Privacy Policy

MedRestock (operated by Aesthetics Dynasty LLC, Orlando, Florida) provides inventory management software for medical practices. This policy explains what we collect, why, and the choices you have. It is written to be read.

1. Information we collect

Account information. Your email address, clinic name, and the email addresses of team members you invite. We authenticate with magic links and station PINs; we never store passwords, and PINs are stored only as salted one-way hashes.

Inventory and operational data. The products, suppliers, locations, stock counts, lot numbers, expiration dates, purchase orders, and adjustments you enter. This is your data (see Terms, Data Ownership).

Attribution data. On clinical plans, dose logs can record patient initials and provider initials that your team types. These are clinic-chosen shorthand for attribution and recall tracing. MedRestock does not collect patient names, dates of birth, medical record numbers, diagnoses, or other identifiers, and does not function as a medical record.

Payment data. Billing is processed by Stripe. Card numbers never touch our servers; we store only Stripe's customer and subscription identifiers and your plan and status.

Usage and device data. Pages visited, features used, browser and device type, and approximate location derived from IP address, collected through analytics tools described in section 6.

Activity log. Every change to inventory is recorded with who made it, what changed, and when. On shared station devices the acting provider (the person who unlocked the station) is recorded as the actor. This log exists so your practice can answer audit and recall questions; it is visible to your account's owners and managers.

2. How we use it

To run the service (sign-in, inventory, alerts, purchase orders, station sign-in); to send transactional email (magic links, low-stock alerts, expiration digests, purchase orders to your suppliers, billing receipts); to provide support and, when you ask us to, help set up your account (for example building an import file from a list you send us); to understand how the product is used so we can improve it; and to communicate about changes to the service. We do not sell your data and we do not use it for advertising.

3. How it is protected

Data is stored in the United States with an established cloud database provider, encrypted at rest and in transit over HTTPS. Access controls are enforced at the database layer as well as in the application, and every request is authenticated and scoped to your organization. Sign-in uses expiring magic links; station PINs are hashed with scrypt and rate-limited against guessing. Every organization's data is isolated from every other's. No system is perfectly secure, and we will notify affected customers without unreasonable delay if we learn of a breach affecting their data.

4. Who we share it with

Only service providers that operate the product, and only to the extent needed: database hosting and authentication, application hosting, payment processing (Stripe), transactional email delivery, security and error monitoring, and the analytics providers described in section 6. Each is bound by contractual confidentiality and its own privacy and security terms, and none may use your data for its own purposes. We may disclose information if required by law or to protect the rights and safety of MedRestock, our customers, or the public. We do not sell, rent, or trade personal information.

5. Your rights and choices

Owners can export their organization's data at any time from within the product and can delete team members. To request account deletion, correction, or a copy of your personal data, email support@medrestock.com. Deletion removes your organization's data within 30 days, except records we must retain for billing, tax, or legal purposes, and the minimum account identifiers (such as an email address) we keep to prevent abuse of free trials. Residents of California and other states with privacy laws may exercise access, deletion, and correction rights through the same address; we do not sell personal information and there is no opt-out to exercise on that point.

6. Cookies and analytics

We use essential cookies for sign-in and session management. Our marketing site uses Google Analytics and may use Microsoft Clarity to understand how visitors use the site; these set analytics cookies and Clarity may record anonymized session interactions. You can block analytics cookies in your browser without affecting the product. We do not use advertising cookies or sell data to advertisers.

7. Health information

MedRestock is inventory software, not an electronic health record, and we are not a business associate under HIPAA for the ordinary use of the product. The optional patient initials field is a clinic-chosen attribution shorthand, not a medical record. Practices remain responsible for how they use that field under their own policies. If your practice requires a Business Associate Agreement for a specific use, contact us before entering any information you consider protected health information.

8. Children

MedRestock is a business tool for medical practices and is not directed to anyone under 18.

9. Changes

We will post updates here with a new date and, for material changes, notify account owners by email.

10. Contact

Aesthetics Dynasty LLC (MedRestock), Orlando, Florida. support@medrestock.com.