Privacy
Last updated September 11, 2026
Clinix is a marketing and patient-communication service for medical spas and aesthetic clinics in the United States. This page explains what we collect, why, who we share it with, and what you can ask us to do with it. It covers both this website and the services we run on behalf of clinics.
Two different roles
We handle data in two distinct capacities, and your rights differ depending on which applies.
- As a business. When you visit this site, email us or book a call, we are the controller of that information and it is covered directly by this policy.
- As a service provider to a clinic. When we answer leads, book consults and run reactivation campaigns, we act on the clinic’s instructions and the clinic remains responsible for that data. If you are a patient or a lead and want your information corrected or deleted, contact the clinic, or contact us and we will pass the request on and act on it.
What we collect on this website
- What you give us. Your email address if you submit the form, and whatever you enter when booking a call through our scheduling provider, typically name, email and any note you add.
- Basic usage data. Page views and clicks on the booking button, so we know whether the site works. We do not build advertising profiles of site visitors and we do not sell this data.
What we handle for clinics
Running follow-up and booking means handling contact details for the clinic’s leads and patients: name, phone number, email address, the service someone asked about, the content of SMS conversations, appointment times, and whether the appointment was attended.
We deliberately keep clinical information out of these channels. Our conversations stay at the level of scheduling and general service information, the same ground a front desk covers on the phone. We do not request or store medical histories, diagnoses, treatment records or clinical photographs over SMS, and we do not send clinical detail to advertising platforms. Where a clinic’s arrangement calls for it, we will sign a business associate agreement and operate under it.
Text messages
Messages are sent to people who contacted a clinic or are existing patients of it. Every conversation identifies the clinic by name. Replying STOP ends messages immediately and the opt-out is honored permanently, across campaigns and across future lists. HELP returns contact information. Message and data rates may apply. We observe quiet hours and do not send outside them.
Who we share data with
We use a small number of service providers, each for a specific function, and we share only what that function needs:
- Twilio, to send and receive text messages.
- Meta, to run advertising inside the clinic’s own ad account.
- Calendly, for scheduling calls and consults.
- Supabase, for application hosting and the database.
- Resend, for transactional email.
- Vercel, for website hosting.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose data otherwise only when the law requires it.
How long we keep it
Clinic data is retained for the period set in that clinic’s agreement, and deleted or returned when the engagement ends. Opt-out records are kept indefinitely on purpose: that is the only way to guarantee someone who unsubscribed is never messaged again. Website enquiry emails are kept for two years unless you ask us to remove them sooner.
Your rights
You can ask us for a copy of the information we hold about you, ask us to correct it, or ask us to delete it. California residents have specific rights under the CCPA as amended by the CPRA, including the right to know, the right to delete, the right to correct, and the right not to be discriminated against for exercising them. We do not sell or share personal information as those terms are defined there.
Email rotem@tryclinix.com and we will respond within 30 days. We may need to verify your identity before acting on a request.
Security
Access to clinic and lead data is restricted to the people who need it to run the service, and access is logged. Data is encrypted in transit and at rest by our infrastructure providers. No system is perfectly secure, and we will notify affected clinics without undue delay if a breach affects their data.
Children
Our services are not directed to anyone under 18, and we do not knowingly collect their information.
Changes
If we change this policy we will update the date above. Material changes affecting clinics under contract will be communicated directly rather than only posted here.