Privacy Policy

1. Introduction

NAM Solutions LLC, d/b/a Consult Engine (“we,” “us,” or “our”) operates an AI-powered patient acquisition platform for cosmetic and aesthetic clinics. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our platform, including the embeddable smile/skin visualizer widgets, the clinic admin dashboard, and our website at consultengine.ai.

2. Information We Collect

2.1 Patient/Visitor Information

When you interact with a clinic’s embedded visualizer, we may collect:

• Contact information: Name, email address, and phone number (provided voluntarily via the lead capture form).
• Treatment preferences: The cosmetic treatment type you select (e.g., veneers, whitening, skin rejuvenation).
• Facial imagery: Public visualizer camera frames and uploaded photos are processed ephemerally and are not retained after the preview. In a clinic’s Chairside workflow, a before/after preview or Final Result may be retained only after separate, case-specific patient consent, in private access-controlled case storage; it remains private unless a separate portfolio release is recorded.
• Consent records: Timestamps and scope of permissions you grant (camera access, data processing, AI generation).
• Device/browser data: IP address (for rate limiting only), browser type, and screen resolution.

2.2 Clinic Administrator Information

When clinics sign up, we collect:

• Practice name, admin name, email, and phone number.
• Billing information (processed by a third-party payment processor; we do not store card numbers).
• Connected-system credentials stored encrypted at rest using AES-256-GCM.

2.3 Automatically Collected Data

• IP addresses for distributed rate limiting (counter only; no patient data stored).
• Aggregate usage analytics for the admin dashboard (leads generated, conversion rates).

3. How We Use Your Information

• Provide the service: Generate AI-powered treatment visualizations using your facial imagery.
• Lead capture: Forward your contact information to the clinic whose visualizer you used, so they can follow up about treatment options.
• CRM sync: Sync lead data to the clinic’s connected CRM for follow-up workflows.
• Appointment booking: Facilitate online scheduling through a connected scheduling system when enabled by the clinic.
• AI Receptionist follow-up: Facilitate automated follow-up calls when enabled by the clinic.
• Transactional communications: Send lead notifications to clinic administrators.
• Improve the platform: Aggregate, de-identified analytics to improve visualization quality and conversion rates.

4. How We Share Your Information

We do not sell your personal information. We share data only as follows:

• With the clinic: Your contact information and treatment preferences are shared with the clinic whose widget you used.
• Service providers (sub-processors): Depending on the clinic’s enabled features, the platform may use the following service categories. A PHI flow must remain disabled until its required agreement and production approval are in place:

• Legal compliance: We may disclose information if required by law, court order, or governmental request.

5. Data Retention

• Lead records: The default retention window is 730 days; the clinic/platform-approved policy and legal holds may require a different period.
• Call logs: The default retention window is 365 days; the clinic/platform-approved policy and legal holds may require a different period.
• Facial images: Public visualizer images are processed in-memory only and cleared after the session. Consented Chairside case media may be retained in private clinic storage for the applicable case-retention period, subject to legal holds and verified privacy-deletion workflows; Final Results and portfolio publication each require separate consent.
• Audit logs: Retained indefinitely for compliance purposes.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of the personal data we hold about you.
• Deletion: Request deletion where applicable. The clinic evaluates record-retention duties and legal holds before supported records are erased.
• Correction: Request corrections to inaccurate personal data.
• Opt-out: Decline to provide information at any time (you simply close the widget).
• Consent choices: Decline optional processing before submission and contact the clinic about any prospective withdrawal available under applicable law.

To exercise any of these rights, contact us at privacy@consultengine.com.

7. Security Measures

• All data transmitted over HTTPS/TLS.
• Sensitive credentials encrypted at rest with AES-256-GCM.
• Admin passwords hashed with bcrypt (cost factor 12).
• Distributed rate limiting to prevent abuse.
• Tenant isolation: each clinic can only access their own data.
• PHI-safe logging strips emails, phone numbers, and image data from system logs.
• Client-side PHI cleanup after each session.

8. Cookies

We use minimal cookies necessary for platform operation:

• Authentication cookie: HttpOnly JWT session cookie for admin login.
• Cookie consent: A localStorage flag recording your consent preference.

Advertising integrations are loaded only when explicitly configured by the clinic and allowed by the visitor’s marketing-consent choice. Patient conversion disclosures must remain disabled unless separately approved for the healthcare context.

9. Children’s Privacy

Our platform is not directed to individuals under 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us information, contact us for immediate deletion.

10. Changes to This Policy

We may update this Privacy Policy periodically. Changes will be posted on this page with an updated “Last updated” date. Continued use of the platform after changes constitutes acceptance.

11. Contact Us

For privacy-related inquiries or to exercise your data rights:

• Legal entity: NAM Solutions LLC, d/b/a Consult Engine
• Email: privacy@consultengine.com
• Subject line: “Privacy Request”