Privacy Policy

Last updated: July 2026

1. Who we are and the role we play

HL Patient Portal ("the Platform", "we", "us") provides patient-portal, commerce, and engagement software to medical spas and wellness clinics ("Clinics"). Each Clinic — not the Platform — owns the relationship with its patients and is responsible for the care it provides. Where a Clinic is a HIPAA covered entity, we act as its business associate and process patient information only on the Clinic's behalf and under a Business Associate Agreement (BAA).

2. Information we process

• Account information — name, email address, phone number, and login credentials for Clinic staff and patients.
• Health-related information — information patients provide or log through their Clinic's portal, such as intake questionnaire answers, medication and injection tracking, weight entries, progress photos, and messages to their care team. This information is encrypted at rest and in transit and is visible only to the patient and their own Clinic.
• Order and payment information — products purchased, order history, and shipping addresses. Card details are processed by Stripe and never touch our servers.
• Technical information — device type, browser, IP address, and usage logs kept for security and reliability.

3. How information is used

• To operate each Clinic's portal: accounts, orders, treatment tracking, messaging, reminders, and support.
• To send transactional communications (order confirmations, password resets, care reminders) on the Clinic's behalf.
• To maintain security: access to health information by clinic staff is audit-logged, and those logs are retained for at least six years.
• To improve reliability and performance of the Platform, using aggregated, de-identified data only.

We do not sell personal information, and we do not use patient health information for advertising.

4. Sharing

Information is shared only with: (a) the patient's own Clinic and its authorized staff; (b) service providers we use to run the Platform — including Amazon Web Services (hosting, using HIPAA-eligible services under a BAA) and Stripe (payments) — and, where a Clinic connects it, the Clinic's own CRM (HighLevel), each bound to appropriate confidentiality and data-protection obligations; and (c) authorities where the law requires it. Clinics decide which integrations they connect and are responsible for the tools they enable, including any analytics or advertising pixels a Clinic chooses to add to its own portal.

5. Security

We use encryption in transit (TLS) and at rest, per-tenant data isolation, role-based access controls, multi-factor authentication for clinic staff, and continuous audit logging. No system is perfectly secure; if a breach affecting your information occurs, affected Clinics and individuals will be notified consistent with applicable law.

6. Retention

Patient records are retained while the patient's account is active or as their Clinic requires, and afterwards only as needed to meet legal obligations (including medical-record and audit-log retention laws).

7. Your choices and rights

• Access and export — patients can download a complete copy of their data from Settings → Export My Data in their portal.
• Deletion — patients can delete their account from Settings → Delete Account, or ask their Clinic to do so. Some records may be retained where the law requires it.
• Correction — account details can be edited in the portal; ask your Clinic to correct anything else.
• Communications — marketing messages can be switched off in notification settings; transactional messages (like order confirmations) are always sent.

8. Cookies and analytics

The Platform uses strictly necessary cookies for sign-in and security. Individual Clinics may enable their own analytics or advertising tools on their portal; those tools are governed by the Clinic's own privacy practices.

9. Children

The Platform is not directed to children under 18. Clinics are responsible for verifying the eligibility of their patients.

10. Changes and contact

We may update this policy from time to time; the "Last updated" date above reflects the current version, and material changes will be announced in the portal. Patients should direct privacy requests to their Clinic first. Clinics and individuals may also contact us at support@hlpatientportal.com.