Main content

Legal

Privacy Policy

Last updated: October 16, 2026 · Previous policy effective September 14, 2026

GlowScript (“we,” “our,” “the platform”) is a practice management platform for med spas and aesthetic clinics, operated by Distinctly Developed LLC. This Privacy Policy explains what data we collect, how we use and protect it, and the rights you have regarding your information, including Protected Health Information (“PHI”) as defined under the Health Insurance Portability and Accountability Act (“HIPAA”).

Our Role Under HIPAA

GlowScript acts as a Business Associate under HIPAA. Your practice (the “Covered Entity”) owns and controls all client and patient data entered into the platform. We process PHI only as directed by your practice and in accordance with our Business Associate Agreement (“BAA”), which is executed with each practice during onboarding. A copy of our standard BAA is available at glowscript.ai/baa.

Information We Collect

Account & Practice Information

When you create an account, we collect identifiers such as your name, email address, phone number, and practice details (business name, address, license information) to provision your workspace and support your team.

Protected Health Information (PHI)

GlowScript stores data entered by your practice, which may include client profiles, appointment history, consent forms, treatment notes, clinical photographs, medical history, and communications. This information may constitute PHI under HIPAA and is treated with the highest level of protection. We do not access, use, or disclose PHI except as permitted by your BAA and applicable law.

Usage & Device Data

We collect usage analytics (pages viewed, features used, timestamps) and technical data (browser type, device information, IP address) to monitor system performance, detect security threats, and improve the platform. This data does not include PHI.

How We Use Data

  • —Provide core scheduling, charting, consent, photo management, and communication features
  • —Authenticate users with multi-factor authentication and enforce role-based access controls
  • —Deliver operational notifications, appointment reminders, and system alerts
  • —Monitor system performance, detect unauthorized access, and maintain audit logs
  • —Support integrations (e.g., Stripe for payments) configured by your practice
  • —Comply with legal obligations, including HIPAA requirements

Data Storage & Security

We implement administrative, technical, and physical safeguards to protect your data in accordance with the HIPAA Security Rule. Our security measures include:

  • —Encryption in transit: All data is transmitted over TLS 1.2 or higher (HTTPS)
  • —Encryption at rest: All data is encrypted using AES-256 with AWS Key Management Service (KMS) customer-managed keys
  • —Multi-factor authentication: Required for all user accounts using time-based one-time passwords (TOTP)
  • —Role-based access controls: Users can only access data appropriate for their role within the practice
  • —Audit logging: Our BAA commits to logging PHI access and retaining those logs for a minimum of six years. This contractual commitment is distinct from HIPAA requirements for retaining security policies and required documentation; it is not a universal retention rule for all logs
  • —Network isolation: Application infrastructure runs within a private virtual network with no direct public access to databases or internal services

All data is stored in the United States on Amazon Web Services (AWS) infrastructure covered by an AWS Business Associate Addendum. We do not transfer data outside the United States.

Sharing & Third Parties

We do not sell, rent, or trade your data. We share data only in the following circumstances:

  • —Infrastructure providers: AWS provides our hosting, database, and storage services under a BAA. No PHI is shared with AWS beyond what is necessary for data storage and processing.
  • —Payment processing: Stripe processes payments on your behalf. We do not share PHI with Stripe — only billing identifiers and transaction amounts necessary to process payments.
  • —Bank connections: If your practice connects a business bank, Plaid provides the connection and returns account and transaction data to GlowScript. We do not share PHI with Plaid.
  • —Practice-enabled integrations: If your practice enables third-party integrations, data may be exchanged according to your configuration. You are responsible for ensuring those services meet your compliance requirements.
  • —Legal requirements: We may disclose information if required by law, regulation, subpoena, or court order.

Breach Notification

In the event of a breach of unsecured PHI, we will notify affected practices without unreasonable delay and no later than 60 days after discovery of the breach, in accordance with the HIPAA Breach Notification Rule (45 CFR §§ 164.400–414). Our notification will include the nature of the breach, the types of information involved, steps we are taking to investigate and mitigate harm, and recommendations for affected individuals to protect themselves.

Data Retention

We retain your data for as long as your account is active. Audit logs related to PHI access remain subject to our minimum six-year contractual retention commitment. Upon account termination, you may request a full export of your data. After the export period (90 days), we will securely delete your data from our systems, except where retention is required by law or for legitimate compliance purposes.

We delete synced payroll-integration data within 30 days of disconnecting the integration, unless you reconnect to the same company before deletion or a documented retention hold applies. GlowScript-created commission records follow the account retention and export schedule above. Residual backups follow our backup expiration and restore-deletion process.

Optional Business Bank Connections

Practices may optionally connect a business bank account to GlowScript Accounting through Plaid. Only a practice owner or manager with Accounting management permission can start a connection, and they must complete a multi-factor authentication step for the current session and accept GlowScript’s banking data disclosure first. We keep a record of that acceptance. Plaid handles the connection to your bank; GlowScript does not receive your bank login password.

GlowScript requests Plaid’s Transactions product and retrieves account balances. We do not request Plaid Auth, and we do not receive or store full bank account or routing numbers; we store only the last digits (mask) of each account. Connecting a bank does not authorize GlowScript to move money, and GlowScript does not initiate payments or transfers from a connected account.

We collect and store account names, account types, masked account numbers, balances, and transaction details to display and track activity in Accounting. Activity is imported when the bank is first connected, when Plaid notifies us that new activity is available, and when authorized staff choose Import. Authorized staff with Accounting access can view imported activity. Imported transactions are not posted to the general ledger automatically; a journal entry is created only when authorized staff categorize or match a transaction. Transaction descriptions supplied by your bank may contain information you or your clients entered.

Plaid access tokens are encrypted with AES-256-GCM before storage, and banking data is stored in our encrypted database on AWS infrastructure covered by an AWS Business Associate Addendum. See Plaid’s End User Privacy Policy for Plaid’s own data practices.

Disconnecting

Owners and managers can disconnect a bank at any time. A successful disconnect removes the Plaid connection and deletes GlowScript’s stored access token, stopping future imports. If the disconnect fails, we report the error. When Plaid notifies us that access was revoked, we delete the stored access token even if Plaid cannot confirm removal. Removal requests are not automatically retried. Previously imported activity remains in Accounting until it is deleted under the retention terms below. A disconnect alone is not a deletion request.

Banking history retention and deletion

Banking history is retained while the practice uses Accounting. After a verified deletion request, or after the 90-day export period following termination, we complete deletion from active systems within 30 calendar days, unless a documented obligation requires retention. Backups expire on their normal cycle. To request deletion, contact privacy@glowscript.ai. Deleting GlowScript’s copies does not delete records held independently by your bank or by Plaid.

Residual backups remain protected and restricted until they expire, and applicable deletions are reapplied before any restored data returns to use. We keep a minimal deletion record until affected backups expire, then delete it within 90 calendar days. Banking consent records are kept while the associated banking data, including backups, remains, then deleted within 90 calendar days, unless a documented obligation requires longer retention. Clinical records follow the practice’s applicable retention requirements and the BAA, separately from banking data.

Your Rights

As a practice using GlowScript, you retain full control over your client data. Your clients may exercise rights under HIPAA through your practice directly. These rights include:

  • —Right to access: Patients may request copies of their health records
  • —Right to amendment: Patients may request corrections to their health records
  • —Right to an accounting of disclosures: Patients may request a record of when and to whom their PHI was disclosed
  • —Right to restrict disclosures: Patients may request restrictions on certain uses of their information

GlowScript will cooperate with your practice to fulfill these requests in accordance with our BAA.

Practice Controls

  • —Update practice and account information in Settings
  • —Manage team member access, roles, and permissions
  • —Export client data at any time
  • —Request account deletion by contacting support

Children's Privacy

GlowScript is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. Client records for minor patients are entered and managed by the practice, which is responsible for obtaining appropriate parental or guardian consent.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes are posted on this page with a new “Last updated” date.

Contact

For questions about this Privacy Policy, data protection, or to exercise your rights, contact our Privacy Officer at privacy@glowscript.ai.