Privacy Policy

Effective Date: September 9, 2026 · Last Updated: October 6, 2026

Claustro AI ("Claustro AI," "we," "us," or "our") operates the website claustroai.com and provides managed AI-powered patient communication services to medical aesthetic practices and their patients. This Privacy Policy explains how we collect, use, disclose, and safeguard information, including Protected Health Information ("PHI") under the Health Insurance Portability and Accountability Act ("HIPAA").

By using our website, calling our demo line, submitting a form, or receiving SMS messages from us, you agree to the practices described in this Policy.

1. Information We Collect

1.1 Information You Provide Directly

When you interact with us through our website, phone line, SMS opt-in form, contact form, or during a demo, we may collect:

• Name, business name, and role
• Phone number (including mobile number for SMS communications)
• Email address
• Business address and location
• Information about your practice (services offered, patient management system, team size)
• Any additional information you voluntarily submit in messages to us

1.2 Information Collected Automatically

When you visit our website, we automatically collect certain technical information including IP address, browser type, device information, referring URL, pages viewed, and timestamps. We use cookies and similar technologies for site functionality and analytics.

1.3 Call, Message, and Direct Message Data

When you call our demo line at (951) 418-2579 or exchange SMS messages with our service, we collect and process the audio recording, transcript, phone number, timestamp, and content of communications. Demo line calls are used to demonstrate the AI receptionist experience and are recorded, transcribed, and retained for quality, training, and service improvement.

When a medical aesthetic practice has connected its Instagram business account to our service, we receive and process direct messages sent to that account — including message content, the sender's Instagram-scoped user ID, and timestamps — in order to respond on the practice's behalf. We do not access the practice's followers, posts, comments, or other profile data beyond what is required to identify the connected account.

1.4 Protected Health Information (PHI)

When Claustro AI provides services to a medical aesthetic practice ("Covered Entity") under a Business Associate Agreement ("BAA"), we may receive, create, maintain, or transmit PHI on behalf of that Covered Entity. Our handling of PHI is governed by the BAA and HIPAA. This Privacy Policy does not create additional obligations regarding PHI beyond those set forth in the BAA.

2. How We Use Information

We use the information we collect for the following purposes:

• To respond to your inquiries and provide information about our services
• To send SMS messages you have opted in to receive (see Section 4)
• To operate, maintain, and improve our services
• To communicate with you about your account, service updates, or scheduling changes
• To comply with legal obligations, protect our rights, and enforce our Terms of Service
• For analytics, aggregate reporting, and service performance measurement (in a de-identified format)

3. Legal Bases and HIPAA

Claustro AI is a Business Associate under HIPAA when providing services to Covered Entities that are healthcare providers. We enter into a Business Associate Agreement (BAA) with each customer that qualifies as a Covered Entity. Under the BAA, we implement administrative, physical, and technical safeguards to protect PHI, restrict its use and disclosure to permitted purposes, and report any security incidents or breaches as required.

Where a subcontractor or service provider will handle PHI on our behalf, we execute a Business Associate Agreement with that provider before any PHI is transmitted to it, and require HIPAA-compliant handling of any PHI it receives. The exception is Instagram, which is the practice's own channel and for which Meta offers no BAA (see Section 5.1). Section 5.1 below lists our current sub-processors and the BAA status of each, including the agreements we will complete before any practice goes live with patients.

4. SMS Communications and Consent

Claustro AI sends SMS messages only to individuals who have provided express written consent by opting in through a web form, verbal request during a phone call, or written request. By opting in, you agree to receive SMS messages from Claustro AI about your inquiry, demo details, follow-up communications, and (for customers) appointment confirmations, scheduling changes, and service updates.

Staff of medical aesthetic practices that use Claustro AI may also opt in, individually and for their own mobile number, to receive urgent clinical alerts at claustroai.com/alerts-consent. A practice cannot opt its staff in on their behalf, and opting in is never a condition of using our services.

4.1 Message Frequency and Rates

Message frequency varies based on your interaction with us. Message and data rates may apply depending on your mobile plan. We are not responsible for messaging or data charges from your carrier.

4.2 Opting Out

You can opt out of SMS communications at any time by replying STOP to any message. After you send STOP, you will receive a confirmation message, and we will not send further SMS messages except a final confirmation of opt-out. To resume messages, reply START. For help, reply HELP or contact us at info@claustroai.com.

4.3 Categories of SMS Messages

SMS messages you may receive include:

• Demo and inquiry follow-up: Information about how our demo works, next steps, and follow-up related to your specific inquiry.
• Appointment and account communications (for customers): Confirmations, changes, and reminders related to appointments or account activity for practices using our services.
• Service updates: Occasional messages about material changes to your service or account.
• Clinical alerts (practice staff only): When a patient reports a possible reaction or other urgent concern to a practice's AI receptionist, the staff members that practice has designated, and who have opted in themselves, receive a text so a clinician can follow up promptly. These alerts contain no patient names, symptoms or other health details: they say that a patient reported a possible reaction, by phone or Instagram message, and link to the practice's secure Claustro AI dashboard, where the full report is available to authorized staff. Replies to alerts are not monitored.

5. How We Share Information

We do not sell your personal information. We share information only as described below:

5.1 Service Providers (Sub-Processors)

We share information with third-party service providers that help us operate our services, subject to written agreements that require them to protect the information. Our sub-processors, and the status of Business Associate Agreements (BAAs) with each, are as follows:

• Google Workspace — email, productivity, and internal document storage. BAA executed with Google under Google Workspace's HIPAA Business Associate Amendment.
• Retell AI — voice AI infrastructure for the Claustro AI receptionist. BAA executed under Retell AI's standard Business Associate Agreement.
• Amazon Web Services (Amazon SES) — transactional email delivery. Used to send operational notifications (such as appointment requests, cancellations, call summaries and clinical alerts, which can include what a patient reported) to a practice's staff. Such notifications are disclosures to the practice about its own patients. The AWS Business Associate Addendum is in effect for the AWS account that sends these emails (effective July 14, 2026).
• Twilio — telephony and SMS transport. Claustro AI does not have a Business Associate Agreement with Twilio, so the SMS messages we send are designed to contain no health information. Clinical alerts to practice staff say only that a patient reported a possible reaction and link to the practice's secure dashboard; texts to patients carry only practice information the patient asks for, such as the practice's address. The details a patient reports reach practice staff by email through Amazon SES and in the dashboard, never by SMS. If a customer engagement ever requires health information in a text message, we will execute a BAA with Twilio before any such message is sent.
• Xano — backend database and API orchestration. Today Claustro AI uses Xano under its standard terms, with no Business Associate Agreement, and the data it holds comes from our own demonstration and testing, not from a live practice's patients. Before any practice goes live with patients, we will move to Xano's HIPAA tier and execute Xano's Business Associate Agreement.
• Google Calendar — appointment availability. When a practice connects its Google Calendar, we store an authorization token for that practice's account and read free/busy time ranges only, using the narrowest scope Google offers for this purpose (calendar.freebusy). We do not have access to event titles, descriptions, attendees, locations, or any other calendar content, and no Protected Health Information is received through this integration.
• Healthchecks.io — operational monitoring of scheduled tasks. Receives a timestamped completion signal with no message body. No personal information and no Protected Health Information is transmitted to this service.
• Vercel — website hosting, and a small relay that receives Instagram message notifications from Meta, verifies them, and forwards them to our backend. The content of those messages, which can include health information a patient chooses to share, passes through this relay in transit; our code does not log or store it. Claustro AI does not have a Business Associate Agreement with Vercel today. Before any practice goes live with patients, we will either execute a Business Associate Agreement with Vercel or move this relay to infrastructure covered by one.
• Instagram (Meta Platforms, Inc.) — direct message transport for practices that have connected an Instagram business account. Message content transits Meta's platform when we send or receive Instagram DMs on a practice's behalf, and Meta's platform stores the resulting message thread. Unlike our other sub-processors, Meta is not a vendor Claustro AI selects or contracts with — Instagram is the practice's own channel, connected under the practice's own agreement with Meta. No Business Associate Agreement exists with Meta for this purpose, and none is offered. Patients can and sometimes do include health information in direct messages, so that information transits and is stored by Meta under the patient's and the practice's own relationship with Instagram. Claustro AI's own database does not keep direct-message text: a message is held only while the reply is generated. Our AI processor, Retell AI, which operates under a Business Associate Agreement with us, retains conversation content for up to 90 days. Our assistant does not ask patients for health details over Instagram, and it directs anyone reporting an urgent concern to call 911 or seek urgent care.

Our sub-processor list may change over time. Material changes will be reflected in an updated version of this Policy.

5.2 Legal Compliance and Protection

We may disclose information when required by law, subpoena, or legal process, or when necessary to protect our rights, safety, or the rights and safety of others.

5.3 Business Transfers

If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to standard confidentiality protections and, where applicable, continuing BAA obligations.

5.4 Aggregated and De-Identified Data

We may create and share aggregated, de-identified, or anonymized data derived from the services (such as conversation flow patterns, operational benchmarks, and service performance metrics) that does not identify any individual or Covered Entity. This use is permitted under our Business Associate Agreements and is used to improve our services and publish industry insights.

6. Data Retention

We retain information for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. PHI retention is governed by our BAAs with each Covered Entity. Demo line call recordings and transcripts are retained for a period consistent with our internal operational and compliance policies, typically no longer than 24 months, after which they are deleted or de-identified.

7. Data Security

We implement administrative, physical, and technical safeguards designed to protect information from unauthorized access, use, disclosure, alteration, or destruction. These include encryption in transit and at rest for PHI, access controls, audit logging, and regular security reviews. No system is completely secure; however, we treat security as a foundational discipline and continuously invest in it.

8. Your Rights and Choices

Depending on your location, you may have the right to:

• Access, correct, or delete information we hold about you
• Object to or restrict certain processing
• Withdraw consent (including SMS opt-out via STOP)
• Receive a copy of your information in a portable format
• File a complaint with a data protection authority

For PHI, additional rights are provided by HIPAA and are exercised through the Covered Entity that provided the PHI to us, not through Claustro AI directly.

To exercise any right, contact us at info@claustroai.com.

To request deletion of data associated with you — including data from Instagram messages — see our Data Deletion Instructions, which explain what we delete, what we are required to retain, and how long each step takes.

9. Children's Privacy

Our services are not directed to individuals under 18, and we do not knowingly collect personal information from children. If we learn we have collected information from a child under 18 without parental consent, we will delete it.

10. International Users

Our services are operated from the United States. If you access our services from outside the United States, your information may be transferred to and processed in the United States, which may have different data protection laws than your jurisdiction.

11. California Privacy Rights

California residents have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know, delete, correct, and opt-out of the sale or sharing of personal information. Claustro AI does not sell personal information as defined under California law. To exercise your rights, contact us at info@claustroai.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated "Effective Date" at the top. We encourage you to review this Policy periodically.

13. Contact Us

For questions about this Policy or our privacy practices, contact us at:

Claustro AI
Email: info@claustroai.com
Website: claustroai.com