Velvet Lead privacy policy

This privacy policy explains how Velvet Lead ("we", "us") handles personal data. It covers two things: this marketing website, and the patient-booking websites and admin panels we build for clinics.

It does not replace the privacy policy on each clinic's own website. Patients should read their clinic's policy to understand how that clinic uses their information.

Who we are

Velvet Lead is a studio that builds and launches patient-booking websites for clinics and med spas in the United States.

• Email: velvetleads@gmail.com
• Address: {{ADDRESS}}

Our marketing website

Information you give us

When you book a demo or contact us, the form asks for:

• your name and clinic name
• business type, country and city
• email address and mobile or WhatsApp number
• your current website, if you have one
• a range for how many inquiries your clinic gets each month
• the biggest problem you want to solve
• how you heard about us

If you sign up for our newsletter, we collect your email address.

The demo form includes a separate checkbox for marketing emails. It is unchecked by default. We only send you marketing emails if you check it or sign up for the newsletter, and you can unsubscribe at any time.

Information collected automatically

• Campaign and landing page details. If you arrive through a link with campaign tags (UTM parameters), we store those tags and the first page you landed on in a first-party cookie for 30 days. If you then send a form, these details are saved with your inquiry so we know which campaign brought you to us.
• Website analytics. We use Vercel Analytics, a privacy-friendly web analytics tool that does not use cookies. It tells us which pages are visited, without building a profile of you.
• Scheduling embed. If you choose to book a call, we may load a Calendly scheduling widget (https://calendly.com/velvetleads/30min). It only loads when you interact with it. Calendly then handles the information you enter under its own privacy policy.

Our cookie policy lists each cookie in more detail.

How we use this information

We use the information from our marketing website to:

• reply to your inquiry and arrange a demo or call
• understand whether Velvet Lead fits your clinic
• send marketing emails and newsletters, only if you agreed
• learn which pages, campaigns and channels bring inquiries, so we can improve the site
• keep the website secure and working

We do not sell your personal data.

Service providers

We use a small number of providers to run the marketing website:

• Vercel hosts the website and provides web analytics.
• Google (Gmail) delivers our emails, including form notifications and newsletters.
• Inquiries sent through our forms are delivered to our team by email. We don't store them in a website database.
• Calendly provides the optional scheduling widget.

These providers process data for us so we can run the website. Some of them may store data outside your country, including in the United States.

Clinic websites and admin panels

Our role

When a clinic uses Velvet Lead, its patients book appointments, send inquiries and chat with the AI assistant on the clinic's website. That personal data belongs to the clinic.

The clinic decides why and how patient data is used. We process it on the clinic's behalf and act on the clinic's instructions. If you are a patient, please contact your clinic about your data. If you contact us, we will pass your request to the clinic.

Data we process for clinics

Depending on how a clinic uses the product, this can include:

• patient names, email addresses and phone numbers
• appointment details, such as treatment, practitioner, date and time
• inquiry messages, lead source and campaign tags
• conversations with the clinic's AI assistant
• whether a patient accepted the clinic's privacy notice and whether they gave marketing consent, with the time and source
• consent records for before-and-after photos
• patient numbers, visit history and whether a patient asked for WhatsApp messages or text reminders
• deposit status for bookings that take a deposit (card details are handled by Stripe and never reach the clinic's website)
• answers to the clinic's medical form, and treatment consent with the exact wording agreed to, a typed-name signature and the time
• clinical records written by the clinic's practitioners: medical summaries, consultation notes, and treatment records including product lot numbers
• reviews patients leave, and whether they chose to share them publicly or with the clinic's team only
• staff names, email addresses and roles

Medical forms and clinical records contain health information. Only the clinic's practitioners and admins can read them. The product isn't a full electronic medical record: it does not include e-prescribing, lab results, insurance billing or telehealth.

What we use it for

We use clinic data only to provide the service to that clinic. That includes showing availability, taking booking deposits, sending booking emails and the WhatsApp messages and text reminders the patient opted in to, collecting medical and consent forms, sending review requests and rebooking reminders, running the AI assistant, producing reports, and providing support.

How we protect it

• A separate database for each clinic. Each clinic's data is kept in its own database.
• Role-based access. Clinic staff have the role admin, manager, practitioner or front desk. The database enforces what each role can see, not just the screen. Only practitioners and admins can read clinical information.
• Clinical records that can't be quietly changed. Signed consultation notes can't be edited or deleted; corrections are added as dated amendments. Every change to a clinical record, and every time one is opened, is logged.
• Error monitoring. Automatic error alerts come to the Velvet Lead team so we can fix problems quickly.
• Trusted infrastructure. The product runs on a Postgres database through Supabase and is hosted on Vercel.

No system is perfectly secure, but we work to protect data against loss and unauthorized access. You can read more on our security page.

Messaging providers

Booking emails are sent through the email account the clinic connects, such as Gmail, another SMTP server or Resend. WhatsApp messages are sent through the Meta WhatsApp Business Cloud API, only to patients who opt in when they book. Text message reminders are sent through Twilio, only to patients who ask for them. Meta and Twilio handle those messages under their own terms.

Payments

Where a clinic takes booking deposits, patients pay on Stripe's secure payment page, through the clinic's own Stripe account. Stripe processes card details under its own terms, and card details never reach the clinic's website or Velvet Lead.

How long we keep data

We keep marketing website inquiries only for as long as we need them to talk with you about Velvet Lead, and delete them once they are no longer needed for that purpose. Newsletter addresses are kept until you unsubscribe.

We keep clinic data for as long as the clinic uses Velvet Lead. When a clinic leaves, we handle its data as agreed with the clinic, which may include returning or deleting it.

Some clinic data is removed automatically sooner: AI assistant chat transcripts are deleted after 12 months; visitors' IP addresses and browser details on inquiries and signed forms are cleared after 90 days; and message contents are cleared from the sending queue 30 days after sending. Clinical notes and treatment records are not deleted along with a booking or a patient.

Your rights

Depending on where you live, you may have the right to:

• ask for a copy of your personal data
• ask us to correct or delete it
• object to or limit how we use it
• withdraw consent to marketing at any time

To make a request about our marketing website, email velvetleads@gmail.com. If your request is about a clinic's patient data, please contact the clinic directly. We will help the clinic respond.

Children

Our marketing website is for clinic owners and staff. It is not meant for children, and we do not knowingly collect their data through it.

International transfers

We work with clinics in the United States, and our providers may store data in other countries. Where we transfer data, we take steps to protect it as described in this policy.

Changes to this policy

We may update this policy as the product or the law changes. The date at the top shows when it last changed. For significant changes that affect clinics, we will tell clinics directly.

Contact us

Questions about this policy can go to velvetleads@gmail.com or {{ADDRESS}}.