GDPR · Health data

Privacy Notice

Clear information about roles, legal bases, access, retention, safeguards, and your rights for medical data.

Version 2026-08-17 · Last updated: 17 August 2026

About this notice

This notice explains transparently how Aesthetic Pass protects and processes medical and other personal data through clear roles, defined purposes and legal bases, controlled access, documented retention, and concrete data-protection rights.

1. Who is responsible and which role applies?

This notice provides information under Articles 13 and 14 GDPR. It is not a consent form. Reading it, accepting Terms, or merely using the service is not by itself explicit consent to process health data.

drylabs GmbH, Straße der Jugend 18, 14974 Ludwigsfelde, Germany, registered with Amtsgericht Potsdam under HRB 41588 P, operates Aesthetic Pass. Email: privacy@aestheticpass.com.

drylabs GmbH is the controller for consumer account administration, platform security, subscription administration, the public website, direct support, and product decisions for patient-led features.

Our protection commitment: We handle health and treatment information as specially protected data. Our privacy framework combines purpose limitation and data minimisation with role- and treatment-relationship-based access, layered technical and organisational safeguards, documented retention and deletion rules, and defined incident-response procedures. We do not sell health data, use it for behavioural advertising, or train models on patient records or patient photographs.

When a clinic or practitioner decides why and how a provider-created treatment record is made, used, corrected, retained, or disclosed, that clinic or practitioner is normally the controller for that medical record. drylabs GmbH generally acts as its processor under Article 28 GDPR to the extent it processes the record on documented instructions. The facts and the applicable agreement determine the role; a contract label cannot override reality. Contact the relevant clinic first for requests about its treatment file. We will assist the clinic and will handle any part for which drylabs GmbH is itself controller.

Data Protection Officer: Dr. Csilla Geleta, Fachärztin für Arbeitsmedizin (specialist physician in occupational medicine). Contact her directly about the processing of personal data or the exercise of data-protection rights at csillageleta@aestheticpass.com.

2. Data we process and where it comes from

Account and identity: user ID, name, email address, date of birth, role, language, timezone, authentication and onboarding status, referral identifiers, and account-security events. Passwords are handled as hashes by the authentication service; we do not store plaintext passwords.
Health and treatment data: skin type, anamnesis answers, allergies and reactions, consent/discussion records and signatures, treatment type and date, practitioner and clinic, products, manufacturers, practitioner-entered lot numbers, quantities, notes, injection zones/maps, outcomes, reminders, and numerical Bio Age results. These are special-category data under Article 9 GDPR when they reveal health.
Photographs: before/after images and progress selfies, their clinical association, type, slot, timestamps, limited upload metadata, and a storage identifier. Apps are designed to remove EXIF metadata before upload.
Practitioner and clinic data: professional profile, title, qualifications, licence details supplied during registration, clinic membership and role, business contact details, subscription tier, inventory and treatment-documentation activity.
Device, security, and diagnostics: IP address, user agent, app/build and operating-system version, device model, bounded error details, MetricKit data on iOS, Firebase Crashlytics diagnostics on Android, rate-limit events, and APNs/FCM notification tokens. Diagnostic payloads can incidentally contain technical context and are treated as potentially personal.
Passport sharing: hashed bearer-token records, validity period, patient association, and access evidence including time, IP address, and user agent.
Payments: plan, status, expiry, processor, and opaque Apple, Google, Stripe, or PayPal transaction/subscription identifiers. Payment providers retain the payment instrument; Aesthetic Pass does not receive full card or bank details.
Website, booking, and correspondence: support/demo messages; for appointment booking, the name, email, optional phone, selected service/provider, date/time, privacy-notice evidence, lifecycle state, and an opaque management credential; Product Atlas contributions, analytics preference, limited acquisition/interaction categories, and ordinary request/security metadata. Booking forms do not accept free-text medical or emergency information.
Data comes from you, a clinic or practitioner acting in a treatment context, your device and app stores, payment and notification providers, or security/hosting infrastructure. If a practitioner records data about you, Article 14 information may also be provided by that practitioner.

3. Purposes and legal bases

Account identity and authentication fields are contractually required to provide a private account. Health fields and photos are required only for the particular record or feature you choose to use; without them, that feature cannot be provided. Optional analytics can be refused without losing the service.

Where processing relies on consent, it can be refused or withdrawn prospectively at any time. Refusal or withdrawal does not remove access to provider-created records, privacy information, export/request channels, or other statutory rights. It does not affect prior lawful processing and does not override a clinic's separate legal basis or record-retention duty.

Purpose	Article 6 basis	Article 9 condition where health data is involved
Create and operate an account and provide non-health account functions	Art. 6(1)(b), and Art. 6(1)(f) for limited platform administration	Not applicable unless the operation includes health data
Provide optional patient-controlled treatment-passport creation, reactions, progress photos, Emergency ID, passport sharing, and stored Bio Age functions	Art. 6(1)(b) for the requested service	Art. 9(2)(a): explicit consent for the specified patient-led purposes
Create and maintain a provider treatment file	The clinic determines its basis, commonly Art. 6(1)(b), (c), or (f), depending on the treatment and legal duty	Art. 9(2)(h), together with applicable German law including § 22(1)(1)(b) BDSG where its requirements are met; otherwise another applicable Article 9(2) condition
Authentication, abuse prevention, access logging, incident detection, backup and recovery	Art. 6(1)(f): legitimate interest in confidentiality, integrity, availability, and evidence; Art. 6(1)(c) where a security duty applies	The Article 9 condition applicable to the protected source data. Article 32 requires safeguards; it is not a separate permission to collect health data
Subscriptions, invoices, refunds, and accounting	Art. 6(1)(b) and (c)	Normally not required; any incidental link to health features is minimised
Transactional reminders and service communications	Art. 6(1)(b) or (f); consent where communications law requires it	The condition supporting the requested treatment-related function
Arrange an appointment for a clinic through Aesthetic Pass Booking	The clinic determines the basis, commonly Art. 6(1)(b) or (f); drylabs GmbH processes on its instructions	The booking service is designed not to collect health-data free text. If the selected service itself reveals health, the clinic must document the applicable Article 9 condition
Optional Google Analytics on allowlisted public marketing pages	Art. 6(1)(a) consent	No health, passport, account, treatment, dashboard, or checkout pages are in the analytics allowlist
Aggregate Cloudflare Web Analytics and bounded first-party website measurement	Art. 6(1)(f), balanced against visitors' rights	No health or treatment data is intentionally sent
Establish, exercise, or defend legal claims	Art. 6(1)(f)	Art. 9(2)(f)

4. Health data, photos, biometrics, Bio Age, and integrations

Provider-authored treatment entries, injection maps, signed anamnesis records, and clinical before/after photos are treated as parts of a medical record where the treatment context and applicable law require that. Corrections must remain recognisable; they are not silently overwritten.
Patients can delete progress selfies and photos attached to a treatment they logged themselves. A patient cannot use the normal photo endpoint to delete practitioner-linked clinical before/after photos.
Bio Age inference runs on the device. The numerical estimate, timestamp, and model version may be stored in the account. It is a cosmetic estimate, not a diagnosis, and is not used to make a legal or similarly significant decision.
Face ID, Touch ID, and Android biometric checks are performed by the operating system. Aesthetic Pass receives the success/failure result, not the biometric template.
We do not use patient photographs or health records to train machine-learning models, for facial recognition, or for advertising.
No EMR connection is offered or active. We do not transmit records to Aesthetic Record, Zenoti, or another EMR.

5. Who can receive data

Service providers acting as processors receive data only for the services described here and are required to protect it and follow the applicable processing instructions. Contact us for current information about processors, subprocessors, and transfer safeguards relevant to your data.

You and authorised account users: the patient, the practitioner who authored a record, practitioners with an active patient-provider link, and authorised clinic administrators according to role and purpose. A pending provider request is limited to identity needed for acceptance and does not expose the clinical card.
Supabase: EU-region database, authentication, Edge Functions, and private Storage. Core application records are hosted in the West EU (Ireland) region. Supabase privacy information.
Cloudflare: Workers hosting, CDN/security, D1 appointment-booking storage, Cloudflare Images, encrypted R2 disaster-recovery storage, rate limiting, and cookie-free Web Analytics. Cloudflare privacy information.
Apple and Google: app distribution, subscription verification, APNs/FCM notifications, and platform diagnostics. Firebase Crashlytics is used for Android diagnostics.
Stripe and PayPal: supported web and clinic subscription processing.
Resend and Google Workspace/Gmail: operational email such as support, demo, tier, and Product Atlas correspondence. Booking receipts sent through Resend contain the recipient address and generic status text, but no client name, service, provider, appointment time, phone, appointment ID, or management credential. Do not send patient records through public contribution forms.
Google Calendar: only when a provider enables the optional connection. The event is a generic “Aesthetic Pass appointment” busy block containing time and opaque internal references, but no client identity, contact details, service, or provider name.
Authorities, courts, insurers, or professional advisers receive data only where legally required or necessary for a documented legal claim. We do not sell personal or health data and do not disclose it for third-party behavioural advertising.

7. Processing outside the EEA

Core database and authentication data are hosted in Supabase's West EU (Ireland) region. Regional hosting does not mean that every support, security, app-store, payment, or delivery operation is confined to the EEA.

Cloudflare's global network processes IP addresses and request headers at edge locations. Cloudflare Images also processes internal upload metadata used to bind and verify an image, which can include photo, treatment, clinic, practitioner, slot, platform, and categorical treatment identifiers. Image bytes and attached upload metadata may be processed outside the EU.

Apple, Google/Firebase, Stripe, PayPal, Resend, and Cloudflare may process data in countries outside the EEA under their service architecture. Depending on destination and provider, transfers are based on an adequacy decision, the EU-U.S. Data Privacy Framework, Standard Contractual Clauses, or another Chapter V mechanism. Transfer-impact and supplementary-measure assessments form part of the processor review.

A passport recipient chosen by the patient can also be outside the EEA. That user-directed disclosure is distinct from our processor transfers. Contact us for information about the safeguard relevant to a particular transfer.

8. Protection of medical data, security, and accountability

Security reports can be sent to security@aestheticpass.com or the privacy address. We investigate suspected incidents and notify the competent authority and affected people under Articles 33 and 34 GDPR where the legal thresholds are met.

TLS in transit and provider-managed encryption at rest. Database backup archives are additionally encrypted client-side with age.
Private photo storage, signed image delivery, bounded upload size, server-side ownership checks, rate limits, and deny-by-default access where a client role does not need a table.
Row-Level Security for authenticated database access plus independently authenticated Edge Functions for privileged, bearer-passport, webhook, and scheduled operations.
Append-only, access-restricted snapshots with SHA-256 fingerprints preserve the state before a correction or deletion. Treatment, zone, photo-metadata, and anamnesis snapshots apply from the baselines established on 16 August 2026.
Operational audit logs, subscription-event logs, database migrations, least-privilege reviews, and bounded diagnostic retention.
Daily database backups, restore documentation, row-count drift checks, and time-bounded encrypted database-backup tiers. Recovery copies are access-restricted and are not used for ordinary product access.
The iOS client applies platform certificate and hostname trust validation to its Supabase network session. Device biometric locking is local to supported devices.

9. Retention, correction, and account deletion

Article 17 erasure is not absolute. Data may be retained where processing is required by law, for health-care record obligations, or for the establishment, exercise, or defence of legal claims. We will restrict use to that purpose.

Account deletion closes sign-in and account use, then deletes or anonymises data for which no retention exception applies. Provider-created medical records and the minimum identity information needed to keep those records intelligible may remain with the responsible clinic for its applicable documentation period. A retained relationship is read-only: it cannot be used for messaging, a new treatment, or account reactivation. Payment, security, consent, and legal-claim evidence may also be retained for their stated purposes. Contact us if you want confirmation of the categories deleted or retained in your case.

Data	Current retention rule or criterion
Provider-authored treatment records, zones, anamnesis, and associated clinical-photo metadata	Default technical deadline: 10 years from the treatment/record date where § 630f(3) BGB applies, unless the responsible clinic documents another mandatory period or legal hold. The clinic remains responsible for its schedule.
Closed-account identity attached to a retained medical record	Only the stable subject reference and minimum identity information needed to keep the medical record accurate and intelligible; it follows the record's applicable documentation period. Sign-in, contact, device, messaging, and account-use fields are closed, removed, or anonymised.
Closed practitioner account and clinic-accountability reference	Sign-in, contact, device, growth-attribution, and unrelated professional-profile fields are removed or anonymised. A deactivated pseudonymous membership reference remains only while clinic-owned asset metadata or an applicable medical, inventory, supply-chain, contract, accounting, or legal-claim record requires it; accountable records use an assisted custody review.
Patient-only diary/treatment records	While the account is active. When an entry or account is deleted, the restricted correction/deletion snapshot is scheduled for deletion after 30 days unless another legal basis or claim requires retention.
Photo bytes	Follow the classification of the associated record. User-removable progress/self-record photos are deleted through the record-aware endpoint; provider clinical photos are assessed with the treatment file. CDN caches may expire after deletion rather than disappearing instantly.
Passport token fingerprint and access evidence	Bearer link usable for 24 hours; the bearer itself is not retained. The expired fingerprint row is deleted 30 days after expiry. Access evidence containing IP/user-agent data is deleted after 12 months.
MetricKit and first-party client error diagnostics	90 days.
Apple/Google subscription webhook audit	24 months, unless required longer for a dispute or statutory accounting evidence.
Privacy-consent evidence	While consent is current and, after withdrawal, only as long as required to demonstrate the consent and handle related claims. The record is restricted to accountability evidence and is not used to continue withdrawn processing.
Appointment-booking records	Default: 180 days after the appointment, then identifying fields are anonymised unless the responsible clinic documents a different lawful retention period or hold. Online management credentials expire 30 days after the appointment. Booking email outbox records are deleted after 30 days; completed privacy-request evidence is retained for three years.
Backups	Supabase and encrypted booking-database copies: daily 14 days, weekly 56 days, and monthly 365 days. Recovery copies are access-restricted; deletion from live systems propagates as backup generations expire and is not undone in ordinary operation.
Payment, invoice, tax, and contract evidence	For the applicable German commercial/tax limitation and documentation period; the exact period depends on record type.
Public-site categorical conversion events	Generally 3 months. Restricted professional growth/attribution records: up to 24 months.
Support and business correspondence	As long as needed to answer the matter and then for any applicable contract, claim, or statutory period.
Account-closure workflow evidence	Three years after completion. This restricted record contains stable UUIDs, state transitions, timestamps, and category counts, but no name, email, free-text reason, IP address, user agent, or retained object path after completion.

10. Your GDPR rights

Use the in-app export for available account data or email privacy@aestheticpass.com. State the account email and the right you wish to exercise. We may request proportionate identity verification and will normally respond within one month, subject to the lawful extension for complex requests. If a clinic controls the requested treatment record, we will route or assist the request rather than silently decide for that clinic.

Access and a copy (Art. 15); rectification (Art. 16); erasure where no exception applies (Art. 17); restriction (Art. 18); data portability for eligible data (Art. 20); and objection to processing based on legitimate interests (Art. 21).
Withdraw consent at any time for future processing (Art. 7(3)). Optional analytics consent can be changed through “Analytics settings” on public marketing pages.
Ask for information about controller/processor roles, recipients, safeguards for a transfer, and the source of data not collected directly from you.
Lodge a complaint with a supervisory authority (Art. 77) and seek a judicial remedy.

11. Website storage, children, and policy changes

Cloudflare Web Analytics is cookie-free and limited to public pages. Google Analytics 4 is loaded only after consent and only on an explicit public-marketing allowlist. It is never rendered on passport, sign-in, registration, account, dashboard, admin, API, or checkout routes. Google Signals, advertising storage, and advertising personalisation are disabled.
A first-party attribution cookie may persist for up to 30 days and the analytics choice is stored locally. Strictly necessary authentication/security storage and a Cloudflare challenge cookie may also be used. Mobile apps do not use browser cookies for normal app operation.
Aesthetic Pass accounts are intended for adults aged 18 or the age of legal majority. Contact us if you believe a minor's data was submitted. A treatment provider remains responsible for any lawful minor-treatment context it controls.
We update the version/date when this notice changes. Material changes are communicated in-app, by email, or prominently on the website as appropriate. A new purpose or consent-dependent processing is not made lawful merely by editing this page; a new legal basis or consent is obtained where required.

12. Contact and complaint

drylabs GmbH
Straße der Jugend 18
14974 Ludwigsfelde, Germany
Privacy operations and rights requests: privacy@aestheticpass.com
Data Protection Officer: Dr. Csilla Geleta, Fachärztin für Arbeitsmedizin — csillageleta@aestheticpass.com
General: info@aestheticpass.com

Competent supervisory authority for drylabs GmbH: Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany; Poststelle@LDA.Brandenburg.de; lda.brandenburg.de. You may also complain to the authority at your habitual residence, workplace, or place of the alleged infringement.

Authoritative legal texts: General Data Protection Regulation and § 630f BGB.

For questions about how your data is processed or how to exercise your rights, contact privacy@aestheticpass.com.