Privacy policy

consultation.club is a product studio operated by Find Why Consulting. We build digital tools for aesthetic clinics, including aesthetiQ, B&A, and Rx. Our registered business is in Australia.

We collect information you provide directly: email addresses submitted via lead forms, waitlists, and the sign-up flow; name and contact details when provided; clinic information for the B&A NFC sign program and aesthetiQ onboarding; and payment information processed by Stripe (we never store card details ourselves).

We use your information to communicate about the products you expressed interest in, to onboard your clinic onto aesthetiQ, to ship B&A NFC signs, to process Stripe billing, and to improve the products based on usage. We do not sell your data to third parties.

aesthetiQ collects patient-provided information (treatment interests, concerns) on behalf of the clinic. The clinic is the data controller for patient data. B&A captures are stored encrypted, associated with the patient's account, and shared with linked clinics only with the patient's explicit consent.

Your account. Your name and email address, and your password, which we store only as a secure hash.

Your photos and videos. The before and after selfies and videos you take in the app, the collections you put them in, the pose of each photo (for example smile or left side) and the date you took it.

Your subscription. Whether you have an active B&A subscription, which Apple or Google confirms to us. We never see your card details.

App analytics and crash reports. Google Firebase records app events, such as when a photo upload starts, succeeds or fails and the name of the collection, and sends us crash reports with your device model and iOS version. It never receives your photos or face data.

Clinics. A clinic you link to sees your name, email, the date you linked and the photos in the collections you choose to share. You can change what you share or disconnect at any time, and it loses access straight away.

What face data the app uses. When the camera is open, B&A detects your face and finds points on it, such as the outline of your eyes, brows, nose, lips and jaw. It uses Apple's Vision framework and Google's MediaPipe Face Landmarker to do this. Both run entirely on your iPhone. B&A does not use the TrueDepth camera, ARKit face tracking or Face ID data.

How it's used. The app uses these points only to guide your photo: to tell you to move closer or back, level the phone, turn your head to the right angle and match the expression in your before photo, so your before and after line up. It is never used to identify you, to recognise you in other photos, for advertising, or for any other purpose.

What is stored, and where. The face points are processed in your iPhone's memory as each camera frame arrives and are discarded straight away. They are never saved and never leave your device. To match an after photo to its before, the app saves a small set of measurements with each photo, on your device only: head angle, how open your eyes and mouth are, smile amount, brow height, camera height and lighting. These are numbers, not images or maps of your face, and they are never uploaded.

Sharing. Face data is never shared with us, your clinic or any third party.

How long it's kept. The face points are not kept at all. The measurements stay on your device until you delete the app, which removes them.

Your photos. The photos themselves are uploaded to your B&A account, encrypted, so you can see them on any device. They are stored with DigitalOcean in Sydney, Australia. They are shared with a clinic only if you link to that clinic and choose which collections to share.

We use Google Analytics and Hotjar on consultation.club, and PostHog on ba.consultation.club, to understand how visitors use our websites, through anonymised usage analytics, heatmaps and session recordings. These services set their own cookies for this. We set a referral attribution cookie (ba_ref) when a patient taps a B&A NFC sign, used solely to activate the extended trial and attribute the install to the clinic.

We also use the Meta Pixel on consultation.club. It tells Meta (Facebook and Instagram) when you visit our website, so we can measure how our ads perform and show our ads to people who have visited. Meta may use a cookie and information about your visit for this. You can control how Meta uses this information for ads in your Facebook or Instagram ad settings, and you can block these cookies in your browser settings.

Your account details and photos are stored with DigitalOcean in Sydney, Australia. Some of the services we rely on, such as Stripe, Apple, Google Firebase and our email provider, may process data outside Australia. Data in transit is encrypted via TLS. Data at rest is encrypted at the database level. We follow Australian Privacy Act obligations for health information.

You can delete any photo in the B&A app, or delete your whole account in Settings. Deleted photos are removed from our storage within 90 days. Deleting the app removes everything stored on your device, including the face measurements.