Privacy

FacePlan is operated by Face Plan Ltd (company number 17469510, registered in England and Wales). It is a platform that clinics use to share skincare and treatment plans with their patients. Your clinic is the data controller for your information; we act as its data processor under UK GDPR.

What we hold

For practitioners: name, email, password hash, clinic name and billing status (card details are held by Stripe, never by us). For patients: name, contact details, the plan your practitioner wrote for you, your responses to it ("I'd like to buy this", "Already have this"), and messages you exchange with your practitioner.

How it is protected

Contact details and messages are encrypted at rest with AES-256-GCM. All traffic is over HTTPS. Practitioners can only see patients in their own clinic. Every change to a plan is recorded with who made it and when. Plan links are personal, expire after 30 days, and can be re-issued only to the email your clinic holds for you.

Dictation

When a practitioner dictates a plan, the audio is sent to a speech-to-text provider for transcription only and is not stored by us. The transcript stays in the practitioner's browser until they choose to structure it; only the resulting plan is saved.

Your rights

You can ask your clinic to correct or delete your information at any time. For anything about this platform itself, contact hello@faceplan.co.uk.

Who we are