Privacy Policy

Last updated: July 21, 2026

1. Introduction

Vansanity, Inc. d/b/a CloudMedSpas (“CloudMedSpas,” “Company,” “we,” “us,” or “our”) values your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our mobile and tablet applications (including the CloudMedSpas provider and patient applications for iOS and iPadOS), or otherwise interact with our platform (collectively, the “Platform”).

By using the Platform, you agree to the terms of this Privacy Policy. Our Platform serves several audiences — website visitors, healthcare providers and their staff, and patients of practices that use the Platform — and not every feature described in this Policy applies to every user. Sections describing specific features (such as visit recording, AI-assisted documentation, and facial scanning) apply only when and if those features are used on your account or by your practice. Where we process Protected Health Information on behalf of healthcare providers, we do so as a business associate under HIPAA and under our agreements with those providers.

2. Information We Collect

We may collect the following types of information.

2.1 Personal Information

  • Name
  • Email address
  • Phone number
  • Mailing address
  • Date of birth
  • Payment information
  • Account login credentials

2.2 Health Information

When you use our services, we may collect health-related information including:

  • Medical history
  • Current health conditions
  • Symptoms
  • Treatment history
  • Prescription information
  • Responses to intake questionnaires
  • Clinical notes, treatment records, and photographs entered by your healthcare provider

This information may be considered Protected Health Information (PHI) under applicable healthcare privacy laws.

2.3 Audio Recordings and Visit Transcripts

Our applications include an optional visit recording feature. Recording occurs only when a user actively starts it using the in-app recording control, and can be stopped by the user at any time. When this feature is used, we collect the audio recording of the visit and the resulting written transcript and clinical summary, which become part of the patient’s record. See Section 7 for how this data is processed by our AI service providers.

2.4 Clinical Photographs

Providers may capture clinical photographs of a patient using the device camera to document treatment areas and outcomes in the patient’s record. On devices that do not support 3D facial scanning, standard two-dimensional photographs are captured in place of a 3D scan. Photographs are collected only when a provider actively takes them.

2.5 Face Data (TrueDepth Camera)

When a provider using our iOS/iPadOS application initiates a 3D facial scan, the application uses Apple’s ARKit face tracking with the device’s TrueDepth camera system to generate a three-dimensional geometric mesh of the patient’s face (“Face Data”). Face Data is collected only when a provider actively initiates a scan; the application does not capture Face Data passively or in the background. The application does not access or retain raw depth maps, infrared imagery, or Face ID data, and camera frames displayed during capture are never saved or transmitted. See Section 8 (Face Data) for full details on use, sharing, storage, retention, and deletion.

2.6 Automatically Collected Information

When you access our Platform, we may automatically collect certain information including:

  • IP address
  • Browser type
  • Device type
  • Operating system
  • Website and application usage activity
  • Date and time of access

3. How We Collect Information

We collect information when you:

  • Create an account
  • Complete intake forms
  • Schedule or attend appointments or telehealth consultations with providers using the Platform
  • Communicate with healthcare providers
  • Purchase products or services
  • Contact customer support
  • Use device features you activate within our applications, including the camera and TrueDepth camera system when you initiate a facial scan, and the microphone when you start a visit recording
  • Use the visit recording and AI-assisted documentation features within our applications, as described in Section 7

We may also collect information automatically through cookies and analytics technologies.

4. Cookies and Tracking Technologies

(unchanged from current policy)

Our Platform may use cookies and similar tracking technologies to improve functionality and user experience. Cookies may help us maintain secure sessions, remember user preferences, and analyze how users interact with our Platform. You may disable cookies through your browser settings, though some features may not function properly without them.

5. How We Use Your Information

We may use your information to:

  • Provide clinical documentation, scheduling, and practice-management tools to healthcare providers through our applications
  • Support consultations, telehealth visits, and prescription workflows conducted by independent licensed providers and partner organizations that use the Platform
  • Power optional AI-assisted features, as described in Section 7
  • Verify your identity
  • Manage your account
  • Process payments
  • Communicate service updates
  • Improve our services
  • Detect fraud or misuse
  • Comply with legal obligations
  • Send SMS text messages you have opted in to receive, such as booking notifications and program updates.

6. How We Share Information

We may share your information with:

6.1 Healthcare Providers and Partner Organizations

Independent licensed healthcare providers, practices, and partner organizations that use the Platform to deliver care to their patients. CloudMedSpas does not itself provide medical or telehealth services; these are delivered by independent providers who are responsible for the care they furnish.

6.2 Pharmacies

Where a provider or partner organization using the Platform prescribes medication, information necessary to fulfill that prescription may be shared with the licensed pharmacy they designate. CloudMedSpas does not dispense medication.

6.3 Service Providers

Third-party vendors who help operate our services, including:

  • Hosting providers (including Amazon Web Services)
  • Payment processors
  • Technology vendors
  • Customer support providers
  • Our artificial intelligence service provider, as described in Section 7

All service providers are contractually required to protect your information with protections the same as or equal to those described in this Privacy Policy, and, where they handle PHI, under Business Associate Agreements as required by HIPAA.

6.4 Legal Requirements

We may disclose information if required by law or legal process.

6.5 Business Transfers

If the Company undergoes a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

We do not sell your personal information, and we do not share your personal information for cross-context behavioral advertising.

6.6 SMS/Text Messaging

By opting in to receive SMS text messages from CloudMedSpas, you consent to receive text messages from us at the phone number you provide, including account notifications, appointment and booking updates, payment confirmations, and program updates. Message frequency varies. Message and data rates may apply. Consent to receive SMS messages is not a condition of purchasing any goods or services.

You may opt out at any time by replying STOP to any message. After opting out, you will receive a final message confirming your opt-out, and no further messages will be sent unless you re-subscribe. For assistance, reply HELP or contact us at legal@cloudmedspas.com.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, excluding messaging service providers acting on our behalf solely to deliver messages.

7. Use of Third-Party Artificial Intelligence Services

Our applications include an optional AI-assisted clinical documentation feature that records a patient visit, transcribes it, and generates a summary for inclusion in the patient’s chart in the electronic health record.

What is sent. When a user starts a visit recording using the in-app recording control, the application transmits the audio recording of the visit and the resulting transcript. The application does not send Face Data, photographs, payment card information, or government identifiers to any AI service.

Who receives it. This data is processed on our behalf by the following service providers:

  • Deepgram, Inc., which converts the audio recording into a written transcript; and
  • Amazon Web Services, Inc. (“AWS”), which hosts our infrastructure and generates a clinical summary from the transcript.

Protections. Both Deepgram and AWS process this data solely as our service providers under written agreements, including Business Associate Agreements (BAAs) as required by HIPAA, and are contractually required to protect this data with protections the same as or equal to those described in this Privacy Policy. Deepgram operates under a zero-retention configuration: audio is processed to produce the transcript and is not stored by Deepgram after processing. Your audio, transcripts, and summaries are not used to train these providers’ AI models.

Your consent and control. Recording never occurs automatically. The application discloses this data sharing and requests your permission before any recording is transmitted, and recording occurs only when you actively start it using the in-app recording control. You may stop recording at any time. If you decline or never use the feature, all other application functionality continues to work. Providers are responsible for obtaining any patient consent to recording required under applicable law, including state laws requiring the consent of all parties to a recorded conversation.

Retention. Recordings, transcripts, and clinical summaries are stored on our secure AWS infrastructure as part of the patient’s medical record and are retained for seven (7) years, consistent with applicable medical record retention laws, unless a longer period is required by law. Deepgram does not retain any audio or transcript data after processing.

8. Face Data and Clinical Photographs: Collection, Use, Sharing, Storage, Retention, and Deletion

What we collect. Our iOS/iPadOS application uses Apple’s ARKit face tracking with the TrueDepth camera system to produce a canonical face geometry mesh — a triangle mesh of approximately 1,220 vertices fitted to the patient’s face — together with its position and orientation transform (“Face Data”). This geometric mesh is the only data the application takes from the TrueDepth session. The application does not access or store raw depth maps, infrared imagery, or any Face ID or facial-recognition data, and performs no face recognition or identification of any kind. Camera frames are displayed as a live preview during capture but are never saved or transmitted.

Separately, the application offers optional Face ID unlock through Apple’s LocalAuthentication framework. In that case the application receives only a success or failure result from iOS and never accesses the TrueDepth camera or any biometric data.

Clinical photographs. On devices that support 3D facial scanning, the application captures the geometric mesh described above. On devices that do not support 3D facial scanning, the application instead captures standard two-dimensional clinical photographs using the device camera. Unlike the face mesh, a clinical photograph is an image of the patient. Photographs are captured only when a provider actively takes them, are used solely for clinical documentation and treatment planning, are not used for identification or recognition, are not transmitted to any third-party artificial intelligence service, are not shared with any third party, and are never sold. Photographs are stored in the patient’s chart in our access-controlled Amazon Web Services environment under the same encryption, access-control, and retention practices described below.

How we use it. Face Data is used solely for clinical documentation. The face mesh is used on the device to align a standardized map of facial treatment zones onto the 3D scan, so that the provider can accurately mark and record injection sites on the 3D model within the patient’s record. All of this processing occurs on the device; the mesh is not sent anywhere for processing. Face Data is not used for identification or authentication, is not used to create biometric templates for recognition purposes, and is not used for advertising, analytics, marketing, model training, or profiling.

Sharing. Face Data is not shared with any third party. It is not transmitted to any third-party artificial intelligence service and is never sold. Face Data exists only within the patient’s chart in the practice’s electronic health record, hosted in our private Amazon Web Services environment.

Storage. While an encounter is in progress, the face mesh is stored in the application’s private sandbox on the device. When the provider saves the encounter, it is uploaded over an encrypted connection to the practice’s private, access-controlled electronic health record backend in our Amazon Web Services environment in the United States, where it is treated as Protected Health Information under HIPAA and is accessible only to authorized members of the patient’s care team. If a scan fails the application’s quality checks, or the provider discards the draft, the mesh is deleted from the device.

Retention and deletion. Face Data and clinical photographs are part of the patient’s medical record and are retained for as long as the medical record is maintained — a minimum of seven (7) years, consistent with applicable medical record retention laws, and potentially longer in accordance with the treating practice’s record retention obligations. Because Face Data is medical record data, it is not subject to routine deletion. If a patient record is purged or a verified deletion request is granted, associated Face Data is deleted with it; deletion requests are honored only to the extent permitted by medical record retention laws. Requests may be submitted to legal@cloudmedspas.com.

Patient consent. Healthcare providers using our applications are responsible for obtaining any patient consent required under applicable law before capturing a patient’s facial scan.

9. Data Retention

We retain medical records maintained on the Platform — including clinical notes, transcripts, summaries, photographs, and Face Data — for as long as the record is maintained, and in all cases for a minimum of seven (7) years, consistent with applicable state medical record retention laws (including California’s seven-year requirement). We retain other personal information only as long as necessary to:

  • Provide services
  • Comply with legal obligations
  • Resolve disputes and enforce agreements

Face Data is subject to the specific retention and deletion practices described in Section 8.

10. Your Privacy Rights

Depending on your jurisdiction, you may have the right to:

  • Access your personal information
  • Correct inaccurate information
  • Request deletion of certain data
  • Receive a copy of your information

To exercise these rights, contact us using the information in Section 13.

11. Security

We use administrative, technical, and physical safeguards to protect your personal information, including encryption in transit and at rest, role-based access controls, and audit logging. However, no security system can be guaranteed to be completely secure.

12. Children’s Privacy

Our Platform is not intended for individuals under the age of 18. We do not knowingly collect information from children.

13. Contact Information

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact:

Vansanity, Inc. d/b/a CloudMedSpas Attn: Iggy Fanlo, Founder & CEO legal@cloudmedspas.com