor, demo or contact lead, or clinic staff user (for example name, email, and login metadata).
- Patient and client records: Your clinic is the controller of patient and client information entered into GlowPilot. We process that information on the clinic's instructions to provide the Service (for example records, photos, consents, and communications the clinic chooses to send).
- Clinic responsibilities: Clinics are responsible for patient notices, lawful bases or consents, and clinical decisions. GlowPilot does not make medical decisions and does not replace the clinic's own privacy notices to patients.
Account, website, and clinic operations data
- Name, email address, phone number, clinic name, and staff role
- Patient and client identity and contact details entered by the clinic
- Appointment history, treatment records, notes, and related clinical information the clinic stores
- Clinical or before-and-after photos and related metadata (where the clinic uses photo features)
- Consent form records and e-signature status when those tools are enabled
- Public booking submissions and related marketing or UTM metadata when a clinic uses booking tools
- Message content and recipient details when the clinic uses email or messaging features (including WhatsApp when enabled)
- Billing and subscription contact details (payment cards are processed by third-party providers when payments are live)
- Demo and contact form contents submitted on our website
Usage Information
- Device information and IP address
- Browser type and operating system
- Pages visited and time spent on our platform
- Cookies, local storage, and similar technologies needed to run the Service (see our Cookie Policy)
- Provide and maintain clinic management services for the customer clinic
- Process appointments, records, photos, consents, and related workflows the clinic configures
- Operate clinic staff accounts, authentication, and support
- Send service emails and, when the clinic enables them, appointment or marketing messages the clinic chooses to send
- Respond to demo, contact, and support requests
- Improve the platform, diagnose issues, and develop features
- Comply with legal obligations and protect the security of the Service
- Prevent fraud, abuse, and unauthorized access
We implement technical and organizational measures designed to protect customer and patient data. Current practices include:
- Encryption in transit (TLS) for data sent over the internet
- Access controls and authentication for clinic staff accounts
- Clinic-scoped data isolation in the application
- Secure cloud storage for files such as photos, where those features are used
- Ongoing work to strengthen security controls as we prepare the product for production use with sensitive clinic data
Depending on your location, you may have the following rights regarding your personal information. Patients should typically contact their clinic first for records the clinic controls. Clinic staff and website visitors may contact us as described below.
- Access: Request a copy of your personal information
- Correction: Request correction of inaccurate information
- Deletion: Request deletion of your personal information
- Portability: Request transfer of your data to another service
- Restriction: Request limitation of processing activities
- Objection: Object to certain types of processing
A curated list of vendors that may process clinic or caller data is published on our subprocessors page. That page is an inventory, not a signed DPA or an AI Act certificate. Subprocessors.
We use cookies and similar technologies (including browser local storage) to operate the Service and remember preferences. Marketing cookies (the Meta pixel) load only after you opt in, and only on public pages. They are not used on patient, appointment, booking, or payment pages, and they are not filled with form data. If you opt in and submit a public lead or demo form, we send Meta a hashed version of that email so the conversion can be matched to an ad. You can manage non-essential cookies through our cookie consent banner or your browser settings.. Cookie Policy.
If you have any questions about this Privacy Policy or our data practices, please contact us. Until the operating company is incorporated, we publish a privacy email only (no registered address yet).
Email: privacy@getglowpilot.com
We may update this Privacy Policy from time to time. We will post the updated policy on this page and change the "Last updated" date. For material changes we will provide additional notice where appropriate. This interim policy will be replaced after incorporation and legal review.