Privacy Policy

Last updated 20 August 2026

1. Scope, and the two roles we play

This policy covers two different things, and the difference matters, so it is worth stating up front.

• This website (essencecrm.ai). Here we decide what is collected, and the answer is: almost nothing. Section 3 sets out exactly what.
• The Essence software, which clinics use to run their practice. Here the clinic decides what information goes in and what is done with it. We hold and process that information on the clinic's behalf and on its instructions, as its service provider. In data-protection language, the clinic is the controller and Essence is the processor.

So if you are a client of a clinic that uses Essence and you want your record changed or deleted, the clinic is the right place to ask. See section 11.

2. Who we are

Essence is practice-management software for medical spas and aesthetics clinics, owned and operated by EnviroVentPro INC, a Delaware corporation operating from Florida. For the purposes of this policy, "Essence", "we" and "us" mean EnviroVentPro INC. You can reach us at any time at info@essencecrm.ai, and that address is monitored by a person.

3. This website

This website is a set of static pages. It sets no cookies. It contains no analytics, advertising pixels, session recording, chat widget or social media embeds, and it loads no fonts, scripts or images from any third party. Nothing you do here is tracked, profiled or shared, because there is nothing doing the tracking.

Our hosting provider keeps short-lived server logs, which are standard for any website and typically record the requesting IP address, the page requested, the time, and the browser's user-agent string. These are used to keep the site available and to investigate abuse, and nothing else.

If you email us, we receive whatever you put in the email, and we keep the correspondence so we can answer you and follow up.

4. What the Essence service collects

When a clinic uses Essence, the following categories of information are held in the service.

Clinic and staff account information

The clinic's business details, and for each staff member a name, work email address, role and permissions, and an access code used to unlock a shared station. Access codes are stored in hashed form, never in plain text.

Information the clinic enters about its own clients

Contact details, appointment history, treatments received, consultation and treatment notes, consent and intake forms, photographs where the clinic uses that feature, purchases, memberships, loyalty balances and outstanding payments. The clinic decides what to record here. Some of it is health-related, and section 7 deals with that.

Payment and billing information

For the clinic's own subscription, and for card payments a clinic takes from its clients through Essence, payment details are collected and processed by Stripe. Card numbers and security codes are entered directly into Stripe's payment form and never reach Essence's servers. What we hold is the result: an amount, a currency, a timestamp, a status, the last four digits and card brand as returned by Stripe, and Stripe's own reference for the transaction.

Messages

Where a clinic connects its email, SMS or messaging channels, the content and metadata of messages sent and received through those channels pass through and are stored in the service so the clinic has a record of its own conversations.

Technical and usage records

Sign-in events, IP addresses, timestamps and a record of sensitive actions taken in the software. These exist so a clinic can see who did what, and so we can detect and investigate unauthorised access.

5. How we use it

We use information only to run the service and the business behind it:

• to provide the software and the features a clinic has switched on;
• to authenticate users and enforce what each role is allowed to do;
• to take payment for subscriptions and to process payments a clinic takes through the software;
• to provide support, and to investigate problems a clinic reports;
• to keep the service secure, detect abuse and prevent fraud;
• to meet legal obligations and to enforce our agreements.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not use clinic or client information to target advertising, and we do not use it to train machine-learning models offered to anyone else.

6. Who we share it with

We share information with a small number of service providers who are needed to run the service, each bound to use it only for that purpose:

• Amazon Web Services. Hosting, storage and backups, in data centres in the United States.
• Stripe. Payment processing for subscriptions and for card payments clinics take through Essence.
• Twilio. Telephony and SMS, where a clinic uses those features.
• Our transactional email provider. Sending email the service generates, such as notifications and password resets.

We may also disclose information if we are legally required to, if it is necessary to protect the rights or safety of people or of our service, or in connection with a merger or sale of the business, in which case this policy continues to apply to the information transferred.

7. Health-related information

Clinics using Essence record information about treatments, which in many cases is information about a person's health. We treat it accordingly. We process it only on the clinic's instructions in order to provide the service, we do not use it for our own purposes, we do not sell it, and we do not use it for advertising or profiling. Access to it inside our systems is restricted to what is necessary to operate and support the service, and such access is logged.

The clinic remains responsible for the lawful collection and use of its clients' health information, including obtaining any consent required where it operates. Where a clinic is subject to a specific regulatory regime and requires a written agreement with us covering that, contact info@essencecrm.ai.

8. How we protect it

• All traffic to the service is encrypted in transit using HTTPS, and stored data is encrypted at rest.
• Each clinic's records are separated from every other clinic's by rules enforced in the database itself, applied on every read and every write, rather than by the application remembering to filter. The same separation applies between one clinic's clients and another's.
• Staff sign in individually rather than sharing a login, and what each person can see and change is determined by their role.
• Databases are not reachable from the public internet. Administrative access is restricted, credentials are held in a managed secret store, and access is recorded.
• Card numbers and security codes are never received or stored by us; that data goes directly to Stripe.

No system can promise perfect security, and we do not. If a breach affecting personal information occurs, we will notify affected clinics without undue delay and provide what they need to meet their own notification obligations.

9. How long we keep it

While a clinic's subscription is active, its information is kept so the clinic can use it. After a subscription ends, the clinic may export its data, and we then delete or irreversibly anonymise it within 90 days, except where we must keep something longer to meet a legal, tax or accounting obligation, or to resolve a dispute. Backups are retained on a rolling schedule and are overwritten in the ordinary course.

10. Your rights and choices

Depending on where you live, you may have the right to ask for a copy of the personal information held about you, to have it corrected or deleted, to object to or restrict certain processing, to receive it in a portable format, and not to be discriminated against for exercising any of these rights.

Residents of California: we do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are used in the CCPA as amended.

To exercise a right in respect of information we hold about you as our own customer or website visitor, email info@essencecrm.ai. We will verify who you are before acting, and will respond within the time the applicable law allows.

11. If your clinic uses Essence

If you are a client of a medical spa or clinic that uses Essence, your record belongs to that clinic. We hold it for them and cannot change or delete it on your say-so, any more than a filing cabinet supplier could. Please contact your clinic directly. If you contact us instead, we will pass the request on to the clinic and tell you we have done so.

12. Children

Essence is business software and is not directed to children. We do not knowingly collect personal information directly from children. A clinic may hold records for a client who is a minor, in which case the clinic is responsible for any consent required.

13. Where information is processed

Essence is hosted in the United States and information is processed there. If you access the service from outside the United States, you understand that the information will be transferred to and processed in the United States, where data protection law differs from that of your own country.

14. Changes to this policy

We may update this policy. When we do, we will change the date at the top, and if the change is significant we will tell subscribing clinics by email before it takes effect. Continuing to use the service after a change takes effect means the updated policy applies.

15. How to contact us

Questions, requests and complaints about privacy all go to the same place: info@essencecrm.ai. We aim to reply within one business day.