What we collect, what we never collect.

Draft for attorney review. This page is a working draft prepared before launch and must be reviewed by counsel before it is relied on.

Effective date: to be set at launch. This policy covers the GlimpseMD marketing website (glimpsemd.com), the clinic dashboard (app.glimpsemd.com), and the patient-facing visualization tool that clinics embed on their own websites or run on a glimpsemd.com subdomain.

1. Who we are

GlimpseMD is operated by Phoenix Online Media, Gilbert, Arizona ("we", "us"). For the patient-facing tool, the clinic that placed the tool on its website is the party that receives your consultation request; we act as the service provider that runs the tool on the clinic's behalf.

2. Patient-facing tool: what happens to your photo

Photo quality checks and the positioning of your facial features are performed in your browser. The facial feature measurements never leave your device and are discarded when the session ends or when you press "Delete and start over."
When you press Generate, your photo and the selected area are sent to our server and then to our AI image provider once, held in memory for that request, and discarded. We do not write photos or generated images to disk or to a database, and we do not create public links to them.
Our AI image provider may retain API inputs for up to 30 days for abuse and safety monitoring, after which they are deleted. We do not use your photo to train any model and we do not permit our provider to do so.
Camera and location metadata is removed from the photo before it is sent to the provider.
We record that a simulation ran: the clinic, the service selected, the amount, the time, and whether a result was shown. This record contains no photo, no result, and no information about you.

3. Consultation requests

If you ask a clinic to contact you, your name, email, phone, optional ZIP code, optional timeline, optional message, and a summary of the service you explored are sent by email to the clinic you chose. We do not store the contents of that request. We record only that a request was delivered. When you provide a ZIP code, the clinic's email may include the median household income for that ZIP code area from public United States Census data. This is information about the area, not about you.

4. Clinic accounts

For clinics that sign up, we store the account email, clinic profile, branding, enabled services, lead delivery settings, plan, and usage counts. Payment details, when billing launches, will be handled by a payment processor and not stored by us.

5. Marketing website

The contact form sends your message to us by email; we do not store it in a database. We do not use advertising pixels or session replay on the patient-facing tool. Analytics on the marketing site, if any, will be listed here.

6. Service providers

Hosting and application delivery (Vercel).
Database, authentication, and clinic logo storage (Supabase).
AI image generation (OpenRouter, routing to OpenAI image models).
Email delivery for consultation requests and contact messages (Resend).
Public area statistics (United States Census Bureau API, ZIP code only).

7. Your choices and rights

You can delete a session at any time from the tool. Because we do not store photos, results, or request contents, there is nothing further for us to delete on your behalf; contact the clinic directly regarding the consultation request it received. Depending on where you live you may have rights to access, correct, or delete personal information we hold and to opt out of certain processing. Contact us using the details on the Contact page.

8. Children

The patient-facing tool is for adults. We do not knowingly process photos of anyone under 18.

9. Changes

We will post changes on this page with a new effective date.