GDPR-compliant AI chatbots for clinic websites: 14 products compared

Source-based comparative review · Last checked 1–2 August 2026

We compared 14 website AI chatbots promoted to aesthetic clinics or usable on clinic websites. The review separates marketing claims from public documentation and records what happened in manual browser tests: whether the widget loaded after optional cookies were rejected, what appeared in cookies or localStorage, whether conversations are retained, and what happens when a visitor asks a health-related question.

Short answer: no AI chatbot is GDPR compliant in isolation. A clinic must assess what the deployed widget collects, where conversations go, how long they remain, which subprocessors receive them, what visitors are told, and whether the clinic can execute the required contract and deletion workflow. In this comparison, public documentation and real deployment behaviour varied sharply—even among tools that describe themselves as GDPR compliant.

Primary topic: GDPR-compliant AI chatbot for an aesthetic clinic website · Also covers aesthetic-clinic chatbots, cookie consent, conversation retention, DPAs, subprocessors, HIPAA/BAA and health-answer boundaries.

What the comparison found

  • “GDPR compliant” is not a complete answer.
    Public DPAs, named subprocessors, retention rules and security documentation give buyers something concrete to verify.
  • Conversation retention ranged from none claimed to indefinite.
    Several products store transcripts by default; some provide deletion or retention controls only on particular plans.
  • Rejecting optional cookies often did not stop the chat.
    That may be intentional when widget storage is classified as necessary, but it does not tell the visitor whether the server retains the conversation.
  • Browser storage and server storage are different.
    A cookie-free widget may still save conversations server-side. A localStorage key may be functional rather than advertising tracking.
  • Medical safety and privacy are separate tests.
    A bot can give a cautious answer while retaining sensitive text, or have strong legal paperwork without clinic-specific clinical boundaries.
  • EU hosting helps, but does not settle GDPR.
    Legal basis, transparency, processors, access, transfers, purpose limitation and retention still matter.

Personal data concerning health is a special category of personal data under GDPR Article 9. The GDPR also requires data minimisation and storage limitation under Article 5, while Article 28 requires controllers to use processors that provide sufficient guarantees and to govern processing by contract. For the underlying legal concepts, see our separate guide to how GDPR applies to an aesthetic-clinic AI chatbot.

Core comparison: 14 AI chatbots / assistants for clinic websites

This is intentionally a wide table. Scroll horizontally on mobile. “Evidence points” count how many of seven documentation fields were found: retention, browser storage, hosting/processing, customer DPA, public subprocessors, security documentation and independent assurance. It is not a GDPR, security, medical-safety or trust score.

Table 1. Full comparison of AI chatbots for clinics, checked 1–2 August 2026
ProductPositioningPublic deploymentKnowledge / medical contentPublished medical boundariesConversation storageRetentionBrowser storageHosting / processingCustomer DPAPublic subprocessorsSecurity documentationIndependent assuranceHIPAA / BAADocumentation pointsMain clinic caution
iGlowlyAesthetic specialistPublic live demo tested manually130+ validated PubMed/PMC guides, supplemented by clinic-selected services; structured aesthetic libraryPublished: no diagnosis; explains limitations, side effects and contraindicationsVendor states that raw conversations are not storedNo conversations retained, according to the vendorNo cookies or localStorage observed before or after the chat in the public demoPublic trust, DPA and subprocessor documentsYesYesYesNo independent report currentlyBAA on request; Zero-PHI design6/7First-party data. The browser test verifies client-side storage only; separately validate the absence of server-side retention, the live deployment and the trust documents.
BotmedicaAesthetic specialistVendor-site assistant tested.Vendor treatment database plus clinic informationPre/post-treatment information; exact clinical guardrails not documentedChat-assistant data covered by the privacy policy“As long as necessary”No public source foundInternational transfers may occurNo customer DPA foundNo named list foundNo dedicated page foundNo public report foundNo public offer found1/7A DPA between a vendor and its own subprocessors is not evidence of a DPA between the clinic and the vendor.
FlashAI.plAesthetic specialistVendor demo tested manually and identified customer deploymentClinic website and price list; no built-in medical library statedNo diagnosis or recommendation; directs to a consultationConversations, technical data and lead information collected; full transcript observed in the browserConfigurable by customer; maximum 24 monthsflash_session_id identifier and full transcript in flashai_chat_history observed in localStorage; two widget cookies documented but not observed in the demoMain servers in the EU; processing by AI providers in the EU, United States or Asia under Standard Contractual ClausesNo customer DPA foundNo named list foundPrivacy and security measures describedNo public report foundThe bot mentioned a possible Enterprise option with a BAA, but no HIPAA offering or public BAA was verified4/7The demo worked without a banner or visible prior notice and stored the full transcript in localStorage. The exact AI providers are not named, and HIPAA statements generated by the bot are not contractual evidence.
OmyboxAesthetic-clinic-specific landing pageGenerator/trial shown; public chat test not completedWebsite, PDF, Excel and catalogues; no built-in medical library statedRedirects requests for personalised medical advice to a professionalVisitor questions and answers stored12 rolling months by default; configurableAnonymous project session identifier in localStorage for 365 days; vendor states that it does not use cookiesEU hosting statedPublic DPACategories public; names on requestMeasures describedNo product-level report foundNo public offer found5/7Persistent localStorage is not the same as no browser storage; conversations are retained for 12 months by default.
HyperleapGeneral platform with a medspa pageNo live Hyperleap deployment verified; the page demo is scriptedWebsites, documents and connected RAG sources; no built-in medical library statedVendor claims handoff to the practitioner for contraindication, prescription and complex casesEncrypted customer data and chat logsDPA defines deletion/return obligationsA cookie policy exists; no deployment available to testAzure India by default; transfers to the United States, Canada and the EU; custom/BYOC optionsYesNamedYesNo public SOC 2/ISO report foundBAA mentioned in vendor blog; offering/eligibility not verified5/7The medspa “demo” is scripted. The chat on the vendor's site used Intercom, so the Hyperleap deployment was not tested.
AstuciaManaged chatbot serviceAstucia-branded beauty retail deployment tested; it was not a clinicServices, prices, policies and FAQs; no built-in medical library statedNo detailed clinical boundary foundChat messages may be captured in logsAs necessary / customer agreementLeadConnector session/history identifiers and page-visit fingerprint observedUnited States and other countriesNo customer DPA foundNo public list foundNo dedicated page foundNo public report foundNo public offer found3/7The tested deployment accepted a message without a consent banner or visible privacy information before the chat.
Tidio / LyroEstablished general support platformVendor homepage bot testedURLs, Q&A, documents and integrations; no medical libraryNo medical framingServer-side dashboard storage; full transcript also observed in localStorageTotal retention not stated; “solved” does not mean deletedDocumented and observed after optional-cookie rejectionEEA storage; some billing/support transfersAvailable from supportTrust/DPA materials; exact list not reviewedYesSOC 2 examination statedNo documented BAA; no formal HIPAA documentation5/7Messages are stored and storage cannot be disabled. Do not allow PHI without a signed BAA and verified controls.
CrispEstablished general support platformVendor chatbox testedConnected knowledge base/content; no medical libraryNo medical framingSessions and messages stored server-sideNo automatic deletion; manual/API. IP address retained indefinitely after the chat startsSession cookie/localStorage documented and observedMessaging data in the Netherlands; plugin data in Germany; relay logs elsewhereAvailable in the accountProvider list in the DPAYesCrisp states that it has not undergone a SOC 2 auditNo official offer found6/7The chat worked after optional-cookie rejection. No zero-conversation-storage mode was found.
Intercom FinEnterprise support platformMessenger/product demoCustomer support content; no medical libraryNo medical framingConversation/contact records storedPolicy and workspace controls; exact default not capturedNamed cookies/localStorage with durationsUnited States by default; eligible new Advanced/Expert customers can choose the EU/AustraliaOn requestTrust/DPA materialsYesReports/attestations via the trust centre or under NDAExpert plan only, with a signed BAA6/7Regional hosting and HIPAA conditions depend on the plan and configuration.
ChatbaseGeneral AI-agent builderEmbeddable agent/demoWebsites, documents and Q&A via RAG; no medical libraryNo medical framingService data stored; HIPAA ZDR is separateDuration of the relationship plus a post-relationship period; deletion availableIn one tested deployment, the widget remained locked until all cookie categories were acceptedAWS in the United States; Standard Contractual Clauses for the EU/UKYesYesYesSOC 2 Type II statedEnterprise plan with BAA and automatic ZDR6/7General terms restrict sensitive data; the Enterprise HIPAA configuration is a separate workflow.
CustomGPTGeneral RAG chatbot builderVendor chatbot testedCustomer websites/documents; no medical libraryNo medical framingConversations retained server-side unless removed under the policy12 months by default; Premium/Custom options allow a custom duration, 12 months or no retentionOptional seven-day browser history documented; no item added during the vendor testAWS US East; US subprocessors listedConflicting statements between Enterprise-only availability and an automatic DPA in 2026Listed in the DPAYesSOC 2 Type II statedNo official offer found6/7The absence of a chat cookie/localStorage item during the test did not mean there was no server-side retention. The DPA excludes sensitive or special-category data.
ChatLabGeneral RAG/AI-agent builderVendor chatbot testedWebsites, files, FAQs and integrations; no medical libraryDPA and privacy terms prohibit medical records and Article 9 dataChat history, logs, summaries and optional client profiles stored30 days by default; configurable from 30 to 180 daysraBot session/client localStorage observed after optional-cookie rejectionPrimarily in the EEA; some AWS/AI processing may take place outside the EEA under Standard Contractual ClausesPublic DPAPublic named listTechnical measures in the DPANo public SOC 2/ISO report foundNo offer found; terms prohibit health/Article 9 data5/7The standard embed loads without a consent gate unless configured by the customer. Accidental disclosure of PHI remains a foreseeable risk.
tawk.to AI AssistEstablished live-chat platform; newer AI layerAI Assist in the vendor's help centre tested manuallyCustomer help content, websites, documents, FAQs and other configurable sources; no medical libraryNo medical framingChats and tickets stored server-side; AI Assist does not use previous conversations as a knowledge or training sourceRetained indefinitely until deletion; some backups may remain for up to 90 daysWithout a banner: TawkConnectionTime, twk_idm_key and twk_uuid_* cookies, plus twk_* and twk_token_* in localStorageProcessing in the United States; listed subprocessors in the United States and IrelandYesYesYesNo public SOC 2/ISO report foundNo BAA or official HIPAA offering found6/7No mode without message retention is offered. The tested deployment loaded the chat and its identifiers without a banner or visible prior notice; not learning from conversations does not mean that conversations are not stored.
Elfsight AI ChatbotGeneral no-code widgetVendor demo and real clinic deployment testedCustomer pages, files, text and Q&A; no medical libraryPrompt-configured rules; no enforced medical boundary foundComplete chat histories and optional transcript emailsIndefinite; no automatic deletionOne 15-second visitor cookie documented; no Elfsight storage observed during the manual captureAI transcript location/processing chain not clearly disclosedNo public customer DPA foundNo named list foundGeneral measures; no dedicated AI trust pageNo public SOC 2/ISO report foundNo offer found2/7Cautious urgent response, but continued collection of health details despite indefinite retention; clinic knowledge was incomplete.

How to read “not found”: it means we did not locate the item in the official pages checked by the stated date. It does not prove that the vendor lacks an internal document or will never provide one during sales. Ask the vendor directly and preserve the written answer.

Cookie consent and browser-storage results

A cookie banner answers only one narrow question: which browser technologies the tested page allows after a choice. It does not prove whether the text of a chat is retained on a server. Conversely, a functional localStorage session ID is not automatically advertising tracking. Clinics need to document both layers.

Table 2. Manual deployment tests and precise vendor documentation
Product / deployment Banner First message before privacy information? Chat after optional elements were rejected? Chat-related browser storage Interpretation
iGlowly public demo No banner; no cookies or localStorage detected Yes; chat available immediately Not applicable; no optional-cookie rejection flow No items observed before or after the chat In a private browsing session, cookies and localStorage were empty before the conversation and remained empty after messages were exchanged. This client-side test does not independently prove the absence of server-side retention.
Botmedica vendor site No banner Yes N/A @BotcopyStore and botcopyFingerprint; full transcript and session data observed in localStorage Terms, the privacy policy and consent to process health data appeared only after the first interaction. Google Analytics cookies came from the site and were excluded.
FlashAI.pl vendor demo No banner Yes; chat available immediately, with no visible prior privacy information N/A; no cookie choice offered flash_session_id identifier and full transcript in flashai_chat_history in localStorage The full transcript, including the PII/PHI-related question and the bot's response, was stored in the browser. The PHPSESSID, lang, user_currency and js_challenge cookies came from the site and were not attributed to the chat. The two widget cookies described in the vendor's policy were not observed in this demo. This test does not determine server-side retention.
Omybox documentation According to the vendor, no banner is necessary because analytics are cookieless and widget storage is essential Not manually tested N/A localStorage identifier omybox:embed-sid:*, 365 days; no widget cookies documented “No cookies” does not mean no persistent browser storage.
Hyperleap No public Hyperleap-powered deployment available The vendor page displayed a scripted dialogue; the live chat on its site used Intercom. No test result was attributed to Hyperleap.
Real Astucia beauty deployment No banner Yes N/A LeadConnector request, session and history identifiers, plus page-visit attribution and a fingerprint in localStorage No transcript text was visible in localStorage. Analytics and Wix storage from the host site were not attributed to the chat.
Tidio / Lyro vendor site Yes; optional categories rejected No; the banner appeared first, but the chat-retention disclosure was not verified Yes Full transcript in tidio_state_* localStorage, with widget cache and timestamp Functional chat storage remained after rejection. Server-side dashboard storage is separate and documented.
Crisp vendor site Yes; optional categories rejected Yes Yes Session cookie and visit state before the choice; ticket/session state after the chat started Crisp separates the continuity required for the chat from rejected optional categories. No transcript text was observed in localStorage, but messages are stored server-side.
Intercom Fin documentation Deployment-controlled Deployment-controlled No, if consent is required as documented Visitor, session and device identifiers documented when Messenger loads Intercom documents a configuration in which consent precedes loading; the clinic must implement it. This behaviour is not universal.
Tested Chatbase deployment Yes No; widget locked No; all categories had to be accepted Exact keys not captured In the tested deployment, the site had configured the widget to remain locked until all cookie categories were accepted. This is specific to the deployment or its CMP, not an automatic or universal Chatbase behaviour.
CustomGPT vendor site Yes; optional consent remained no/unset Yes Explicit “Reject” click not recorded No cookie or localStorage change attributable to the chatbot observed This says nothing about server-side storage; according to the official documentation, new agents retain conversations for 12 months by default.
ChatLab vendor site Yes; optional categories rejected Yes Yes raBotChatOpened, client identifier and session identifier in localStorage The standard embed loads immediately unless the customer configures consent in the widget or blocking by its CMP.
tawk.to / AI Assist help centre No banner Yes; chat available immediately, with no visible prior privacy information Not applicable; no cookie choice offered TawkConnectionTime, twk_idm_key and twk_uuid_* in cookies; twk_* and twk_token_* in localStorage The widget and its session identifiers loaded before any interaction, without a banner. No transcript was observed in localStorage. The help centre's Google Analytics cookies and tkbuid were not attributed to AI Assist. Chats nevertheless remain stored server-side until they are deleted.
Elfsight vendor demo Yes; optional cookies rejected The test began after the choice Yes No Elfsight-specific item observed; the documentation mentions a 15-second elfsight_viewed_recently cookie Observed Google items were excluded. Server-side histories represent a separate issue of indefinite retention.

Why can a chat work after “Reject all”?

“Reject all” commonly means reject all optional categories. A vendor or clinic may classify a session identifier as strictly necessary for the chat service the visitor requested. That can be defensible, depending on the implementation and local law, but the classification does not authorise unlimited transcript retention or excuse missing privacy information. The deployment still needs a legal basis, transparent notice, data minimisation, suitable retention and an operational deletion process.

For strict markets such as Belgium, test the actual clinic deployment—not only the vendor website. Record the page before consent, after rejection and after the first message. Separate host-site analytics from widget storage by domain, key name and network request.

Product-by-product clinic notes

The table is the fastest comparison. These short notes preserve the context that is easily lost inside a yes/no cell.

iGlowly

Documented strength
Clinic-specific medical-content boundary, public trust material, DPA and subprocessor information, plus a design that the vendor says does not retain raw conversations or use browser storage.
Clinic limitation
No independent assurance report currently. The product and this article have the same publisher, so purchasers should verify every first-party statement directly.

Official sources: product page · trust centre

Botmedica

Documented strength
Aesthetic-specific positioning and a privacy policy that covers chatbot data.
Observed deployment
The vendor-site assistant was tested; no named customer deployment was verified. The chat could start without a cookie banner. It then requested agreement to the terms and privacy policy and consent for processing health information. In one run, the legal links were placeholders; another run used valid Botmedica policy links. Full transcript and session data appeared in localStorage.
Clinic limitation
No public clinic-customer DPA, named subprocessor list, dedicated security page or independent report was found. A processor agreement between Botmedica and its own vendors is not the clinic's Article 28 contract.

Official sources: aesthetic AI assistant · B2B privacy policy

FlashAI.pl

Documented strength
Aesthetic-medicine focus, an explicit no-diagnosis/no-recommendation boundary, described retention controls and two documented widget cookies.
Clinic limitation
Main servers are described as EU-based, but external AI processing can span the EU, US or Asia. No clinic-customer DPA or named subprocessor list was found in the pages checked.
Name warning
This Polish clinic product is not Flash.co, the consumer skincare-shopping assistant. Search results can mix them; the Flash.co cookie test was excluded from the core comparison.

Official sources: aesthetic medicine · privacy policy

Omybox

Documented strength
Public DPA, EU hosting statement, precise storage documentation and a published redirect for personalised medical advice.
Storage reality
Visitor questions and answers are retained for 12 rolling months by default. The embedded widget uses a persistent anonymous localStorage session ID for 365 days rather than cookies.
Clinic limitation
Processor categories are public, but the named list is supplied on request. The clinic must distinguish “cookieless” from “no browser identifier” in its notice.

Official sources: privacy · cookies and storage · DPA

Hyperleap

Documented strength
Public DPA, named providers, security material and medical handoff claims on the medspa page.
Verification gap
No live Hyperleap widget or named customer deployment was verified. The apparent medspa “demo” was scripted page copy, while the chat on Hyperleap's own site was Intercom.
Clinic limitation
Primary hosting is Azure India by default, with other processing/transfers described across several regions. A BAA is mentioned in a blog, but eligibility and paperwork were not verified.

Official sources: medspa page · security · DPA · subprocessors

Astucia

Observed runtime
A real Astucia-branded retail beauty deployment used LeadConnector/HighLevel. It loaded and accepted a message without a GDPR banner or visible pre-chat privacy notice.
Browser storage
LocalStorage recorded session/history identifiers, the visited page, timestamp, attribution and a fingerprint. No transcript text was visible there.
Clinic limitation
The tested deployment was a beauty-retail site, not a clinic, so it shows runtime privacy behaviour but not safe handling of medical questions. No public clinic-customer DPA or subprocessor list was found.

Official sources: medspa article · privacy policy

Tidio / Lyro

Documented strength
An established platform with EEA storage statements, DPA availability, security documentation and a stated SOC 2 examination.
Storage reality
Conversations are stored in the Tidio application/dashboard. After optional-cookie rejection on Tidio's own site, the full tested transcript was also present in localStorage. Moving a chat to “Solved” does not delete it, and no no-storage mode was found.
Clinic limitation
Tidio does not document a BAA offer and says formal HIPAA documentation is unavailable. The bot's assertion that Tidio follows HIPAA “in practice” is not an adequate substitute, and one generated answer about encryption contradicted official documentation.

Official sources: security · privacy and GDPR · conversation dashboard · chat history

Crisp

Documented strength
Detailed GDPR material, customer DPA, named providers and EU messaging/plugin storage. Crisp's documentation is unusually clear about cookies and deletion.
Storage reality
Conversations are stored server-side and are not deleted automatically; deletion is manual or API-based. Crisp says an IP address may be kept indefinitely after chat begins. On its own site, session state existed before the consent choice and chat still worked after optional categories were rejected.
Clinic limitation
Total Privacy Mode can strengthen a deployment, but no zero-conversation-storage mode was found. Crisp states it has not undergone a SOC 2 audit, and no official BAA offer was found.

Official sources: GDPR status · cookie policy · conversation deletion

Intercom Fin

Documented strength
Enterprise documentation, customer DPA, subprocessors, security material and independent reports/attestations. Intercom also documents how to keep Messenger disabled until consent.
Clinic options
Eligible new Advanced/Expert customers may select EU or Australian hosting rather than the US default. HIPAA support requires the Expert plan and a signed BAA.
Clinic limitation
Those controls are plan- and configuration-dependent. A clinic should not assume that a generic Intercom deployment has EU hosting, a BAA or consent gating.

Official sources: GDPR · Messenger cookies

Chatbase

Documented strength
Public DPA, subprocessors, security material and stated SOC 2 Type II. Enterprise HIPAA setup includes a BAA and automatic Zero Data Retention.
Observed deployment
On the deployment tested, the widget remained locked until all cookie categories were accepted. This is strong consent gating for that installation, not a universal product guarantee.
Clinic limitation
General terms restrict sensitive/special-category data, whereas Enterprise HIPAA adds a separate control set. A clinic must contract for the correct workflow and verify that its embed, actions, lead capture and logs all match it.

Official sources: security · DPA · HIPAA configuration

CustomGPT

Documented strength
Public security/subprocessor material, stated SOC 2 Type II and detailed conversation-retention documentation. The vendor-site chatbot added no chat-attributable cookie or localStorage item during the test.
Storage reality
Official documentation states that new agents retain conversations server-side for 12 months by default. Premium/Custom options can change retention, including a “never” choice. Optional guest browser history is a separate seven-day feature.
Clinic limitation
DPA availability statements conflict between Enterprise-only pages and a 2026 automatic DPA, and the DPA lists no sensitive/special-category data. Clarify both points in writing before any health-adjacent deployment.

Official sources: security · conversation retention · browser history · GDPR

ChatLab

Documented strength
Public DPA, named subprocessors, published technical measures, a 30-day default retention period and documented controls to load the widget after consent.
Observed deployment
Chat remained usable after optional cookies were rejected, creating client/session identifiers in localStorage. No privacy or health-data warning appeared before the first message on the standard vendor deployment.
Clinic limitation
ChatLab's governing terms prohibit health records and GDPR Article 9 data. Advising customers to warn users and delete accidental PHI is useful, but it is reactive: people can still disclose health data before a warning unless the clinic configures a gate and strict routing.

Official sources: DPA · subprocessors · deletion · load after consent

tawk.to AI Assist

Documented strength
An established live-chat platform with customer DPA, public subprocessors, security documentation and a long operating history.
Important distinction
AI Assist is a newer product layer. Its retrieval, model providers, prompts, logs and failure modes should be assessed separately rather than inheriting the maturity of the underlying human-chat service.
Clinic limitation
US processing, retention until deletion and no public SOC 2/ISO report or BAA offer found in the pages checked.

Official sources: privacy policy · data protection · subprocessors

Elfsight AI Chatbot

Documented strength
Low-code setup, flexible knowledge sources, configurable rules, lead forms and human handoff. The tested clinic bot handled an urgent postoperative prompt conservatively at first.
Storage reality
Elfsight's staff knowledge base says complete chat histories are stored indefinitely and are not automatically deleted. Optional transcript emails add another copy. A short-lived visitor cookie is documented and can be disabled account-wide by support.
Clinic limitation
No public clinic-customer DPA, named subprocessor list, AI transcript location or independent report was found. In the clinic test, the bot continued asking for health detail, introduced a possibly irrelevant consultation fee and missed a Sculptra page already present on the clinic site.

Official sources: knowledge base · instructions · GDPR/cookies · privacy policy

Clinic buyer checklist: what to request before installation

A polished demo is not procurement evidence. Ask for documents and test the exact configuration you will deploy.

  1. A clinic-customer DPA. Confirm it is incorporated into your contract and covers the actual service, not only an agreement between the vendor and its own subprocessors.
  2. A named subprocessor list. Identify the model provider, cloud host, analytics, support tools, email/transcript services and every region in which they process data.
  3. A data-flow diagram. Follow a message from the visitor's browser through the widget, vendor backend, model, logs, CRM, email and human inbox.
  4. Exact retention rules. Ask separately about server transcripts, logs, backups, browser history, lead records, model-provider logging and copies sent by email or integration.
  5. Deletion mechanics. Test one conversation: delete it, export evidence of deletion and confirm what remains in backups or downstream systems.
  6. Consent and transparency options. Decide what appears before the first message, which storage is necessary, which is optional and whether the widget can remain disabled until your consent platform allows it.
  7. Health-data contract position. Do the terms permit GDPR Article 9 data? If not, what stops or redirects a visitor before they submit it?
  8. Medical-answer boundary. Require clear no-diagnosis/no-suitability rules, urgent escalation, human handoff and testing against real clinic content.
  9. Independent evidence. Request the current SOC 2 report, ISO certificate and scope where claimed. SOC 2 is an examination/report, not a product “certification.”
  10. Plan-specific controls. Verify whether EU hosting, custom retention, zero-data retention, BAA, audit logs or consent gating require Enterprise.
  11. Operational ownership. Name the person who will update prices, treatments, contraindications, contact details and emergency routing—and retest after every change.
Practical procurement rule: if a vendor cannot tell you whether conversations are stored, where they are processed and how they are deleted, the clinic cannot give visitors an accurate privacy notice or operate a reliable data-subject request workflow.

Are you a vendor listed in this comparison? Products, documentation and configurations change. If information about your product is outdated or you believe we have made a factual error, please contact hello@iglowly.com with a link to the relevant documentation. We will review supported corrections and update the comparison where appropriate.


Methodology, evidence standard and limitations

Research was conducted on 1–2 August 2026. We began with products marketed for aesthetic clinics and added established general chat/AI-agent platforms that a clinic buyer is likely to compare. The core set contains 14 products: iGlowly, Botmedica, FlashAI.pl, Omybox, Hyperleap, Astucia, Tidio/Lyro, Crisp, Intercom Fin, Chatbase, CustomGPT, ChatLab, tawk.to AI Assist and Elfsight AI Chatbot.

For every product, we looked for the same categories: public runtime, knowledge source, built-in medical content, health-answer boundary, lead behaviour, conversation storage, retention, browser storage, hosting/processing, customer DPA, subprocessors, security documentation, independent assurance and HIPAA/BAA information.

Official vendor pages and documents were preferred. Manual browser tests used an incognito session and inspected cookies and localStorage before consent, after optional rejection where available, and after messaging. Host-site analytics were excluded from the widget result when attribution was clear. A real deployment was named only when the observed widget could be linked to the compared product.

Evidence points (0–7) are documentation coverage only: one point each when usable evidence was found for retention, browser storage, hosting/processing, customer DPA, public subprocessors, security documentation and independent assurance. A vendor can document a risky practice clearly and receive a point; another may have a good internal control that is not public and receive none. The number must never be read as legal compliance, medical quality or overall trust.

  • “Vendor states” identifies a first-party claim.
  • “Observed” describes the tested deployment at the stated time.
  • “Not found” means not located in the official materials checked, not proven absent.
  • A vendor-site configuration does not guarantee identical behaviour on every customer embed.
  • A browser test cannot prove server-side deletion, model-provider logging or backup erasure.
  • A safe answer in one prompt does not establish clinical reliability.

Vendor pages, plans and policies change. Re-check all selected-vendor documents immediately before signing. For general regulatory interpretation, consult the GDPR text on EUR-Lex, the EDPB's GDPR principles and qualified privacy counsel.

Publisher disclosure. iGlowly publishes this comparison and is one of the products included. We used the same fixed fields for every product and link to vendor documentation wherever available. Statements about iGlowly are first-party claims unless an independent source is expressly named. This is procurement research, not legal advice or a certification of any vendor.

By iGlowly Insights
August 2, 2026

FAQ

Can an AI chatbot on a clinic website be GDPR compliant?

Yes, a deployment can be designed and operated in line with GDPR, but the chatbot is not compliant by label alone. The clinic must establish a lawful basis, provide transparent information, minimise data, control retention, govern processors, secure the service and respect data-subject rights. Health-data processing needs additional Article 9 analysis.

Which AI chatbot stores no conversations?

In this comparison, iGlowly states that it does not retain raw conversations. That is a first-party claim from the publisher of this article and should be validated against the live deployment and contract. Other reviewed products commonly documented server-side conversation storage, although retention and deletion controls varied.

Does a clinic chatbot need cookie consent?

It depends on the technologies and jurisdiction. Storage that is strictly necessary to provide a chat expressly requested by the visitor may be treated differently from analytics, advertising or optional history. A cookie banner is not consent to retain chat content. Have local counsel or your DPO assess the exact widget and configuration.

If the chatbot works after “Reject all,” is that automatically a GDPR breach?

No. “Reject all” usually rejects optional categories, and a functional chat session may be classified as necessary. The important questions are whether that classification is accurate, whether the visitor receives clear information, whether the processing has a lawful basis and whether storage is limited to what is necessary.

Is localStorage a cookie?

No. It is a different browser-storage mechanism, but privacy and ePrivacy rules can still apply. Buyers should test cookies, localStorage, sessionStorage, IndexedDB and network requests rather than searching only for cookie names.

Is a DPA enough for a clinic chatbot?

No. A DPA is essential when a vendor processes personal data on the clinic's behalf, but it does not prove that the configuration is appropriate, the bot is medically safe, retention is minimal or every subprocessor is acceptable. It is one part of technical, legal and operational due diligence.

Is EU hosting enough for GDPR?

No. EU hosting can reduce transfer complexity, but GDPR also covers lawful basis, transparency, minimisation, security, retention, processor governance and individual rights. Model providers, support access and integrations can create additional processing locations.

What if a visitor submits health information even when the bot says not to?

Treat that as a foreseeable event, not an edge case. Use a pre-chat warning, prevent free-text collection where possible, add immediate stop-and-handoff logic, restrict staff access, define rapid deletion and incident workflows, and select contracts that match the residual risk. A footer disclaimer alone does not prevent processing.

Does HIPAA matter for a European aesthetic clinic?

HIPAA applies to specific US covered-entity and business-associate workflows; it is not a substitute for GDPR. A BAA can matter when a US clinic or eligible workflow handles PHI. European clinics should not treat HIPAA marketing as proof of GDPR compliance.

How often should a clinic test its AI chatbot?

Test before launch, after changes to the model, prompts, knowledge base, consent platform or integrations, and on a recurring schedule. Prices, services, staff contacts and safety instructions change. A once-trained chatbot can become inaccurate even when the software itself does not change.