Privacy Policy

VisitCare is a software-as-a-service platform that helps appointment-based businesses (such as beauty, wellness, and aesthetic practices) manage clients, services, calendars, and automated WhatsApp messaging.

This Privacy Policy explains how personal information is collected, processed, and protected when businesses, business users, clients, website visitors, or other individuals interact with VisitCare.

Depending on the circumstances, a business using VisitCare generally acts as the controller of its client data, while VisitCare acts as a processor on the business's behalf. For data processed for VisitCare's own account, subscription, support, or legal purposes, VisitCare acts as an independent controller.

Depending on how VisitCare is used, the platform may process information including:

• business account and contact information;
• business identity information (name, WhatsApp number, working hours, services offered);
• client identification and contact information (name, phone number);
• appointment information (service, date, time);
• communication history (WhatsApp messages sent through the platform);
• subscription and billing metadata;
• device, browser, IP, and technical information required to operate and secure the platform.

VisitCare does not process medical records, clinical notes, treatment photographs, or health-related data. It is not designed or intended to store special-category health information.

Personal information may be processed for purposes including: managing bookings and calendars; sending automated confirmations, reminders, follow-ups, and recall messages; managing business accounts and subscriptions; providing customer support; maintaining platform security; affiliate attribution and referral tracking; complying with applicable legal or regulatory obligations.

Where required by applicable law, personal data is processed on an appropriate legal basis, which may include performance of a contract, legitimate interests, consent, or compliance with legal obligations. Businesses are responsible for ensuring they have an appropriate legal basis — including any required client consent for WhatsApp messaging — for entering client information into VisitCare.

Businesses using VisitCare determine which client information is entered into the platform and how it is used. Each business is responsible for complying with applicable privacy and data protection laws, informing clients where legally required, obtaining consent where legally required, establishing appropriate retention periods, ensuring users are authorized to access business information, and responding to client rights requests relating to data they control.

Where VisitCare processes personal data on behalf of a business, it does so in accordance with the business's instructions, the platform's functionality, and applicable law. VisitCare does not independently determine the purposes for which businesses process their clients' personal data.

VisitCare relies on third-party service providers and infrastructure providers necessary to operate the platform, including Base44 (platform infrastructure, hosting, database, and email delivery), Twilio (WhatsApp message delivery infrastructure), Meta/WhatsApp (messaging channel), and subscription payment processing through Base44 Payments, powered by Wix Payments, and Stripe (for subscriptions billed in euro). Such providers may process information only to the extent necessary to provide their respective services. VisitCare does not store full payment card details.

VisitCare uses reasonable technical and organizational safeguards designed to protect information against unauthorized access, alteration, disclosure, loss, misuse, or destruction, including authenticated access, business-specific access controls, role-based permissions, separation of business data, and encrypted communications. No electronic system can guarantee absolute security.

VisitCare is designed as a multi-tenant platform. Client, appointment, and communication data are associated with the relevant business account. Users should only be able to access information belonging to businesses for which they have been authorized.

Information is retained only for as long as reasonably necessary to provide the VisitCare service, for the purposes for which it was collected, and to comply with legal, contractual, accounting, or regulatory obligations. Businesses are responsible for determining retention periods applicable to their own client and business records.

VisitCare does not sell personal information. Information may be disclosed only where reasonably necessary: to service providers and subprocessors required to operate the platform; at the direction of the relevant business; where required by applicable law, regulation, court order, or valid legal request; to protect the security, integrity, rights, or legitimate interests of VisitCare, its users, or others; or in connection with a legitimate corporate restructuring, merger, acquisition, or transfer, subject to applicable law.

Depending on the infrastructure and service providers used, information may be processed or stored in countries outside the user's or business's country. Where required by applicable law, appropriate safeguards will be used for international transfers of personal data.

VisitCare operates on the Base44 platform and uses service providers that may process data in various countries. Base44 platform infrastructure, Twilio, Meta/WhatsApp, and the payment provider may process or store data in the European Union, Romania, and the United States. Where personal data is transferred to countries outside the European Union / European Economic Area, VisitCare relies on appropriate safeguards as required by applicable data protection law. The specific transfer mechanisms applicable to each provider may vary and are subject to the provider's own data processing agreements.

VisitCare is operated from Romania. Personal data is protected by Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and applicable Romanian data protection legislation. Individuals may exercise their rights under the GDPR and may lodge a complaint with the Romanian supervisory authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal).

Depending on applicable law, individuals may have rights including: access to personal data; correction of inaccurate information; deletion of personal data; restriction of processing; objection to certain processing; withdrawal of consent where processing is based on consent; data portability; information about processing; and the right to lodge a complaint with a competent data protection authority. Where a request concerns client information controlled by a business, the request should generally be directed first to that business.

Requests relating to VisitCare account data, platform-related personal information, or privacy matters may be submitted to support@visitcare.io. Where the requested information belongs to or is controlled by a business, VisitCare may need to coordinate the request with that business.

VisitCare provides communication functionality that allows businesses to communicate with clients via WhatsApp. Businesses are responsible for ensuring communications are lawful, appropriate, and sent to authorized recipients. VisitCare may also send operational, security, billing, subscription, or service-related communications to business users.

VisitCare subscription billing is separate from any client-facing activity within a business account. Subscription payment information may be processed by third-party payment providers: Base44 Payments, powered by Wix Payments, for subscriptions billed in Swiss francs, and Stripe for subscriptions billed in euro. VisitCare does not intentionally store full payment card details.

This Privacy Policy may be updated from time to time to reflect changes to VisitCare functionality, new service providers, changes in applicable law, security or operational changes, or changes in business practices. The most current version will be published on this page together with the applicable "Last updated" date.

For privacy questions relating to VisitCare:

Synaptrix AI S.R.L. — operator of VisitCare

General support: support@visitcare.io

Registered address: Calea Torontalului nr. 69, Clădirea VOX, Corp B, Biroul nr. 702, Etajul 7, 300668 Timișoara, Județul Timiș, România

Company registration number: J2026058744002

Tax identification number: 55731334

VisitCare operates a referral program through individual sales partners. Sales partners receive unique referral links containing a referral code (for example, visitcare.io/?ref=AGENTCODE). When a visitor clicks a referral link, the referral code is captured and used to attribute the subsequent business registration to the referring partner.

The referral technology uses a first-party cookie named "vc_ref" stored in the visitor's browser. The cookie stores only the referral code (a short alphanumeric identifier), no personal data. The cookie is set with a 30-day expiration period and a SameSite=Lax attribute. The first valid referral code encountered is retained; subsequent referral codes do not overwrite it. No third-party tracking cookies are used.

When a visitor registers a business account, the referral code stored in the cookie (or entered manually during registration) is permanently associated with that business account. This association is used to calculate and attribute commissions to the referring sales partner when the business makes subscription payments. Referral click records (landing page, referrer URL, and partner identifier) are stored for attribution and reporting purposes.

The legal basis for affiliate tracking and attribution is legitimate interests (Article 6(1)(f) GDPR), to operate the referral program, attribute registrations correctly, and calculate partner commissions. Referral cookies are retained for 30 days. Referral click and commission records are retained for as long as necessary for accounting, audit, and commission reconciliation purposes.

Under applicable ePrivacy and cookie laws, the referral cookie is a non-essential cookie that requires consent. VisitCare implements a cookie consent banner that appears on first visit, allowing visitors to accept all cookies, reject optional cookies, or manage their preferences. The referral cookie (vc_ref) is only set after the visitor grants consent for referral tracking. Visitors who decline optional cookies are not attributed to a referral partner via the cookie, but may still enter a referral code manually during registration. Consent can be withdrawn or modified at any time via the Cookie Settings link in the footer; upon withdrawal, the referral cookie is removed and future referral tracking is stopped.

VisitCare uses the following browser storage technologies. Storage is categorised as strictly necessary (no consent required) or optional (consent required).

• Authentication token (localStorage): stores the user's session token after login. Strictly necessary; removed on logout.
• Language preference — visitcare.language (localStorage): stores the selected interface language. Strictly necessary for the website to display in the chosen language.
• Service sort order — visitcare_services_sort (localStorage): stores the business owner's preferred service display order within the authenticated app. Strictly necessary for app functionality.
• Sidebar state (cookie): stores the sidebar open/closed state in the authenticated app. Strictly necessary for UI functionality.
• Referral code — vc_ref (cookie, 30 days): stores the referral code from a partner link for attribution. Optional; only set after consent.

No analytics, marketing, or third-party tracking cookies are used. Consent for the optional referral cookie is managed through a cookie consent banner that appears on first visit. Visitors can accept all cookies, reject optional cookies, or manage individual preferences. Consent preferences and a timestamp are stored in localStorage. Consent can be withdrawn or modified at any time via the Cookie Settings link in the footer; upon withdrawal, the referral cookie is removed and future referral tracking is stopped.