Frontlo Privacy Policy

Version 1.2 · effective from 28 October 2026

This is a translation. In case of any discrepancy, the Polish version prevails.

This policy explains how we process personal data on the Frontlo platform: in the panel for clinics (app.frontlo.com), on clinic websites built with Frontlo and in the Frontlo mobile app for patients (including apps published under a clinic’s name).

1. Who we are

The platform is operated by WEBSITTERS SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, with its registered office in Wrocław, ul. Aleksandra Hercena 10, 50-453 Wrocław, entered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0000946109, tax ID (NIP) 8992915384, REGON 521002056 (“Frontlo”, “we”).

Contact on personal data matters: [email protected] or by post to our registered office. We have not appointed a data protection officer — please write to the address above on any data-related matter.

2. Who is the controller of your data

Frontlo provides software to clinics (practices, salons). Who decides about your data therefore depends on the purpose for which we process it:

Where the clinic is the controller, the purposes, legal bases and retention periods are set out in the clinic’s privacy policy — you will find it on the clinic’s website and in the app (My account → Settings). The clinic’s contact details are also there. Frontlo does not sell patient data, does not use it for its own marketing and does not share it with other clinics.

3. Users of the clinic panel

What data

• first name, last name, e-mail address, phone number, job title, profile photo (if added);
• clinic data and invoicing details (company name, tax ID (NIP), address);
• login and security data (hashed password, sessions, IP address, log of actions in the panel);
• a record of acceptance of the Terms of Service and the Data Processing Agreement (version, date, IP address, browser);
• plan and payment history, correspondence and requests sent to us;
• content entered into AI features (if you use them).

For what purpose and on what legal basis

• opening and maintaining the account, providing the services — Article 6(1)(b) GDPR (contract);
• invoices and billing — Article 6(1)(c) GDPR (legal obligation);
• platform security, detecting errors and abuse, evidence of acceptance of documents, establishing and defending claims, messages about changes to the service, technical support — Article 6(1)(f) GDPR (Frontlo’s legitimate interest);
• news about Frontlo — only with consent, which can be withdrawn at any time.

Team members are added to the panel by the clinic. We process their data relating to their work at the clinic (e.g. schedule, assigned appointments, entries in records) on behalf of the clinic.

For how long

For the term of the agreement, and then until the limitation periods for claims expire; accounting documents — 5 years from the end of the year in which the tax payment deadline fell.

4. Patients — the Frontlo app and clinic websites

What data

• phone number (login with an SMS code), first name, last name and, optionally, e-mail, date of birth and gender;
• delivery address and phone number for the courier (for orders with delivery), voucher recipient details;
• appointments, orders, vouchers, packages, subscriptions, points and rewards, messages with the clinic, reviews;
• payments — amount and status; you enter your card details in the window of the payment provider Stripe (including Apple Pay and Google Pay) and they are not passed to Frontlo or to the clinic;
• consents (terms of service, marketing, ad measurement, statistics) with the date and place they were given;
• technical data: device token for push notifications, platform and app version, IP address and browser when you use the clinic’s website, app crash reports (section 5), visit statistics for the website and app screens (section 6);
• treatment records and health information — only if the clinic keeps them in its panel (section 8). The app and the clinic’s website do not collect health data.

Why

To enable appointment booking, purchases and payments, to send confirmations and reminders (SMS, e-mail, push), to maintain your account in the clinic’s loyalty programme, to let you contact the clinic, to count visits to the clinic’s website and app and — with your consent — to send the clinic’s marketing communications, keep more detailed statistics and measure its ads (section 6). We maintain your Frontlo app account on the basis of the contract for use of the app (Article 6(1)(b) GDPR), and its security and crash reports on the basis of our legitimate interest (Article 6(1)(f) GDPR).

The clinic may set up automatic offers and rewards based on your account history (e.g. birthday, number of appointments, points). We do not make decisions about you based solely on automated processing which produce legal effects concerning you or similarly significantly affect you.

App permissions

• notifications — appointment reminders and messages from the clinic (you can turn them off in the system settings);
• camera — only when you scan a QR code yourself (e.g. a clinic code); the image does not leave your phone;
• tracking (iPhone, the “Allow to track” prompt) — appears only if you turn on “Personalised ads” (section 6); the “Statistics” switch does not require it.

The app does not use location, contacts, photos or the microphone, contains no third-party advertising libraries, does not display ads and does not read the device’s advertising identifier (IDFA / AAID).

5. Crash reports and security

The panel, the server and the app send crash reports and performance data to Sentry (device model, system and app version, error trace). Reports from the app are not linked to your account and do not contain appointment details or health data. Legal basis: legitimate interest (Article 6(1)(f) GDPR) — detecting and fixing errors. Reports are deleted automatically after the retention period set in Sentry.

6. Visit statistics and the clinic’s ad measurement

Visit statistics

Frontlo counts visits to the clinic’s website and app for the clinic, so that the clinic can see in its panel how many people visit and where they come from. The clinic is the controller of this data; Frontlo processes it on the clinic’s behalf (data processing agreement). The data stays within Frontlo — it is not passed to external analytics or advertising tools.

• without consent — page and screen views and visits only: the page address (without parameters) or the name of the app screen, and when you arrive from elsewhere — the address (host) of the referring page and campaign parameters (UTM), the device type (phone, tablet, computer) and country. No cookies, no identifiers and no storage of your IP address (the IP address is used only briefly to protect against abuse). Legal basis: the clinic’s legitimate interest — visit statistics (Article 6(1)(f) GDPR);
• with consent — on the website, analytics (statistics) consent in the banner; in the app, the “Statistics” switch: additionally a random identifier of the browser or app installation and a session identifier, which let the clinic see the number of unique visitors, sessions and the source of the visit that led to a booking or purchase. On the website we store them in the cookies _fl_vid (13 months) and _fl_sid (up to 30 minutes of inactivity), in the app — in the phone’s storage. Legal basis: your consent (Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law).

We keep individual events for 90 days and daily totals without personal data for 25 months. You can withdraw consent via “Cookie settings” on the clinic’s website or with the “Statistics” switch in the app — the app then deletes the installation identifier.

Ad measurement (Meta, Google, TikTok) — only with consent

A clinic may measure the effectiveness of its ads on Meta (Facebook, Instagram), Google (Google Analytics 4, Google Ads, Google Tag Manager) and TikTok. The clinic is the controller of this data; Frontlo transmits it on the clinic’s behalf. Nothing is sent without your consent.

On the clinic’s website

On your first visit, the website shows a consent banner. Analytics tools (Google Analytics) load only after you consent to analytics, and advertising tools (Meta, TikTok, Google Ads) only after you give marketing consent. You can change your consent at any time via “Cookie settings” on the clinic’s website.

In the app

The app has two separate switches (when creating an account and in My account → Settings → Consents and privacy), both off by default:

• “Personalised ads” — ad measurement on Meta and TikTok. On an iPhone, turning it on also requires system permission (the “Allow to track” prompt, App Tracking Transparency) — if you do not grant it, the switch stays off;
• “Statistics” — the clinic’s Google Analytics 4 and visit statistics for the app with the installation identifier (above). It does not require the “Allow to track” prompt.

What is sent and from where

• the type of event (e.g. form submission, booking, purchase, product view), its value and items, the event identifier;
• with marketing consent — SHA-256 hashes of your e-mail address, phone number and account identifier (we do not send them in plain text; your name is not sent), and from the clinic’s website also your IP address, browser, page address and identifiers from the platforms’ cookies (e.g. _fbp, _fbc, _ttp, _ga);
• website events are sent by the browser, and forms, bookings and purchases also by the Frontlo server (Meta Conversions API, Google Analytics 4 Measurement Protocol, TikTok Events API), with the same identifier so that they are not counted twice; events from the app and subscription renewals are sent by the server only.

Which decision applies

Website events always use the choice made in the banner in that browser. For events without a browser (from the app and subscription renewals), your most recent decision saved in your account applies — separately for ads and for statistics: the switch in the app (“Personalised ads” or “Statistics”) or the banner choice on the clinic’s website (marketing or analytics consent) when you make a purchase or booking there while logged in. A later withdrawal of consent overrides an earlier consent, and where decisions were made at the same moment, the more cautious one applies. The switch in the app shows the decision that applies and where you made it. The same rule applies to the installation identifier in the app’s visit statistics.

Legal basis: your consent (Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law). You may withdraw it at any time, without affecting processing carried out before the withdrawal. After sending, the server deletes the matching data (IP, hashes, cookies); we keep a log of transmissions without that data for 30 days. Meta, Google and TikTok process the data they receive under their own terms — in part as independent controllers — and may transfer it outside the EEA (section 9).

7. Deleting your app account

You can delete your account in the app: My account → Settings → Delete account (confirmed with an SMS code), without the app at app.frontlo.com/delete-account (SMS code, choose clinics), or by writing to the clinic or to [email protected]. Deletion covers all accounts with your phone number — at all clinics. An active subscription paid by card must be cancelled first. Unused vouchers, packages and points are forfeited — the app will show them before deletion.

We delete: contact details, consents, sessions and devices, notifications, chat, points, campaigns and baskets.

The following is retained, without contact details:

• billing records (orders, payments, appointments, vouchers) — for the period required by tax and accounting law (5 years), Article 17(3)(b) GDPR;
• treatment records, if the clinic keeps them — together with your first name, last name and date of birth, for 20 years (section 8);
• the phone number trace — a hash of the number created with a secret key (HMAC-SHA256), the list of clinics where you had an account, and dates. Without the number in plain text, your name or e-mail. Its purpose is to prevent “new client” promotions and rewards from being exploited by repeatedly creating accounts: if you return with the same number, you can create an account, but without the bonuses for new clients. Frontlo is the controller of the trace, and the legal basis is the legitimate interest of Frontlo and the clinics in preventing abuse (Article 6(1)(f) GDPR). We delete the trace automatically 3 years after the most recent account deletion. You may object — write to [email protected].

8. Medical records

A clinic may keep treatment records in Frontlo: the medical questionnaire, treatment notes including the products used, consents signed at the clinic, and photos. The clinic is the controller of this data — it processes it on the basis of Article 9(2)(h) GDPR and the Polish Act on Patients’ Rights and the Patients’ Rights Ombudsman. The clinic keeps the records for 20 years from the end of the year in which the last entry was made (Article 29 of that Act) — deleting your app account does not change this.

The records are available only in the clinic’s panel, to people to whom the clinic has granted permission. Frontlo staff have no access to them in the panel. Exception: the clinic owner may grant Frontlo support read-only access for the duration of a support request (1, 24 or 72 hours); the owner may revoke it at any time, and every access is recorded in a log visible to the clinic.

9. Who we share data with

We use providers who process data on our behalf or on behalf of the clinic:

• Hetzner Online — servers and backups (Germany, Finland);
• Cloudflare — file storage in Cloudflare R2 in the EU region, DNS, traffic protection;
• Amazon Web Services (Amazon SES) — sending e-mails (EU region);
• SMSAPI or SerwerSMS — sending SMS messages (Poland);
• Google Firebase Cloud Messaging (and, on iPhones, also the Apple Push Notification service) — push notifications;
• Stripe — card, Apple Pay and Google Pay payments; for fraud prevention and legal obligations, Stripe acts as an independent controller;
• Sentry — crash reports;
• OpenAI — only when a panel user uses AI features (the content sent to the feature);
• Fakturownia — issuing invoices to clinics;
• Meta, Google, TikTok — only with your consent and if the clinic enables ad measurement (section 6).

The current list of sub-processors for patient data is in the Data Processing Agreement. We may also disclose data to authorities entitled to it by law. You download the app from the App Store or Google Play — Apple and Google process data related to the download under their own policies.

Some providers may process data outside the European Economic Area (e.g. in the USA). This takes place on the basis of a European Commission adequacy decision (the EU–US Data Privacy Framework) or standard contractual clauses.

10. Your rights

You have the right to access your data and obtain a copy of it, to rectification, erasure, restriction of processing and data portability, to object to processing based on legitimate interest, and to withdraw consent at any time (in the app — the “Personalised ads” and “Statistics” switches, on the clinic’s website — “Cookie settings”), without affecting processing carried out before the withdrawal.

Where the clinic is the controller (section 2), write to the clinic — if you write to us, we will forward your request to the clinic and help it fulfil the request. In all other matters write to [email protected]. We reply within one month. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).

Providing data is voluntary, but without a phone number you cannot create an app account, and without registration details you cannot create a panel account.

11. Security

Connections are encrypted (HTTPS), passwords are stored as hashes, files are private and shared via temporary signed links, each clinic’s data is kept separate, and only authorised persons have access to it. We make regular backups.

12. Cookies

The Frontlo panel uses only cookies and browser storage that are strictly necessary for it to work (login, session, appearance settings). Clinic websites use strictly necessary cookies (e.g. basket, login, remembering your banner choice), and analytics and advertising cookies only after you consent in the banner, including the visit statistics cookies _fl_vid (13 months) and _fl_sid(30 minutes) — after analytics consent (section 6). Without consent, visit statistics work without cookies. Details of the tools chosen by a clinic are described in its privacy policy.

13. Changes to this policy

We will inform you of material changes in the panel, in the app or by e-mail. The current version is always available at this address.