Privacy policy

Effective August 1, 2026. Updated October 25, 2026. Questions: hello@consentshot.com.

The short version: ConsentShot stores clinic sign-in details, staff names, patient names and dates of birth, patient photos, signed consent records, and an audit log of clinic activity. Patient photos may include faces. We store clinic records using Amazon Web Services; clinic-directed sharing is described below. The app contains no analytics SDKs and no third-party trackers. We never sell data, and we never use it for advertising. Everything is encrypted in transit and at rest.

Who this policy covers

ConsentShot is a before and after photo and consent app for medical practices. A clinic subscribes, and its staff use the app on clinic devices. That means two kinds of people show up in our records: clinic account holders and staff, and patients whose photos and consent forms the clinic stores. This policy explains what we hold about both.

The clinic is the owner of its patient records. We process them on the clinic's behalf so the app can work. If you are a patient with a question about photos of you, start with your clinic; it controls the record and can show or export it, or request permanent deletion through support.

What we collect

Clinic account email and password. Used to sign the clinic in. Passwords are handled by our authentication provider and we never see them in plain text.
Staff records. We store staff names and existing PIN records for legacy clinic access. Shared clinic-device access does not use personal staff PINs or require staff switching.
Patient names and dates of birth. Entered by clinic staff to identify the patient's record.
Patient photos. Captured inside the app on the clinic device. They upload to our servers and are not written to the device's camera roll.
Signed consent records. The consent form text, the patient's finger signature, the signer's name, the permission choices the patient made, a timestamp, and an identifier for the device the form was signed on. The device identifier is part of the record's audit trail; it is not an advertising identifier.
Audit logs. Our servers record each capture, view, and export and when it happened. With shared clinic-device access, clinical actions are attributed to Clinic device, not a verified individual. Owner actions are attributed to the owner account, not proof of the person using it.

That is the whole list. The app does not read your contacts, your location, or the device camera roll. The camera permission is used only to take clinical photos inside the app.

Face data: what we collect

Clinic staff can capture ordinary photographs of a patient's face using the device camera, with the patient's recorded consent. These facial photographs are the face data we collect. ConsentShot does not collect face scans, depth maps, facial landmarks, face geometry, or biometric templates, and does not perform facial recognition or identify people from their faces.

Face data: how we use it

Facial photographs are linked to the clinic's patient record for photo documentation, before-and-after comparison, a prior-photo overlay to help staff manually align a new photograph, and consent-authorized watermarked exports. We do not analyze facial features, infer identity or health information from faces, or use facial photographs for advertising, profiling, research, or AI model training. No additional use of face data is planned.

Facial photographs are stored in private, encrypted Amazon Web Services (AWS) S3 storage in US East (Ohio); associated patient, consent, and photo records are stored in encrypted AWS PostgreSQL databases there. AWS processes this data as our contracted infrastructure provider on our instructions. Authorized clinic users access their own clinic's records. We do not sell face data or send it to advertising, analytics, facial-recognition, or AI services.

A clinic user can share a watermarked facial photograph through the device's share sheet only when the server confirms the recorded consent permits that export. The user chooses the recipient or other app; that destination receives the photograph and handles its copy under its own privacy practices. We do not automatically post photos to social networks. Revoking consent blocks future exports; it cannot recall copies already shared. Disclosure may also occur when required by law, limited to what the law requires.

Face data: retention and deletion

Saved facial photographs have no automatic expiry: they are retained as clinic records while the account is active until the clinic directs permanent deletion, subject to applicable record-retention obligations or legal holds. Archiving in the app hides a record; it does not permanently delete it. Patients should ask their clinic; clinic owners can request deletion or account closure at hello@consentshot.com. Permanent deletion is an operator-assisted process, not an automatic result of archiving, consent revocation, or subscription cancellation.

For account closure, we arrange return of the clinic's records and retain them for at least 30 days after the clinic confirms receipt before an authorized purge, with longer retention if a legal hold or record-retention obligation applies. Purging removes stored photo versions and return/export copies; database backups can retain deleted associated records for up to seven further days. We confirm completion rather than treating a request as completed deletion.

Temporary upload files have a three-day storage expiry and temporary export files a one-day expiry; older versions have a one-day expiry. Storage lifecycle deletion can take additional processing time. Device captures are temporarily cached, with pending captures encrypted; they are removed after confirmed save, discard, or sign-out. Temporary device export files are cleaned up after sharing. The app does not automatically save captures to the camera roll. Copies a clinic user saves or shares outside ConsentShot remain under that user's or recipient's control.

What we use it for

One purpose: making the product work for the clinic. Photos and consent records exist so the clinic has a clinical record and so the export gate can check the signed consent before anything leaves the app. Sign-in details control access to the clinic account; audit logs record activity under that access. We do not use any of this data for advertising, marketing profiles, or model training.

What never happens

No selling data. Not to anyone, not in anonymized form, not as part of an acquisition of "user insights."
No third-party analytics or tracking. The app ships with zero analytics, crash-reporting, or advertising SDKs.
No sharing with third parties, except clinic-directed exports described above, the infrastructure providers who host our servers and storage (they process data under contract, on our instructions, and cannot use it for their own purposes), and disclosures the law compels, which we would limit to what the law requires.
No patient photos in our marketing. Ever.

How it is protected

Photos and consent records are encrypted in transit and at rest. Access inside a clinic uses a persistent shared clinic-device sign-in, without personal staff PINs or staff switching. The device lock protects access to the signed-in device. Owner settings require a separate, fresh password sign-in. Access is logged under the clinic-device or owner account attribution described above. Exports are checked server-side against the signed consent: if the form does not cover the use, the export is blocked. If a patient revokes consent, future exports stop immediately.

HIPAA

We designed ConsentShot to be used with protected health information, whether or not a given practice is a HIPAA covered entity. For practices that are, we sign a Business Associate Agreement. Email hello@consentshot.com and we will send one.

How long we keep it

Photos, consent records, patient records, and audit history are retained for the clinic's record-keeping needs rather than automatically expiring. Facial photographs follow the same rules. See Face data: retention and deletion for deletion requests, the account-closure return and holdback process, legal holds, temporary-file expiry, and the seven-day database backup window.

Your choices

Patients: your consent form lists exactly what you allowed, and you can revoke it through your clinic at any time. Revocation blocks future exports the moment it is recorded. For access, correction, or deletion of your photos, contact your clinic; we will support whatever the clinic directs.
Clinics: you can export or delete your data, or close your account, by emailing us.
Everyone: depending on where you live, privacy law may give you rights to access, correct, or delete personal information. Email us and we will honor them, working with your clinic where the record belongs to it.

Children

ConsentShot is a professional tool for practice staff, not a consumer app, and we do not knowingly collect information from children. Where a clinic treats a minor, consent works the way it does in the rest of medicine: through the parent or guardian, under the clinic's own policies.

Changes to this policy

If we change this policy, we will update this page and the date at the top. If a change reduces protections in any real way, we will email clinic account holders before it takes effect.

Contact

ConsentShot
hello@consentshot.com