Last updated: 19/07/2026
This Privacy Policy explains how iGlowly collects, uses, stores, and protects information when visitors interact with the iGlowly Assistant widget embedded on clinic websites.
This policy applies exclusively to the iGlowly Assistant widget and its related data processing. It does not apply to the clinic website on which the assistant is embedded, nor to the iGlowly platform website (iglowly.com), which is covered by a separate privacy policy.
The iGlowly Assistant is an informational software tool designed for general education about aesthetic treatments, procedures, and clinic-related topics.
The iGlowly Assistant is:
The assistant provides general informational content only. It does not provide medical advice, diagnosis, or treatment recommendations. Users must not use the assistant to submit personal, sensitive, or medical information.
Data protection roles depend on the context of the processing.
Where the iGlowly Assistant processes Personal Data on behalf of a clinic customer in connection with the provision of the Service, the clinic acts as the Data Controller and iGlowly acts as the Data Processor. This relationship is governed by iGlowly’s Data Processing Agreement (DPA).
For Personal Data that iGlowly processes for its own business and administrative purposes, including customer account management, billing, support, and business communications, iGlowly acts as the Data Controller.
Anonymous and aggregated analytics that cannot be used to identify an individual do not constitute Personal Data under the GDPR.
iGlowly is currently operated by its founder within:
Jobyourself Coop SC
Chaussée de Charleroi 112
1060 Brussels
Belgium
VAT: BE 0479.233.349
The founder operates as an independent professional within this cooperative structure. Editorial responsibility and operation of the iGlowly Assistant remain under the responsibility of the founder of iGlowly.
The iGlowly Assistant is specifically designed to minimise data collection. We do not store:
Chat messages exist only in volatile memory (RAM) during real-time processing and are never written to disk, database, or log storage.
The assistant stores only anonymous, non-identifying usage statistics. These may include:
This data cannot be used to identify any individual. It is used to provide demand analytics to clinics and to improve the assistant.
If a visitor nevertheless enters personal information into the assistant, the system applies automated detection and redaction before any message reaches the AI processing layer.
Sanitisation operates in two layers:
When personal data is detected, it is replaced with anonymised tokens (e.g., "[name hidden]", "[email hidden]") before the message is sent for AI response generation.
Sanitisation processing takes place in the European Union (Azure Western Europe region).
This architecture is designed to prevent personally identifying information from reaching AI providers and to minimise the handling of identifiable health information.
Some visitor questions are processed by an AI system to generate responses.
For common questions (e.g., "Do you offer Botox?", pricing queries), the assistant uses deterministic response paths that do not involve AI processing.
The iGlowly Assistant does not use:
The assistant operates entirely in browser session memory. When the browser tab is closed, no assistant-related data remains on the visitor's device.
Anonymous usage analytics are hosted on secure servers located in the European Union (Germany), using Supabase infrastructure on AWS EU.
Personal data sanitisation is processed in the European Union (Azure Western Europe).
Security measures include:
iGlowly uses the following subprocessors for the assistant:
Supabase (AWS) Purpose: Database hosting, anonymous analytics storage Location: EU (Germany)
Microsoft Azure Purpose: Personal data detection and sanitisation (PII redaction) Location: EU (Western Europe)
OpenAI Purpose: AI response generation Location: United States
Vercel Purpose: Frontend delivery, widget code hosting Location: Global CDN
These providers process information under contractual confidentiality and security obligations.
The current subprocessor list is available at iglowly.com/assistant/trust/processors.
Clinics that embed the iGlowly Assistant receive anonymous demand analytics through a dashboard. This includes aggregated data such as:
Clinics do not receive chat transcripts, visitor identities, or any personally identifying information. They see aggregated signals, not individual conversations.
Anonymous usage data is hosted in the European Union (Germany).
AI response generation is processed by OpenAI, which may process sanitised, non-identifying message content in the United States. Messages are sanitised before transmission to remove personal identifiers (see Section 6).
Where data is transferred internationally, iGlowly relies on appropriate legal safeguards, including contractual protections and, where applicable, Standard Contractual Clauses or other lawful transfer mechanisms.
Where the iGlowly Assistant processes Personal Data on behalf of a clinic customer, the clinic acts as the Data Controller and determines the applicable legal basis for the processing. iGlowly acts as the Data Processor and processes such data only on the clinic’s documented instructions, in accordance with the DPA.
Where iGlowly processes Personal Data as a Data Controller for its own purposes, the applicable legal bases may include:
Anonymous and aggregated analytics that cannot be used to identify an individual do not constitute Personal Data under the GDPR and therefore do not require a legal basis under the GDPR.
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) may provide you with certain rights regarding personal information.
The iGlowly Assistant is designed according to data minimization and privacy-by-design principles. The system does not store personal data, does not use tracking cookies, and does not sell or share personal information.
Because the iGlowly Assistant does not store personal data or user identifiers, iGlowly generally does not hold personal information that can be linked to an identifiable consumer through the Assistant.
Nevertheless, under the CCPA/CPRA, California residents may have the right to:
iGlowly does not sell personal information and does not share personal information for cross-context behavioral advertising.
Requests related to privacy or personal data can be submitted to: privacy@iglowly.com
Because the iGlowly Assistant does not store personal data or conversation transcripts, iGlowly may not be able to identify or link requests to specific individuals using the Assistant.
The iGlowly Assistant operates under a Zero-PHI (Protected Health Information) architecture designed to avoid the intentional collection, storage, and retention of identifiable health information.
The system minimises PHI exposure through:
If a visitor voluntarily enters personal or medical information, that information may be processed transiently for the purpose of detecting and removing personal identifiers before any downstream AI processing. Full conversations are not retained, and only anonymous, aggregated analytics are stored.
iGlowly’s Zero-PHI architecture is designed to minimise the processing and retention of identifiable health information as far as possible. Whether a Business Associate Agreement (BAA) is required depends on the clinic’s status, the applicable legal relationship, and the specific data flow. iGlowly can provide a Zero-PHI Statement and, where appropriate, a BAA for review and execution.
For further information, see iglowly.com/assistant/trust/zero-phi.
When data is no longer needed, iGlowly deletes, anonymises, or securely restricts it as appropriate.
Under applicable data protection law, you may have the right to:
Because the assistant is designed not to retain personal messages or identifiable content, iGlowly may be unable to link anonymous analytics back to a specific individual.
The iGlowly Assistant is not directed to children and is not intended for use by persons under 16. iGlowly does not knowingly collect personal data from children.
iGlowly may update this Privacy Policy to reflect legal, technical, or business changes. The updated version will be posted with a revised "Last updated" date.
For privacy-related questions or requests:
trust@iglowly.com
Postal contact:
Jobyourself Coop SC
Chaussée de Charleroi 112
1060 Brussels Belgium
