Your data stays with you and your clinic.

Ovea Club is an app made by AutoAppoint that med spas and wellness clinics use for memberships, rewards, offers, bookings and refill reminders. This policy covers the Ovea Club app, the website joinovea.club and the clinic admin.

The short version

We never sell your data and we don't run ads.
Your clinic sees what you do with that clinic. Other clinics don't.
Marketing messages and product analytics are off until you turn them on, and you can turn them off any time in Profile.
You can delete your account in the app. It removes your profile, points and clinic links.

Who is responsible

For information about your care, your clinic is in charge. When a clinic is a covered entity under HIPAA, we work for it as a business associate under a Business Associate Agreement, and we only use that information to run the service for the clinic. For your Ovea Club account itself (email, sign-in, app settings), AutoAppoint is responsible.

What we collect

Account: email address, and your name and phone number if you add them.
Clinic activity: which clinics you joined and how (tag, QR code, code or link), your membership plan and status, points, rewards you redeem, visits you request or book, and offers you claim.
Payments: handled by Stripe for your clinic. We see the status of a payment and the last four digits of the card. We never see or store full card numbers.
Calls and texts: if your clinic uses the refill agent, the content of those calls and texts and the notes passed to your provider.
Device: the type of phone and app version, and security logs of sign-ins and changes (time, IP address).
Analytics, only if you allow it: which screens you open, so we can make the app better. It is never tied to health information and never shared with advertisers.

We don't use advertising IDs and don't track you across other apps or websites.

How we use it

To run the app: show your clinic's menu, prices, your plan and points, take booking requests, and send sign-in codes.
To let your clinic serve you: confirm visits, add points, process memberships and reach you about refills and appointments.
To keep accounts secure and to meet legal duties, including HIPAA audit logs.
To send offers and news, only if you opted in, from the clinic you joined.

Who we share it with

Your clinic. Only the clinic you joined sees your activity with it.
Service providers that host and run the service for us under contract, and under a Business Associate Agreement wherever they store or send health information: cloud hosting and database (Amazon Web Services), and email and text delivery. Payments go through Stripe for your clinic; Stripe gets what a payment needs, not your treatment details.
The law. When a valid legal process requires it, and we tell you when we are allowed to.

We don't sell or rent personal information, and we don't share it for cross-context behavioral advertising.

Texts and calls

If you give your clinic your phone number and agree to reminders, the clinic's assistant may call or text you about refills, visits and your membership, including with automated technology. Agreeing is never a condition of buying anything. Message frequency varies and message and data rates may apply. Reply STOP to stop texts or HELP for help.

How long we keep it

We keep your account while it is active. When you delete it, we remove your profile, points and clinic links right away. Security and audit logs are kept for six years because HIPAA requires it. Backups roll off within 35 days. Your clinic may keep its own records of your visits under its own policies.

Your choices and rights

See, correct or delete your information: in Profile, or write to us.
Turn marketing and analytics on or off: Profile, then Privacy.
Leave a clinic: hold that clinic in Profile.
Residents of California, Washington, Nevada, Colorado, Connecticut, Virginia and other states with privacy laws can ask to know, correct, delete or get a copy of their data, and can appeal a refusal. Washington's My Health My Data Act and Nevada's health data law also give you the right to withdraw consent for consumer health data. We don't discriminate against anyone for using these rights.
For health information your clinic keeps, ask your clinic. It has its own Notice of Privacy Practices.

Security

Data is encrypted in transit and at rest. Your email and name are additionally encrypted in our database with keys that are stored apart from it. Access is limited to the people who need it and every access to patient lists is logged. More on the HIPAA and security page. If a breach affects your information, we and your clinic will notify you as the law requires.

Children

Ovea Club is for adults 18 and over. We don't knowingly collect information from children.

Changes

If we change this policy in a way that matters, we'll show it in the app and ask you to accept it before you continue.

Last updated November 3, 2026. Questions: privacy@joinovea.club