Privacy Policy
Effective date: July 30, 2026 · Last updated: July 30, 2026
1. Scope and roles
This Privacy Policy explains how Rhodium handles personal information in connection with the Services.
1.1 Two relationships
1. Clinic / Customer accounts (B2B) — When a medical spa or clinic (“Customer”) uses Rhodium, Rhodium typically processes Customer Data, including patient, lead, and staff information the Customer stores in Rhodium, on the Customer’s behalf as a service provider, processor, or business associate as applicable. The Customer decides what to collect and how to use it for their business.
2. Rhodium’s own website and sales/marketing — When you interact with Rhodium’s marketing sites or become a Rhodium prospect or customer contact, Rhodium acts as a controller of that business-contact information.
If you are a patient or consumer of a clinic, please contact that clinic and review their privacy policy. Rhodium generally does not respond to patient requests directly except as required by law or as instructed by the Customer under a BAA/DPA.
2. Personal information we process
Depending on how the Services are used, we may process Customer staff and portal user details including name, email, phone, authentication data, roles, login logs, and support communications. We may also process Customer Data such as identifiers and contact details; date of birth, gender, preferences, and consent flags; appointments, treatments, loyalty data, surveys, reviews, and message history; EMR/PMS-synced clinical and scheduling data; uploaded images or files; and advertising identifiers such as Google gclid and Meta click identifiers. Some Customer Data may be PHI or otherwise sensitive under HIPAA or state law.
We may process website and product analytics, including device and browser data, IP address, approximate location, pages viewed, referring URLs, cookies, diagnostics, crash, and performance data. We also process business billing details and transaction metadata through payment processors such as Stripe or Square. Card data is typically processed by the payment provider and not stored in full by Rhodium.
3. Sources of information
We receive information directly from you through account signup, forms, and support; automatically from use of the portal, websites, and APIs; from Customer systems you connect including EMR/PMS, CRM, phone, ecommerce, and ad platforms; and from service providers supporting Rhodium, including hosting, delivery, analytics, and AI providers under contract.
4. How we use information
We use personal information to provide, operate, secure, and support the Services; authenticate users and enforce access controls and tenant isolation; enable Customer-configured messaging, marketing, scheduling, and CRM workflows; power enabled integrations; improve reliability; prevent fraud and abuse; comply with law; communicate about the Services, billing, and product updates; and create de-identified or aggregated statistics that do not reasonably identify individuals.
4.1 Advertising platform processing
When a Customer enables Google Ads, Rhodium may link Customer accounts; create and manage campaigns; upload hashed Customer Match audiences; upload offline conversions tied to click IDs; store OAuth refresh and access tokens encrypted for the Customer’s company tenant; and use Rhodium’s platform developer token server-side. When enabled, Meta, Facebook, and Instagram integrations may support lead forms, campaign tooling, and conversion events with hashed identifiers. Other enabled tools may include Amazon Ads, StackAdapt, and a first-party Rhodium pixel.
5. How we share information
We do not sell personal information for money. We may share information with Customer-authorized users within that Customer’s tenant; subprocessors and vendors supporting hosting, databases, delivery, integrations, CRM, AI, error monitoring, session analytics, and payment processing; advertising platforms only when a Customer connects them and initiates syncs, campaigns, or conversions; professional advisors or authorities for legal, security, or regulatory requirements; and parties involved in corporate transactions subject to appropriate safeguards. Vendors that process PHI are expected to have appropriate contractual protections, including BAAs where required.
6. Cookies and similar technologies
We and certain partners use cookies, pixels, and similar technologies to keep you signed in and remember preferences; measure product usage and diagnose errors; support Customer website tracking and attribution pixels; operate analytics tags where enabled; and support social and advertising SDKs Customers enable. You can control cookies through browser settings, though some features may not work if cookies are blocked. Customers embedding Rhodium pixels or lead forms on their sites are responsible for their own cookie and consent notices.
7. Security
We implement administrative, technical, and physical safeguards appropriate to the Services, which may include encryption in transit and encryption of certain secrets and tokens at rest; access controls, authentication, and tenant scoping; logging and monitoring; and vendor diligence for sensitive processing. No method of transmission or storage is 100% secure. Promptly notify us of suspected unauthorized access at info@rhodiumsoftware.com.
8. Retention
We retain personal information for as long as needed to provide the Services, meet legal and accounting requirements, resolve disputes, and enforce agreements. Healthcare-related records may be retained longer consistent with Customer instructions and applicable law. Upon termination, Customer Data handling follows the Terms, order form, and off-boarding process.
9. Your choices and rights
Customer staff may update profile information in the portal where available, or by contacting their clinic admin or info@rhodiumsoftware.com. Patients and consumers of a clinic should submit access, deletion, correction, or restriction requests to the clinic. Depending on your state, you may have rights to know, delete, correct, or opt out of certain sharing. For Rhodium-controlled marketing contact data, email info@rhodiumsoftware.com with the subject “Privacy Request.” We do not knowingly sell personal information or use it for cross-context behavioral advertising except as directed by a Customer through ad-platform integrations they control. You may unsubscribe from Rhodium marketing emails via the link in the message; product and account notices may still be sent.
10. Children
The Services are directed to businesses and adults. Rhodium does not knowingly collect personal information from children under 13, or under 16 where required, for Rhodium’s own purposes. Customers are responsible for age-appropriate practices in their patient and lead collection.
11. International transfers
Rhodium is based in the United States and processes information in the U.S. and other locations where we or our sub-processors operate. If you access the Services from outside the U.S., you understand information may be transferred to the U.S., which may have different data-protection rules.
12. Third-party sites
Links to third-party sites or clinic-hosted policies are not controlled by Rhodium. Their privacy practices apply to those properties.
13. Changes to this Policy
We may update this Privacy Policy periodically. The “Last updated” date will change when we do. Material changes may be notified via the portal or email. Continued use after the effective date means you acknowledge the updated Policy, except where additional consent is required by law.
Appendix A — Categories of third parties
The Services may involve cloud hosting and storage; identity providers; databases; customer support tooling; email, SMS, and voice providers; EMR/PMS connectors; payment processors; CRM tools; advertising platforms; AI, speech-to-text, and vision providers; error and session monitoring; and analytics tags. A current subprocessor list may be provided to Customers under NDA or via security review upon request.