Privacy Policy

1. Introduction & Scope

GetIntakes ("GetIntakes", "we", "us", or "our") provides business-to-business intake workflow automation and triage routing software to medical aesthetics clinics, plastic surgery practices, and aesthetic and surgical clinics ("Clients"). This Privacy Policy describes how we collect, process, and safeguard information submitted through our website and platform applications.

2. Information We Collect

Depending on your interactions with GetIntakes, we may collect:

• Business Account Information: Names, clinical practice names, professional email addresses, phone numbers, and administrative credentials.
• Client Intake Submission Data: Form responses, scheduling preferences, and project/procedure scoping inquiries submitted by prospective patients or customers of our Clients.
• Technical Usage Information: Browser type, IP address, device telemetry, session duration, and standard web analytics data collected via cookies or tracking tags.

3. Protected Health Information (PHI) & HIPAA

Where GetIntakes handles Protected Health Information (PHI) on behalf of a Covered Entity Client under the Health Insurance Portability and Accountability Act (HIPAA), GetIntakes operates as a Business Associate. Our obligations regarding PHI are governed by the applicable Business Associate Agreement (BAA) executed with each respective Covered Entity Client. BAAs are available upon request for eligible healthcare practice accounts.

4. Use of Artificial Intelligence & Large Language Models

GetIntakes is designed to interface with third-party language and vision models (including Google Gemini 3.8 Flash via Google Cloud Vertex AI and Google AI Studio) via commercial enterprise APIs. We configure our API connections with enterprise zero-data-retention and zero-model-training settings where commercially supported. Client inquiry data is not used by our platform to train publicly available foundation models.

5. Data Security & Encryption Standards

We implement technical, physical, and administrative safeguards designed to protect personal data against unauthorized disclosure, alteration, or destruction. All data in transit is encrypted using modern TLS (Transport Layer Security) protocols, and data at rest is stored using industry-standard AES-256 encryption.

6. Third-Party Disclosures

We do not sell, rent, or trade personal data or client intake submissions to third-party data brokers. Data is shared strictly with approved sub-processors necessary to deliver the service (e.g., cloud hosting providers, payment processing networks like Stripe/Square, and practice EMR APIs authorized by the Client).

7. Your Rights & Contact Information

Depending on your jurisdiction, you may have rights to access, correct, export, or request the deletion of your personal data. For privacy inquiries or to request a Business Associate Agreement, contact our compliance team: