Velvet Lead privacy policy

This privacy policy explains how Velvet Lead ("we", "us") handles personal data. It covers two things: this marketing website, and the patient-booking websites and admin panels we build for clinics.

It does not replace the privacy policy on each clinic's own website. Patients should read their clinic's policy to understand how that clinic uses their information.

Who we are

Velvet Lead is a studio that builds and launches patient-booking websites for clinics in the United States and Pakistan.

• Email: velvetleads@gmail.com
• Address: {{ADDRESS}}

Our marketing website

Information you give us

When you book a demo or contact us, the form asks for:

• your name and clinic name
• business type, country and city
• email address and mobile or WhatsApp number
• your current website, if you have one
• a range for how many enquiries your clinic gets each month
• the biggest problem you want to solve
• how you heard about us

If you sign up for our newsletter, we collect your email address.

The demo form includes a separate checkbox for marketing emails. It is unticked by default. We only send you marketing emails if you tick it or sign up for the newsletter, and you can unsubscribe at any time.

Information collected automatically

• Campaign and landing page details. If you arrive through a link with campaign tags (UTM parameters), we store those tags and the first page you landed on in a first-party cookie for 30 days. If you then send a form, these details are saved with your enquiry so we know which campaign brought you to us.
• Country preference. We store your chosen country (Pakistan or the United States) in a cookie called vl_country, so the site shows the right currency and details.
• Website analytics. We use Vercel Analytics, a privacy-friendly web analytics tool that does not use cookies. It tells us which pages are visited, without building a profile of you.
• Scheduling embed. If you choose to book a call, we may load a Calendly scheduling widget (https://calendly.com/velvetleads/30min). It only loads when you interact with it. Calendly then handles the information you enter under its own privacy policy.

Our cookie policy lists each cookie in more detail.

How we use this information

We use the information from our marketing website to:

• reply to your enquiry and arrange a demo or call
• understand whether Velvet Lead fits your clinic
• send marketing emails and newsletters, only if you agreed
• learn which pages, campaigns and channels bring enquiries, so we can improve the site
• keep the website secure and working

We do not sell your personal data.

Service providers

We use a small number of providers to run the marketing website:

• Vercel hosts the website and provides web analytics.
• Google (Gmail) delivers our emails, including form notifications and newsletters.
• Enquiries sent through our forms are delivered to our team by email. We don't store them in a website database.
• Calendly provides the optional scheduling widget.

These providers process data for us so we can run the website. Some of them may store data outside your country, including in the United States.

Clinic websites and admin panels

Our role

When a clinic uses Velvet Lead, its patients book appointments, send enquiries and chat with the AI assistant on the clinic's website. That personal data belongs to the clinic.

The clinic decides why and how patient data is used. We process it on the clinic's behalf and act on the clinic's instructions. If you are a patient, please contact your clinic about your data. If you contact us, we will pass your request to the clinic.

Data we process for clinics

Depending on how a clinic uses the product, this can include:

• patient names, email addresses and phone numbers
• appointment details, such as treatment, practitioner, date and time
• enquiry messages, lead source and campaign tags
• conversations with the clinic's AI assistant
• whether a patient accepted the clinic's privacy notice and whether they gave marketing consent, with the time and source
• consent records for before-and-after photos
• staff names, email addresses and roles

The product is built for appointment booking and enquiries, not clinical records. It does not include clinical notes, prescriptions, insurance billing or telehealth.

What we use it for

We use clinic data only to provide the service to that clinic. That includes showing availability, sending booking emails and WhatsApp messages the patient opted in to, running the AI assistant, producing reports, and providing support.

How we protect it

• A separate database for each clinic. Each clinic's data is kept in its own database.
• Role-based access. Clinic staff are invited with the role admin, manager or staff. The database enforces what each role can see, not just the screen.
• Error monitoring. Automatic error alerts come to the Velvet Lead team so we can fix problems quickly.
• Trusted infrastructure. The product runs on a Postgres database through Supabase and is hosted on Vercel.

No system is perfectly secure, but we work to protect data against loss and unauthorized access. You can read more on our security page.

Messaging providers

Booking emails are sent through Google (Gmail). WhatsApp messages are sent through the Meta WhatsApp Business Cloud API, only to patients who opt in when they book. Meta handles those messages under its own terms.

How long we keep data

We keep marketing website enquiries only for as long as we need them to talk with you about Velvet Lead, and delete them once they are no longer needed for that purpose. Newsletter addresses are kept until you unsubscribe.

We keep clinic data for as long as the clinic uses Velvet Lead. When a clinic leaves, we handle its data as agreed with the clinic, which may include returning or deleting it.

Your rights

Depending on where you live, you may have the right to:

• ask for a copy of your personal data
• ask us to correct or delete it
• object to or limit how we use it
• withdraw consent to marketing at any time

To make a request about our marketing website, email velvetleads@gmail.com. If your request is about a clinic's patient data, please contact the clinic directly. We will help the clinic respond.

Children

Our marketing website is for clinic owners and staff. It is not meant for children, and we do not knowingly collect their data through it.

International transfers

We work with clinics in Pakistan and the United States, and our providers may store data in other countries. Where we transfer data, we take steps to protect it as described in this policy.

Changes to this policy

We may update this policy as the product or the law changes. The date at the top shows when it last changed. For significant changes that affect clinics, we will tell clinics directly.

Contact us

Questions about this policy can go to velvetleads@gmail.com or {{ADDRESS}}.