Privacy Policy

Clinic360 is follow-up and customer-management software for skin, laser and aesthetic clinics. Clinics use it to keep track of enquiries, appointments, treatments and payments, and to message their clients on WhatsApp.

We handle personal information in two different roles:

• For our own website and our customers, meaning visitors to our site, people who ask us for a demo, and clinic staff who sign in to Clinic360, we decide how that information is used and are responsible for it.
• For a clinic’s clients and enquiries, meaning the patients and leads a clinic records in Clinic360 or messages through it, we process that information on the clinic’s behalf and on its instructions. The clinic is responsible for it. If you are a client of a clinic that uses Clinic360, the clinic’s own privacy notice also applies to you.

Information you give us directly

• Demo requests. When you ask for a walk-through on our website we collect your clinic’s name, your name, email address, phone number, city, number of branches, and anything you choose to write in the message box.
• Staff accounts. For each person who signs in to Clinic360 we store their name, email address, optional phone number, role and the branches they work at. Passwords are stored only as a one-way hash, never as readable text.
• Clinic details. A clinic’s name, address, contact details, branding, treatments and prices.

Information clinics enter about their clients

• Contact and profile details: name, phone number, email address, gender, date of birth and address.
• Appointments, consultations, recommended and completed treatments, treatment packages, payments, reviews, tasks, and notes written by clinic staff.
• Messaging preferences, including whether the person has asked not to be contacted.

WhatsApp messages

When a clinic connects its WhatsApp Business number, we receive and store the messages sent between the clinic and its clients: the phone numbers involved, the message content, the name shown on the WhatsApp profile, and delivery and read status with timestamps.

Information collected automatically

• Device and connection information. Your IP address and browser type (user agent), which we record when you submit a demo request, when staff sign in, and on the audit log of changes made inside the app.
• Server logs. Our servers keep standard technical logs of requests (time, page requested, IP address, errors) to keep the service running and secure.
• Cookies. We use two first-party cookies: one that keeps staff signed in (cros_session) and one that remembers whether the app is shown in light or dark mode (clinic360-appearance). We do not use advertising cookies, tracking pixels or third-party analytics.

• To provide the service. We store and display a clinic’s records to its staff, send and receive the WhatsApp messages the clinic writes or switches on (such as booking confirmations, reminders and follow-ups), and show which clients need a follow-up.
• To respond to demo requests. We use your details to contact you about Clinic360 and arrange a walk-through.
• To recognise you and keep accounts secure. We use sign-in sessions, audit logs, IP addresses and user agents to keep staff signed in, spot misuse, and investigate problems.
• To support and improve Clinic360. We use this information to fix faults, answer questions from clinics, and understand which features are used.
• To meet legal obligations such as record-keeping and responding to lawful requests.

We do not sell personal information, and we do not use it for advertising. A clinic’s client data is used only to provide Clinic360 to that clinic.

We share personal information only with the service providers we need to run Clinic360:

• Meta Platforms (WhatsApp Business Platform / Cloud API) delivers and receives WhatsApp messages for clinics that connect their number.
• Twilio delivers and receives WhatsApp messages for clinics that connect through Twilio.
• DeepSeek is an AI service that helps our team read a clinic’s own business details (its name, address, contact details, services and prices) when the clinic is being set up. We never send patient or client information to it.
• Hosting and backup providers run the servers Clinic360 runs on and store its backups.

We may also disclose information if the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or sale of our business, in which case this policy continues to apply. We never share one clinic’s data with another clinic.

Information we receive through the WhatsApp Business Platform, including message content, phone numbers and profile names, is used only to show the conversation to the clinic that owns that WhatsApp number and to send that clinic’s replies and scheduled messages.

• It is kept separate for each clinic and is only visible to that clinic’s authorised staff.
• It is not sold, not used for advertising, and not used to build profiles across clinics.
• Anyone who asks a clinic to stop messaging them is marked as “do not contact”, and Clinic360 will not send them automated or group messages after that.
• It is deleted as described below under “How to delete your data”.

• A clinic’s data, including its client records and WhatsApp messages, is kept for as long as the clinic uses Clinic360, or until the clinic or the person concerned asks us to delete it.
• When a clinic leaves, we first take it offline so nobody can reach its data. When the clinic asks, we then permanently delete the clinic and all of its records.
• Backups are kept on a rolling cycle of about 14 days, so deleted data disappears from backups within that time.
• Demo requests are kept while we are in conversation with you, and are deleted when you ask.

You can ask us to delete your personal information at any time.

1. Email hello@clinic360.app with the subject line “Data deletion request”.
2. Tell us the phone number or email address your information is held under and, if you are a client of a clinic, the name of that clinic.
3. We may ask you to confirm the request from that phone number or email address so that nobody else can delete your data.
4. We will delete the information, or have the clinic that holds it delete it, and confirm to you within 30 days.

If you are a client of a clinic, you can also ask the clinic directly. Its staff can remove you or mark you as “do not contact” in Clinic360.

If you own a clinic, you can ask us to delete your whole clinic account and everything in it. We can give you an export of your data first if you want one.

We may keep a small amount of information when the law requires it, for example records of payments, and only for as long as it requires.

Depending on where you live, you may have the right to:

• find out what personal information we hold about you and get a copy of it;
• have inaccurate information corrected;
• have your information deleted;
• object to, or ask us to limit, how we use it, including asking not to receive messages; and
• complain to your local data protection authority.

To use any of these rights, email hello@clinic360.app. We will not treat you differently for doing so.

All connections to Clinic360 are encrypted with HTTPS. Passwords are stored only as a one-way hash. Each clinic’s data is kept separate from every other clinic’s at the database level, and within a clinic, staff see only what their role allows. Changes to records are written to an audit log. No system is perfectly secure, but we work to protect your information and will tell affected clinics promptly if a breach affects their data.

Clinic360 is a tool for clinic businesses and is not directed at children. We do not knowingly collect information from children under 13 except where a clinic records a minor as a client, under the clinic’s own responsibility and with a parent’s or guardian’s involvement.

We may update this policy as Clinic360 changes. When we do, we will change the “Last updated” date at the top of this page, and if the change is significant we will tell clinics using Clinic360 before it takes effect.

If you have any question about this policy or about your personal information, email hello@clinic360.app.