Your clients share a lot with you: medical history, medications, photos of their face and body, and notes about what they hope to change. As a med spa owner, protecting that information is part of the job, and the software you choose either makes that easier or harder. GlowScript was built inside a working med spa, so we designed it with HIPAA-focused safeguards from the start rather than adding them later.
This page explains what those safeguards are, in plain language, so you can judge them for your own practice. GlowScript gives you tools that support your HIPAA program. It does not replace your own policies, staff training or risk assessment, and no software alone can meet HIPAA for you.
Encryption everywhere your data goes
Everything stored in GlowScript is encrypted at rest with AES-256, using AWS Key Management Service. That includes the database, uploaded files such as consent forms and treatment photos, and backups. Data moving between your browser and GlowScript is encrypted in transit with TLS 1.2 or higher. The database sits inside a private network with no public internet access, and credentials are kept in a secrets manager instead of in code.
The right people see the right records
HIPAA expects you to limit access to the minimum each person needs. GlowScript supports that with:
- Multi-factor authentication available for sign-in.
- Role-based access, so a front desk role and an injector role can see different things.
- Automatic session timeout, so an unattended screen at the front desk does not stay open.
- Invite-only onboarding, so staff join your practice only when you add them.
A record of who did what
GlowScript logs account activity such as changes to records, along with infrastructure logging and monitoring on our side.
PHI stored in AWS US regions
PHI in GlowScript is stored in AWS US regions. GlowScript runs on AWS under a signed AWS Business Associate Addendum, and uses services such as Aurora PostgreSQL, CloudFront with a web application firewall, Cognito for identity with MFA available, KMS for keys and CloudTrail for API activity logs. Encrypted, automated database backups support point-in-time recovery.
Glow AI and protected health information
Glow AI, the assistant built into GlowScript, works on your own practice data to draft follow-ups, prep the day and answer questions such as "who hasn't rebooked since April?" Glow AI runs under role-based permissions, and nothing it drafts is sent without staff approval.
Consent and charting that support your records
Custom consent forms with e-signatures and version control, plus before and after photos stored with the client record, help keep documentation in one encrypted place instead of in paper files or a shared phone.
Messaging defaults
Transactional texts, such as appointment reminders, are on by default and clients can opt out. Marketing texts are opt-in only.
Business Associate Agreement
GlowScript publishes a Business Associate Agreement at /baa that applies to subscribing practices. See our BAA page for details.
Try it in your own practice
GlowScript is $299 per location per month, with every feature included. Start a 30-day trial, card required, before your first charge. If you have a question while you set things up, ask Glow AI inside the app.