Privacy policy

consultation.club is a product studio operated by Find Why Consulting, a registered business in Australia. We build digital tools for aesthetic clinics, including aesthetiQ, B&A and Rx.

This policy covers the Before & After (B&A) app, this website (ba.consultation.club) and B&A Pro, the clinic portal.

Your account. Your name and email address, and your password, which we store only as a secure hash.

Your photos and videos. The before and after selfies and videos you take in the app, the collections you put them in, the pose of each photo (for example smile or left side) and the date you took it.

Your subscription. Whether you have an active B&A subscription, which Apple or Google confirms to us. We never see your card details.

App analytics and crash reports. Google Firebase records app events, such as when a photo upload starts, succeeds or fails and the name of the collection, and sends us crash reports with your device model and iOS version. It never receives your photos or face data.

Clinics. A clinic you link to sees your name, email, the date you linked and the photos in the collections you choose to share. You can change what you share or disconnect at any time, and it loses access straight away.

What face data the app uses. When the camera is open, B&A detects your face and finds points on it, such as the outline of your eyes, brows, nose, lips and jaw. It uses Apple's Vision framework and Google's MediaPipe Face Landmarker to do this. Both run entirely on your iPhone. B&A does not use the TrueDepth camera, ARKit face tracking or Face ID data.

How it's used. The app uses these points only to guide your photo: to tell you to move closer or back, level the phone, turn your head to the right angle and match the expression in your before photo, so your before and after line up. It is never used to identify you, to recognise you in other photos, for advertising, or for any other purpose.

What is stored, and where. The face points are processed in your iPhone's memory as each camera frame arrives and are discarded straight away. They are never saved and never leave your device. To match an after photo to its before, the app saves a small set of measurements with each photo, on your device only: head angle, how open your eyes and mouth are, smile amount, brow height, camera height and lighting. These are numbers, not images or maps of your face, and they are never uploaded.

Sharing. Face data is never shared with us, your clinic or any third party.

How long it's kept. The face points are not kept at all. The measurements stay on your device until you delete the app, which removes them.

Your photos. The photos themselves are uploaded to your B&A account, encrypted, so you can see them on any device. They are stored with DigitalOcean in Sydney, Australia. They are shared with a clinic only if you link to that clinic and choose which collections to share.

Newsletter. Your email address, the page you signed up on, and which campaign brought you to the site.

Clinics (B&A Pro). The business name and number, clinic and location names, staff names, emails and roles, phone, website, delivery address for NFC stands, and how the clinic heard about us. We check business numbers with the Australian Business Register or Companies House where we can. Payments are handled by Stripe; we never see or store card or bank numbers. The clinic privacy notice has the detail.

Patients linking to a clinic. When you sign in here with your B&A account, we receive your B&A user ID, email and name from B&A, and keep a record of which clinic you linked to, which collections you chose to share, any capture reminders your clinic set, whether you agreed to share with your clinic, and whether B&A is provided by your clinic. To provide it we check whether you still pay for your own App Store or Google Play subscription. Your B&A sign-in is held only in an encrypted cookie for two hours; we don't store your password.

Site analytics and advertising. On our marketing pages (the home page, B&A Pro for clinics, the blog, how-to and this page) Google Tag Manager loads Google Analytics, the Meta pixel, the TikTok pixel, the Reddit pixel and the OpenAI Ads pixel. They record page views and clicks on the App Store and Google Play buttons, with your browser, device type, approximate location from your IP address, and the campaign that brought you to the site. Meta, TikTok, Reddit and OpenAI use this to measure our ads, and Meta may use it to show our ads to people who have visited. You can control how Meta uses this in your Facebook or Instagram ad settings. None of them run on the pages where patients link to a clinic or choose what to share, or in the clinic portal. We also count clinic sign-ups and patient links with PostHog, as numbers only. We do not record your screen or keystrokes.

Emails we send. SendGrid tells us when an email we sent you is delivered, opened or clicked, bounces, is marked as spam or leads to an unsubscribe. We keep a record of that in PostHog against your email address, so we can see which emails reach people and stop sending to addresses that don't work. It never includes what the email said or anything about your photos.

To run the B&A app: your account, your photos and collections, and your subscription.

To send the newsletter you asked for, and stop when you unsubscribe.

To run B&A Pro: clinic sign-up and billing, NFC stands, patient links, QR codes, invites and capture reminders.

To show a clinic the photos in collections a patient has chosen to share with it, and nothing else.

To understand which campaigns and pages lead to people downloading B&A, and to improve the app from how it's used.

We do not sell your personal information.

A clinic you link to sees your name, email, the date you linked, and the photos in the collections you choose to share. It sees nothing you haven't shared. Every time its staff open your photos it's logged, and the clinic's admins can see that log. Disconnect and it loses access straight away.

Our service providers: DigitalOcean (hosting and storage), Stripe for clinic payments, Apple and Google for app subscriptions, Google Firebase for app analytics and crash reports, SendGrid for sending emails, and PostHog for analytics. They process data only to run these services for us.

Google, Meta, TikTok, Reddit and OpenAI receive the page views and button clicks described above from our marketing pages, under their own privacy policies.

Apple receives the campaign token in the App Store link you tap, so we can see how many downloads each campaign or clinic brings in. Apple reports these as totals, not as individuals.

Google Analytics, Meta, TikTok, Reddit and OpenAI set cookies on our marketing pages. If you're in the UK or Europe, we ask first and they only run if you agree. You can change your answer any time with Cookie settings at the bottom of every page, and you can block these cookies in your browser settings.

Your browser also stores the campaign that brought you to the site for 30 days, so the App Store link can carry it.

Your account details and photos are stored with DigitalOcean in Sydney, Australia. Some of the services we rely on, such as Stripe, Apple, Google Firebase, SendGrid and PostHog, may process data outside Australia.

Data in transit is encrypted with TLS, and data at rest is encrypted at the database level. We follow the Australian Privacy Act's obligations for health information.

You can delete any photo in the B&A app, or delete your whole account in Settings. Deleted photos are removed from our storage within 90 days. Deleting the app removes everything stored on your device, including the face measurements.

Every newsletter email has an unsubscribe link.

You can change what you share, or disconnect from a clinic, at any time in the app or on your My clinics page.

To access, correct or delete what we hold about you, email [email protected] or WhatsApp 0413 653 028. We respond within 30 days.

If you're in Australia and unhappy with how we handled a complaint, you can contact the Office of the Australian Information Commissioner (OAIC).

For privacy questions, email [email protected].