This Privacy Policy explains how the Beauty Backroom app collects, uses, stores, shares and deletes your information. It covers the Beauty Backroom app for iPhone and Android and the web app at app.kellybroganmd.com (together, the "App").
1. Who we are
The App is owned by RWS Trust and operated as part of Kelly Brogan MD's Beauty Backroom program ("we," "us"). RWS Trust is responsible for your information in the App. Contact us at support@kellybroganmd.com or 3692 Grand Ave #185, Miami, FL 33133.
The App is only for adults 18 and older who have bought a Beauty Backroom program or subscription.
2. Information we collect
We collect only what the App needs to work. Your chats, tracker and notes can contain health information you choose to enter, such as the peptides and doses you take.
Account
- What it includes
- Email address, first name, plan (program or subscription), time zone
- Why we need it
- To sign you in, greet you by name and show times in your time zone
Sign-in
- What it includes
- Six-digit sign-in codes and the IP address each was requested from
- Why we need it
- To sign you in without a password and prevent abuse
Consent
- What it includes
- The disclaimer you accepted, when, and your IP address and browser
- Why we need it
- To record that you accepted the disclaimer before first use
Chat
- What it includes
- Your questions and the assistant's answers
- Why we need it
- To answer you and let you reopen, rename or delete past chats
Answer reports
- What it includes
- The reason you chose, any note you add, and a copy of the question and answer
- Why we need it
- So our team can review answers you report
Tracker
- What it includes
- The peptides you track, the dose as you typed it, days and times, cycles, start and end dates, doses taken or skipped and when, and pauses
- Why we need it
- To run your tracker, its history and dose reminders
My notes
- What it includes
- The text of your notes
- Why we need it
- To keep your notes. Only you can see them.
Program progress
- What it includes
- Where you are in the program and which posts you have read
- Why we need it
- To show your posts and unread counts
Feedback form. The in-app Feedback form is run by our customer-relationship system, GoHighLevel. The App fills in your name and email for you. What you submit goes to GoHighLevel, not to the App.
What we don't collect. The App does not access your location, contacts, camera, microphone or photos. The only phone permission it asks for is notifications, for dose reminders. Payments are not made in the App.
3. How we use your information
We use your information only to run the App: to sign you in, confirm your access, answer your questions, keep your tracker and history, and remind you of doses.
The App does not:
- show advertising;
- use analytics, tracking or advertising tools, on the web or on phones;
- sell or share your information for marketing; or
- use your tracker or chats for sales or marketing.
The web app sets one cookie, which keeps you signed in.
4. The AI assistant
The chat assistant's answers are written by Claude, an AI service from Anthropic, using Beauty Backroom's approved materials. To answer you, the App sends Anthropic your question, the conversation so far and the relevant materials. It does not send your name or email address, but anything you type in a message is sent as written, so avoid including personal details you don't want shared.
Anthropic does not use your chats to train its models and deletes them within 30 days, except in limited cases set out in its commercial terms and data retention policy.
The assistant gives general education, not medical advice.
5. Who can see your information
Your chats, tracker entries and notes are private. Other clients cannot see them, and our team's admin pages do not show them, with one exception: answers you report.
- Our team sees answers you report, with your report. Our team can also delete your account at your request.
- Toolshed, the company that builds and maintains the App, has technical access to the database and hosting for maintenance and support.
- Service providers listed in Section 7 process information only to run the App for us.
- Legal reasons. We may disclose information if the law requires it, or to protect the safety, rights or property of you, us or others.
- Change of ownership. If the Beauty Backroom business is sold or transferred, your information may move to the new owner under this policy.
We do not sell your information or share it with data brokers.
6. Health information
We treat tracker entries, chats and notes as sensitive health information. We use it only to provide the App to you, and we do not use it for marketing or share it beyond the providers below. Using the App does not create a doctor–patient relationship.
7. Where your information is stored and who processes it
Everything the App keeps is stored in one database in Ohio, in the United States.
Cloudflare
- Role
- Runs the App's server and hosts the coaching-call recordings
- What it receives
- Every request the App makes
- Where
- Worldwide network
Neon
- Role
- The App's database
- What it receives
- Everything in Section 2
- Where
- Amazon Web Services, Ohio, US
Anthropic
- Role
- Writes the assistant's answers
- What it receives
- Your questions, the conversation so far and approved materials
- Where
- United States
GoHighLevel
- Role
- Confirms your access from your plan; holds Feedback form answers
- What it receives
- Your email address
- Where
- United States
n8n and Google Workspace
- Role
- Send your sign-in code from support@kellybroganmd.com
- What it receives
- Your email address and the code
- Where
- United States
8. On your phone
The iPhone and Android apps keep some information on your phone, and erase all of it when you sign out.
- Sign-in is kept in your phone's secure storage (iPhone Keychain or Android Keystore), on that phone only and not in backups.
- Saved screens: a copy of what you last saw is kept for up to 72 hours so the App opens without a connection, along with any doses you ticked offline until they are sent.
- Dose reminders are scheduled by your phone. They say "Time for your dose" and never name the peptide. You can turn them off in the App.
- Time zone: the App reads your phone's time zone to show dose times in local time.
9. Deleting your information
- You can delete any single chat, note or tracker item at any time.
- Delete my account, in the account menu on the web and in the phone apps, erases your chats, tracker (items, schedules and every dose), notes, program progress, reports, consent records and sign-ins.
- If you can't sign in, email support@kellybroganmd.com from your account email and we will delete your account.
- Losing access (for example, when your plan ends) signs you out but does not delete your data. You can still ask us to delete it.
- Deleting your App account does not delete your contact record in our customer-relationship system, GoHighLevel. To be removed from it too, email support@kellybroganmd.com.
10. How long we keep information
Chats, tracker entries and notes stay until you delete them or your account; the App does not delete them automatically. When you delete something, it is removed from our live database right away. Our database provider keeps a 6-hour restore history so we can recover from mistakes; after 6 hours, deleted data can no longer be recovered. The copy on your phone lasts up to 72 hours, and Anthropic keeps chats for up to 30 days, as described above.
11. Your privacy rights
Depending on where you live, you may have the right to:
- know what information we hold about you and get a copy;
- correct it;
- delete it;
- withdraw consent you gave us; and
- appeal if we decline your request.
Residents of Washington, Nevada, Connecticut and other states with consumer health data laws have additional rights over health-related data, including the right to know who it was shared with. Residents of the EU and UK have rights under the GDPR.
To make a request, email support@kellybroganmd.com. We will confirm your identity through your account email and respond within 45 days (30 days for GDPR requests). We will not treat you differently for using these rights.
12. Security
All traffic between the App and our server is encrypted (HTTPS), and the server reaches the database only over encrypted connections. Sign-in codes and active sign-ins are stored only in scrambled (hashed) form. Admin pages are open only to our team's admin accounts, which also sign in with an emailed code. You can sign out of all devices from the account menu. No system is perfectly secure, so tell us right away if you think your account was used without your permission.
13. Children
The App is for adults 18 and older. We do not knowingly collect information from anyone under 18, and we will delete it if we learn we have.
14. Changes to this policy
We will post any changes here and update the effective date. If a change materially affects how we use your information, we will tell you in the App or by email before it takes effect.
15. Contact us
RWS Trust
3692 Grand Ave #185
Miami, FL 33133
support@kellybroganmd.com