Clinic Privacy Policy

Last updated: September 7, 2026

1. Scope

HairCare+ Clinic is operated by Aleh Leuchanka, Voltastrasse 106, 4056 Basel, Switzerland ("we", "our", or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard information when authorized staff members use the HairCare+ clinic web workspace and native mobile applications (together, the "Clinic Service").

The Clinic Service is intended only for authorized personnel of participating clinics and care teams. It is not intended for public consumer use.

2. Information We Process

When the Clinic Service is used, we may process the following categories of information:

• Clinic Staff Account Information: name, work email address, clinic affiliation, role, internal identifiers, and authentication session data.
• Clinic Profile Information: clinic name, timezone, branding assets, and operational settings configured in the service.
• Patient Care Data Made Available to Authorized Staff: patient names, contact details, surgery dates, recovery status, task timelines, restrictions, unread care items, and related care coordination data.
• Patient Media and Communications: progress photos, photo review notes, and in-app chat messages exchanged with patients through the service.
• Audio and Attachments: voice messages or related metadata exchanged through clinic chat workflows where enabled.
• Device and Usage Information: push notification tokens, app diagnostic data, access timestamps, and limited technical logs necessary to operate and secure the service.

3. Sensitive and Health-Related Data

The Clinic Service may display or process sensitive personal data and health-related information submitted by patients or entered by clinic staff in connection with post-operative care. This can include surgery dates, recovery progress, restrictions, task completion status, clinical notes, and progress photos that may incidentally include parts of a patient’s face.

• We do not use facial recognition in the Clinic Service.
• We do not create or store biometric templates or face geometry.
• We do not use patient photos for advertising, profiling, or identity verification.

4. How We Use Information

• Authenticate clinic staff and manage access to the Clinic Service.
• Provide clinic-facing workflows for patient roster management, review queues, progress monitoring, and communication.
• Enable authorized staff to review patient-submitted photos, messages, and care updates.
• Maintain auditability, service reliability, abuse prevention, and account security.
• Send operational notifications such as patient messages, pending reviews, or workflow alerts.
• Support customer support, troubleshooting, and legal compliance obligations.

5. Access Controls and Authorized Use

Access to the Clinic Service is limited to accounts that are linked to clinic staff records and authorized for a participating clinic. Clinics are responsible for ensuring that only appropriately authorized staff members use the Clinic Service and that their use complies with applicable medical confidentiality, privacy, and employment obligations.

Clinic administrators manage staff roles and can remove workspace access. Removing a staff member’s access does not itself delete the clinic’s patient records. Requests about personal data can be made through the contact in Your Rights.

6. Data Sharing

We share information only as necessary to operate the service and support authorized clinic workflows. Recipients may include:

• The relevant participating clinic and its authorized staff: so that patient care workflows can be performed within the clinic account.
• Infrastructure and service providers: including Supabase for data storage and authentication, Cloudflare for web hosting, and OpenAI where AI-assisted functionality is enabled. Google Places processes location-based searches where that feature is used.
• Professional advisers or authorities: where required by law, regulation, valid legal process, or to protect rights, safety, or security.

We do not sell personal data. We do not use clinic or patient data from the Clinic Service for third-party advertising.

7. Data Storage and Security

Service data is stored through Supabase cloud infrastructure. Limited local data may be stored in the browser or mobile device to support signed-in app usage, notifications, and performance. We implement technical and organizational measures designed to reduce unauthorized access, alteration, disclosure, or loss of data.

8. Retention

We retain clinic account information, operational logs, patient care data, and associated media for as long as required to provide the service, maintain account integrity, resolve disputes, enforce agreements, and comply with legal, medical record, or regulatory obligations. Retention periods may vary based on the type of data and the obligations applicable to the participating clinic.

9. Your Rights

Depending on your location and applicable law, you may have rights to access, correct, delete, restrict, object to, or export personal data. Where a request relates to patient data controlled or used by a participating clinic, we may direct you to contact the relevant clinic first or coordinate the request with that clinic.

To exercise privacy rights or ask questions, contact privacy@haircare.clinic. We may request information necessary to verify your identity and authority before acting on your request.

10. Children's Data

The Clinic Service is not intended for use by children. It is intended for use only by adult authorized clinic personnel.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes may be posted on this page or communicated through the service or other appropriate channels.

12. Contact

If you have questions about this Privacy Policy or data handling in the Clinic Service, please contact us at:

Aleh Leuchanka
Voltastrasse 106, 4056 Basel, Switzerland
privacy@haircare.clinic