MedspAI, LLC ("MedspAI," "we," "us," or "our") provides a software platform for med spas and wellness businesses. This Privacy Policy explains how we collect, use, share, and protect information in connection with our platform and services ("Services").
This Policy applies to our business clients ("Clients") and, where applicable, to their patients and customers ("End Users") whose information is processed through the Services on Clients' behalf.
For End User information, MedspAI acts as a service provider to the Client. End Users with questions or requests about their information should contact the practice they communicated with.
If you have questions about this Policy, contact us at team@medspai.com.
When a Client creates an account, we collect:
When a Client adds team members to their account, we collect:
The Services process and store the following communication data:
When Clients use the contact management features, we store End User data provided by or collected on behalf of Clients, including:
Client is responsible for ensuring they have appropriate authorization to store and process End User data through the Services.
We store the configuration information Clients provide to set up the AI, including:
Payment processing is handled by Stripe. We do not store credit card numbers, bank account details, or other sensitive payment information on our servers. We store Stripe customer IDs and subscription identifiers to manage billing. For information on how Stripe handles payment data, see stripe.com/privacy.
We collect data about how Clients use the Services, including:
When a Client requests number porting, we collect:
This data is used solely to process the port request and is transmitted to our porting partner (Twilio) for that purpose. Account numbers and PINs submitted for porting are deleted from our systems within 30 days after the port is completed or cancelled.
Communications processed through the Services may include health information that End Users choose to share. Clients are responsible for determining whether their use of the Services meets their obligations under HIPAA and applicable state privacy laws.
We use the information we collect to:
We use third-party service providers to operate and deliver the Services:
When a Client connects its own CRM or scheduling system to the Services, we exchange contact and appointment data with that system at the Client's direction.
These providers process data on our behalf under their own terms and data protection commitments. We do not sell data or share it with third parties for their own purposes. We may update this list as the Services evolve.
We do not sell, rent, or trade personal information to third parties for their own marketing or commercial purposes.
We share data with service providers listed in Section 3, and other vendors, only to the extent necessary to operate and deliver the Services.
We may disclose Client Data or End User data if required to do so by law, regulation, court order, or other legal process. Where permitted by law, we will attempt to notify the affected Client before complying with such a requirement.
We may also disclose information when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of MedspAI, our Clients, End Users, or others.
In the event of a merger, acquisition, reorganization, or sale of all or substantially all of our assets, Client Data may be transferred to the acquiring entity. We will notify affected Clients via email prior to any such transfer.
We may use and share aggregated, de-identified data that cannot reasonably be used to identify any individual or business for product development, research, analytics, and marketing purposes.
We do not share mobile phone numbers or SMS opt-in consent with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are not shared with any third party, other than the service providers that deliver messages on our behalf.
We retain data for the following periods:
| Data Type | Retention Period |
|---|---|
| Call recordings | Up to 90 days from the date of the call |
| Call transcripts and AI summaries | Until deleted at Client's request or when the account is deleted |
| SMS and web chat messages | Until deleted at Client's request or when the account is deleted |
| AI Recall message history | Until deleted at Client's request or when the account is deleted |
| AI-generated contact summaries | Until cleared by Client, deleted at Client's request, or when the account is deleted |
| Account data (business info, settings, contacts) | While the account is active, and after termination until deletion is requested |
| Team member data | While the account is active, and after termination until deletion is requested |
| Number porting account numbers and PINs | Deleted within 30 days after port completion or cancellation |
| Payment records | As required by applicable tax and financial regulations |
When data is deleted, it is removed from our systems. Our service providers retain the data they process according to their own retention policies. After an account is terminated, we retain its data until the Client requests deletion, and we may delete data from terminated accounts after 30 days. All deletion is subject to any legal hold obligations.
Clients may request a full export of their account data or request deletion of specific data at any time by contacting team@medspai.com. We will complete export and deletion requests within 30 days.
We take the security of Client and End User data seriously and implement the following measures:
We follow industry best practices for security, but no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security. In the event of a confirmed data breach affecting Client Data, we will notify affected Clients without undue delay, consistent with applicable law.
Clients may access and update their account information at any time through the account dashboard. Clients may also request a summary of the personal data we hold about them by contacting team@medspai.com.
Clients may request deletion of their account and associated data at any time. See Section 5.1 for details.
Clients may request an export of their account data in a commonly used electronic format at any time. See Section 5.1 for details.
Clients may opt out of non-essential marketing communications from MedspAI by clicking the unsubscribe link in any marketing email or by contacting team@medspai.com. Clients cannot opt out of transactional and operational communications related to their account (such as billing notices and service announcements).
California residents (including owners and staff of California-based Client businesses) have the following rights under the California Consumer Privacy Act (CCPA):
To exercise CCPA rights, contact us at team@medspai.com with the subject line "California Privacy Request."
End Users should direct requests to access, correct, or delete their information to the practice they communicated with. We assist Clients in responding to these requests.
The Services are intended for use by business operators and their employees and are not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected information from a child under 13, please contact us at team@medspai.com and we will promptly delete it.
We use session cookies solely for authentication — to keep users logged in during an active session. These cookies are essential to the functioning of the platform and cannot be disabled.
We do not use advertising cookies or third-party advertising trackers on the platform, and we do not share browsing data with advertising networks.
We use an error-monitoring provider (Sentry) to detect and diagnose problems. It collects error reports and performance data. When an error occurs, it may capture a replay of the session with on-screen text masked and media blocked. We use this data only to maintain and improve the platform.
We may update this Privacy Policy from time to time as our services evolve or in response to legal or regulatory changes.
For material changes — changes that significantly affect how we collect, use, or share personal information — we will notify Clients via email at least 30 days before the change takes effect. The notification will describe the nature of the change and provide a link to the updated Policy.
For non-material changes (such as clarifications or corrections), we will update the Policy and revise the effective date at the top of the document.
Continued use of the Services after the effective date of any update constitutes Client's acceptance of the updated Policy.
If you have questions, concerns, or requests related to this Privacy Policy or your data, please contact us:
Email: team@medspai.com Company: MedspAI, LLC
We will respond to all privacy inquiries within 10 business days.
MedspAI, LLC