Privacy Policy

1. Who we are

PatientPulse provides a guided Treatment Finder that medical aesthetics clinics embed on their own websites, together with a dashboard to manage treatments and view the enquiries it captures. This policy explains what personal data we process and how.

For clinic account data we are the data controller. For visitor enquiry and requested results-copy data captured through a clinic's widget, and reviewer data a clinic instructs us to import, organise or display, the clinic is the data controller and we act as its processor under our terms. The clinic decides why that data is used and is responsible for its lawful basis and privacy information.

2. What data we process

Clinic account data

• Clinic name, website, business contact details and the email used to sign in.
• Your treatment menu, pricing, booking links and other clinic-authored content.
• Billing and subscription records. Card details are handled by our payment provider. We never see or store full card numbers.

Visitor enquiry and requested results-copy data (captured by the widget on a clinic's site)

• The concern, treatment area and downtime preference a visitor selects in the guided flow.
• The own-words treatment concern a visitor chooses to enter in AI Search. We validate that wording into a closed set of structured treatment goals before it can be used in the Finder or attached to an enquiry.
• The contact details a visitor chooses to submit with an enquiry: name, email, phone and any message.
• If a visitor separately asks us to email the treatment cards already shown, their email address, the closed-set concern and treatment identifiers used for that copy, and the time, wording version and technical record of each unticked consent choice. We do not store the words they typed for this feature, and asking for a copy is not an enquiry.
• Basic technical context (such as the referring page) where available, used to give the clinic a clearer starting point for follow-up.

The Treatment Finder does not ask for medical history and is not a medical record. Visitors should not put a name, contact details or medical history into AI Search.

When a visitor uses AI Search, PatientPulse sends the wording to OpenAI's Responses API so it can be interpreted into the Finder's closed set of treatment goals. The request is sent with OpenAI storage disabled (store: false). We do not intentionally send the clinic's identity or treatment menu, or the visitor's contact details or enquiry message, with that request. If one follow-up question is needed, the answer and the earlier validated structured context are sent together.

Reviewer data supplied or authorised by a clinic

• The original review text and rating, reviewer display name, publication date, source profile or review link, and source label.
• Source information supplied by the clinic, including whether an export is complete, date-bounded or selected and the permissions the clinic records for it.
• For a Google Business Profile connection, the Google account authorisation, managed business location and review records the clinic instructs us to sync.
• Exact treatment-name matches suggested by our local rules, together with the clinic's approval, rejection and moderation decisions.

We do not ask clinics to import reviewer email addresses or phone numbers. Review text is not sent to an external AI model in this version. The treatment-link check looks only for exact treatment names and approved aliases, creates a suggestion for the clinic to review, and does not make a legal or similarly significant decision about a reviewer.

A review can reveal information about a person's health or treatment. Before using the review tools, the clinic must confirm that it is authorised to provide the content, has an appropriate data-protection basis (including any condition required for special-category data), and can handle access, correction or deletion requests.

The Clinic Growth Playbook

When you ask for The Clinic Growth Playbook on our website, in a treatment guide or in the Clinic Growth Hub, we are the data controller for what you give us. We collect:

• your email address;
• your name, the name of your clinic and your clinic website;
• the page you asked from, the address of the page that sent the form (without anything after a question mark), and the campaign tags of the link that brought you to us, such as the source and campaign name, together with any advertising click identifiers you allowed when you accepted cookies;
• when you asked and how many times, whether our email reached you, and how often the download link was opened.

Why. To send you the playbook and a link to download it, and then to email you ideas for growing your clinic and news about PatientPulse. Asking for the playbook is how you sign up for those emails, and the form says so directly below its button. We also use the page and campaign details to learn which of our pages and campaigns bring clinic owners to us.

Legal basis. Our legitimate interests in sending you the playbook you asked for and in keeping business contacts up to date about growing a clinic and about PatientPulse. You can unsubscribe at any time, from any of our emails with the one-click link, or by emailing hello@patientpulse.co. Our marketing emails stop straight away, and the playbook link you already have keeps working.

Advertising measurement. If you have accepted cookies, the page that confirms your request tells Google Analytics and Meta once that a playbook request was made, and from which of our pages. We never send them your email address, your name, your clinic name or your website. If you have not accepted cookies, nothing is sent.

How long we keep it. For 24 months after your last contact with us (a request, a download or a reply), and then we delete it. If you unsubscribe, we keep your email address and the date you unsubscribed, so that we never send you marketing again. You can ask us to delete your details at any time by emailing privacy@patientpulse.co.

Who processes it. We send the playbook and our marketing emails through Resend, our email provider listed in section 4, and keep your details in our own database at Railway, also listed in section 4. We do not sell your details or share them with anyone for their own marketing.

Visits to our own site

If you have not accepted cookies, we still count the visit, because we want to know how many people reach our site and which pages they read. We do that without storing anything on your device.

To tell one visit apart from another, our server creates a short code from your IP address and your browser type. Two things are true about that code, and both matter:

• We do not keep your IP address or your browser details. They are used to make the code and then discarded. The code cannot be turned back into either of them.
• The code is rebuilt roughly every hour using a new secret that we never write down. After that, the same visitor produces a different code. It is also thrown away entirely whenever our servers restart.

In plain terms: it groups your requests into a visit for about an hour, and then forgets. We cannot use it to recognise you tomorrow, and we do not attempt to.

We do not record your town or city unless you have accepted cookies. Without consent we record your country and region only.

We keep this traffic data for up to 13 months, after which it is reduced to monthly totals that do not identify individual visits.

We estimate your location using a local copy of a geolocation database. Your IP address is not sent to its provider.

We do this under our legitimate interest in understanding how our own site performs. You can object to it at any time by emailing privacy@patientpulse.co, and you can avoid it entirely by declining cookies, which stops the persistent identifier described in section 6.

3. Why we process it (lawful basis)

• Contract: to provide the service to clinics: run the widget, deliver enquiries and visitor-requested results copies, operate the dashboard, process authorised review content on the clinic's documented instructions, and handle billing.
• Legitimate interests: to keep the service secure, prevent abuse, maintain and improve product quality, and measure how our own public website performs so we know which of our marketing works. We balance this against your rights, and you can object at any time (see section 7).
• Legitimate interests: to send The Clinic Growth Playbook to clinic owners who ask for it, and then our emails about growing a clinic and about PatientPulse, until they unsubscribe (see "The Clinic Growth Playbook" in section 2).
• Legal obligation: to keep records we are required to keep (for example, for tax).

When a visitor submits an enquiry, the clinic relies on its own lawful basis as controller for handling that enquiry and contacting the visitor.

A one-off results copy is sent only after the visitor ticks the transactional request. Marketing is a separate, optional and initially unticked choice; the one-off request does not itself authorise marketing.

4. Service providers

We use a small number of trusted providers to run the service. We do not sell personal data, and we do not share it for third-party marketing.

Providers that process personal data for us

These are also the sub-processors under the Data Processing Agreement we have with each clinic.

The full list, with the data each provider receives and where it processes it, is on our Sub-processors page.

Other providers we use for our own business

These never receive patient enquiry data.

Enquiry submissions are delivered only to the clinic whose Treatment Finder the visitor used. They are not shared with any other clinic.

If a clinic chooses to connect Google Business Profile, Google supplies the authorised business-location and review data directly to PatientPulse. We use that Google data only to provide the review features described here, do not sell it, and do not transfer review text to an external AI service.

Authorised review content is available only to the clinic that supplied or connected it and, if that clinic enables public review cards, to visitors using that clinic's Treatment Finder. It is not shared with another clinic.

5. Data retention & deletion

Clinic account and billing records are kept for as long as the clinic remains a customer and for the period we are required to retain them afterwards. A clinic can ask us to close its account and delete its data when it stops using the service.

PatientPulse does not persist the raw wording entered into AI Search. We may attach only the validated, closed-set Finder context to an enquiry a visitor chooses to submit. OpenAI's handling of the API request is described in section 4.

Clinic Growth Playbook requests are kept for 24 months after the last contact, as set out in section 2.

Requested Finder results-copy records are kept for up to 12 months and then automatically deleted. The email contains only cards that were on the clinic's current menu when the copy was sent, their displayed facts and any closed-set concern the clinic could not match; it does not contain the visitor's raw search wording.

Review content is kept while the clinic has instructed us to manage it, subject to any shorter source-specific limit. Disconnecting Google immediately revokes the stored grant and deletes copied Google review content from the live service. Disconnecting another source also removes its content from public display and deletes its active copy. We delete or correct active review data when the clinic withdraws its instruction, the source reports a deletion, or a valid reviewer request is passed to us, and deleted data then ages out of encrypted backups through the normal backup-retention cycle.

6. Cookies

LinkedIn advertising, where enabled. After you accept the banner naming LinkedIn, approved public business pages and our generic signup-confirmation page may load the Insight Tag. It can send page URLs, referrers, timestamps, device information, IP addresses and Website Actions such as button labels and clicks. We do not use Website Actions as a signup-conversion source. A separately verified clinic signup uses an opaque event identifier. We do not enable LinkedIn email matching or send patient answers, treatment choices or private account details. Declining keeps LinkedIn off. Withdrawal stops further collection from our page; it cannot recall data already sent or delete cookies on LinkedIn's own domain. See LinkedIn's data-use explanation and cookie table.

PatientPulse uses a small set of first-party cookies: strictly necessary cookies that keep you signed in and protect our forms, and functional cookies that remember your Treatment Finder setup as you move through onboarding. With your consent we also use Google Analytics, Google Ads and the Meta Pixel on approved pages of our own public marketing site, to understand how it is used and to measure our own Google, Facebook and Instagram advertising. When checkout starts, an entitled clinic trial starts or a first payment is verified, we may also send Meta that commercial event with a one-way hashed clinic-buyer email and Meta's browser/click identifiers so the ad can be measured across the checkout journey. With the same accepted advertising consent, a first verified payment may be sent server-side to Google Ads Data Manager using the consented Google click identifier, transaction identifier, time, currency and value. We never include patient data, treatment choices or free text. Those analytics and advertising technologies are activated only after you choose Accept on our cookie banner, and declining changes nothing about how the site works.

We also run our own first-party analytics on our public site, instead of relying only on Google. With your consent we set one cookie, pp_vid, so we can tell that several page views belong to one visit rather than several, see whether you return later, and see which of our own marketing brought a clinic to us. This stays on our own site. We do not use it to follow you anywhere else, we do not share it, and declining changes nothing about how the site works.

We also count visits from people who have not accepted cookies, without storing anything on their device. See section 2 for how that works.

The strictly necessary cookies are needed to deliver the service you have asked for. The functional cookies make the onboarding funnel work and save your progress. We show a short consent banner where you can accept, decline or later change the analytics and advertising choice. Withdrawal revokes further Meta events and removes PatientPulse's optional analytics and advertising identifiers from the browser. The embedded Treatment Finder does not set advertising or analytics cookies on clinic websites.

Full detail is in our Cookie Policy.

7. Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict and port your data, and to object to certain processing. To exercise any of these rights, contact privacy@patientpulse.co. Where a clinic is the controller of enquiry or reviewer data, we will help that clinic respond. A reviewer may contact the clinic shown as the review source or contact us with the clinic and source details so we can route the request securely.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

8. Security & international transfers

Data is transmitted over encrypted connections (TLS) and backups are stored encrypted. We take reasonable technical and organisational measures to protect personal data, though no online service can be completely secure.

Our application and database are hosted in the United States, and some of our providers process data in the United States or the European Union. Where personal data leaves the UK, we rely on UK adequacy regulations or on the ICO's International Data Transfer Agreement or Addendum, as set out in our Data Processing Agreement. If a personal data breach affects enquiry data, we tell the clinic concerned as that agreement requires.

9. Changes & contact

We may update this policy from time to time and will revise the "last updated" date above. For any privacy question, contact privacy@patientpulse.co.

See also our Cookie Policy and Terms of Service.