Collect less, protect what remains
The safest data is the data we never ask for. Our forms are short on purpose, and every step that remains is protected in transit and at rest.
- We never ask visitors for health details, medical history or photos.
- Every page and every form uses an encrypted connection.
- Clinic accounts are confirmed with a one-time code, not a guessable link.
- Access inside an account follows roles, so each person sees only what their job needs.
How appointment requests are protected
When you request an appointment, we ask for your email address, the dates that suit you and an optional short note. The form reminds you not to share medical information, because a clinic does not need it to reply about availability. You confirm your address with a six-digit code sent by email. Codes expire after a short time, and repeated wrong attempts are limited. Until you confirm, your request is not shared with anyone. After you confirm, it goes only to the clinic you chose. We do not sell requests, and we do not pass them to other clinics.
- Six-digit codes expire and cannot be reused.
- Wrong code attempts are counted and limited.
- A request reaches the clinic only after you confirm your email.
How clinic accounts are protected
A clinic proves ownership before it can edit anything. The code goes to an email address on the clinic's own website domain, or the clinic places a code on its website. This stops strangers from taking over a profile that is not theirs. Once a profile is claimed, changes are made only from inside the confirmed account.
Roles on Group and Enterprise
Group and Enterprise plans support several team members with roles. An owner manages billing and the team, a manager edits locations and reads reports, and the front desk handles incoming requests. When someone leaves, the owner removes their access in one step.
SSO and audit log on Enterprise
Enterprise accounts can sign in through single sign-on with SAML, so your team uses the identity system you already manage. The audit log records who changed what and when across all locations, which helps chains and franchises review edits and answer internal questions.
Encrypted connections everywhere
All traffic between your browser and beautytreatments.com travels over an encrypted connection. Data is stored with a hosting provider in secured facilities, and access to production systems is limited to the people who run the service. Card details for clinic subscriptions are entered on the payment processor's secure page and are never stored on our servers.
How long we keep data, and how to delete it
We keep a request for as long as it is useful to you and the clinic, and unconfirmed requests are cleared after a short period. Clinic account data is kept while the subscription runs and for a limited time afterward for accounting and dispute handling. You can ask us to delete your data at any time by writing to [email protected] from the address you used. We confirm the request and remove the data, except for records we must keep by law. Read the full details in our privacy policy.
Open data, handled responsibly
Business profiles in the directory come from open data, not from private sources. Every unclaimed profile has a button to request a correction or removal, and a removed profile stays removed when the data is refreshed. Learn more about where our directory data comes from.
Report a security issue
If you believe you have found a security issue on beautytreatments.com, write to [email protected] with a short description and the steps to reproduce it. Please do not access other people's data or disrupt the service while testing. We read every report, reply to confirm we received it and fix confirmed issues as a priority. For anything else, see how to contact BeautyTreatments.