Privacy Policy

AesthetOS is a software-as-a-service platform designed to support the administration, clinical workflow, documentation, communication, billing, and operational management of aesthetic and medical practices.

This Privacy Policy explains how personal information may be collected, processed, stored, transferred, and protected when clinics, clinic users, patients, website visitors, or other individuals interact with AesthetOS.

Depending on the circumstances and applicable law, a clinic using AesthetOS will generally act as the controller of patient and clinic-related personal data, while AesthetOS may act as a processor on behalf of that clinic. For certain data processed for AesthetOS’s own business, security, subscription, support, or legal purposes, AesthetOS may act as an independent controller.

Depending on how AesthetOS is used, the platform may process information including:

• clinic user account information;
• clinic identity and business information;
• patient identification and contact information;
• appointment information;
• medical and treatment information;
• health-related information and other sensitive or special-category personal data;
• treatment records;
• consent records;
• clinical notes;
• uploaded clinical photographs and images;
• uploaded documents;
• communication history;
• tasks and workflow information;
• inventory information;
• invoice and billing information;
• clinic subscription and payment-related metadata;
• audit, security, device, browser, IP, and technical information required to operate and secure the platform.

AesthetOS is designed to process only information necessary for the functions requested by the clinic and for the secure operation of the service.

Personal information may be processed for purposes including:

• managing clinic workflows;
• managing patients and appointments;
• documenting treatments and clinical activity;
• managing consent forms;
• managing clinical imaging and documents;
• facilitating clinic-patient communications;
• managing inventory, tasks, invoices, and reports;
• administering clinic user accounts and permissions;
• managing AesthetOS subscriptions;
• providing customer support;
• maintaining platform security;
• preventing misuse, fraud, and unauthorized access;
• troubleshooting, logging, auditing, monitoring, and improving platform reliability;
• complying with applicable legal or regulatory obligations.

Where required by applicable law, personal data is processed on an appropriate legal basis.

Depending on the circumstances, this may include:

• performance of a contract;
• compliance with legal obligations;
• legitimate interests;
• consent;
• processing necessary for the provision or management of healthcare or medical services where permitted by applicable law;
• other lawful bases available under applicable data protection legislation.

Clinics are responsible for ensuring that they have an appropriate legal basis for entering and processing patient information in AesthetOS.

Clinics using AesthetOS determine which patient and clinic information is entered into the platform and how that information is used.

Each clinic is responsible for:

• complying with applicable medical, privacy, and data protection laws;
• informing patients where legally required;
• obtaining consent where legally required;
• establishing appropriate retention periods;
• ensuring that users are authorized to access clinic information;
• responding to patient rights requests relating to data controlled by that clinic.

Requests concerning patient information should normally be directed first to the clinic that collected or controls the information.

Where AesthetOS processes personal data on behalf of a clinic, AesthetOS processes that information in accordance with the clinic’s instructions, the functionality of the platform, applicable contractual obligations, and applicable law.

AesthetOS does not independently determine the clinical purposes for which clinics process their patients’ medical information.

AesthetOS may rely on third-party service providers and infrastructure providers necessary to operate the platform.

Depending on the services enabled, these providers may support functions including:

• cloud hosting and infrastructure;
• authentication;
• database and storage services;
• email delivery;
• communications;
• subscription billing and payment processing;
• monitoring, security, logging, and technical operations.

Such providers may process information only to the extent necessary to provide their respective services and subject to applicable contractual and legal safeguards.

Subscription payments for the AesthetOS SaaS service may be processed through Stripe. AesthetOS does not store full payment card details.

AesthetOS uses reasonable technical and organizational safeguards designed to protect information against unauthorized access, alteration, disclosure, loss, misuse, or destruction.

Security measures may include, where applicable:

• authenticated access;
• clinic-specific access controls;
• role-based permissions;
• separation of clinic data;
• server-side storage of sensitive integration credentials;
• encrypted communications;
• security logging and monitoring;
• restricted administrative access;
• controlled backend functions.

No electronic system can guarantee absolute security. AesthetOS continuously aims to maintain safeguards appropriate to the nature of the information processed.

AesthetOS is designed as a multi-tenant platform.

Clinic records and associated patient, treatment, imaging, consent, appointment, communication, task, inventory, invoice, and reporting data are associated with the relevant clinic account.

Users should only be able to access information belonging to clinics for which they have been authorized.

Information is retained only for as long as reasonably necessary:

• to provide the AesthetOS service;
• for the purposes for which the information was collected;
• to maintain security and operational records;
• to comply with legal, contractual, accounting, or regulatory obligations.

Clinics are responsible for determining retention periods applicable to their own patient and business records.

Where legally permissible and technically feasible, information may be deleted, anonymized, or otherwise removed after the applicable retention period.

AesthetOS does not sell personal information.

Information may be disclosed only where reasonably necessary:

• to service providers and subprocessors required to operate the platform;
• at the direction of the relevant clinic;
• where required by applicable law, regulation, court order, or valid legal request;
• to protect the security, integrity, rights, or legitimate interests of AesthetOS, its users, or others;
• in connection with a legitimate corporate restructuring, merger, acquisition, or transfer, subject to applicable law.

Depending on the infrastructure and service providers used, information may be processed or stored in countries outside the European Union / European Economic Area.

Where required by applicable law, appropriate safeguards will be used for international transfers of personal data.

These safeguards may include contractual protections, recognized adequacy mechanisms, standard contractual clauses, or other lawful transfer mechanisms.

AesthetOS is operated by Synaptrix AI S.R.L., Romania.

Personal data is primarily protected by Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and applicable Romanian data protection legislation. The relevant supervisory authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

Where Swiss data protection law applies to Swiss customers, it may provide additional protections as a secondary framework.

The exact rights available depend on the circumstances, the individual’s location, and the applicable law.

Depending on applicable law, individuals may have rights including:

• access to personal data;
• correction of inaccurate information;
• deletion of personal data;
• restriction of processing;
• objection to certain processing;
• withdrawal of consent where processing is based on consent;
• data portability;
• information about processing;
• the right to lodge a complaint with a competent data protection authority.

Where a request concerns patient information controlled by a clinic, the request should generally be directed first to that clinic.

Requests relating to AesthetOS account data, platform-related personal information, or privacy matters may be submitted to:

privacy@aesthetos.io

Where the requested information belongs to or is controlled by a clinic, AesthetOS may need to coordinate the request with that clinic.

Deletion may be subject to applicable legal, medical, accounting, contractual, security, or regulatory retention requirements.

AesthetOS is intended for professional use by clinics and medical practices.

Clinics are responsible for ensuring that information relating to minors is processed lawfully and that any required parental consent, guardian authorization, or other legal basis is obtained.

AesthetOS may provide communication functionality that allows clinics to communicate with patients or other contacts.

Clinics are responsible for ensuring that communications are lawful, appropriate, and sent to authorized recipients.

AesthetOS may also send operational, security, billing, subscription, or service-related communications to clinic users.

AesthetOS subscription billing is separate from patient invoicing performed inside a clinic account.

Subscription payment information may be processed by third-party payment providers such as Stripe.

AesthetOS may retain payment-related identifiers, subscription status, billing interval, payment status, and similar metadata necessary to manage the SaaS subscription, but does not intentionally store full payment card details.

This Privacy Policy may be updated from time to time to reflect:

• changes to AesthetOS functionality;
• new service providers;
• changes in applicable law;
• security or operational changes;
• changes to business practices.

The most current version will be published on this page together with the applicable “Last updated” date.

For privacy questions relating to AesthetOS:

AesthetOS

Synaptrix AI S.R.L., Romania

Email: privacy@aesthetos.io

General support: support@aesthetos.io

General inquiries: hello@aesthetos.io