Privacy, made clear.

What we collect

• Your account: your email address and sign-in details.
• Your clinic: the clinic name, location, contact details, brand preferences, audiences, treatments and guidance you choose to save.
• Your content: the notes and answers you give us, campaign copy, photos and logos you upload or import, generated images and your edits.
• Your website: information and images from your public website, when you ask us to review it. You approve anything imported before it is used.
• The waitlist: the email address you give us for launch updates.
• Feedback, ideas and support: what you send us, the account it relates to, an optional reply email address, and limited technical information used to prevent spam. A reply email address is never added to a mailing list.
• Technical information: security, request and error records created when the service is used. We do not use advertising trackers.
• Optional analytics: only if you agree. See below.

How we use it

• To provide Toggled: signing you in, saving your workspace, creating and editing the campaigns and images you ask for, exporting your work and helping when you need support.
• To email you: launch updates you have asked for, and sign-in, security and service messages. Weekly planning emails are switched off during the beta.
• To keep Toggled safe: using limited technical information to protect the service, fix faults and prevent abuse.
• To improve Toggled: optional analytics, only with your consent.

We do not sell personal information, and we do not use clinic content in Toggled’s own advertising.

Our legal bases

Depending on the activity and the law that applies, we rely on performing our agreement with you, your consent, complying with legal obligations, and our legitimate interests in running and securing Toggled. You can withdraw marketing consent at any time by emailing us.

Optional analytics

If you say yes in the cookie banner, we use PostHog, in its EU cloud, to understand how people find Toggled and how they use its main features. Before you sign in, you are counted under a random ID. Once you have a confirmed account, analytics are linked to that account, so this information is pseudonymous rather than anonymous.

We never send analytics your name, email address, clinic or client content, photos, anything you type, full web addresses, your IP address or browser details. We do not use session recording or heatmaps.

The legal basis is your consent. Your choice lasts up to 180 days, and you can change it at any time through Cookie settings on the Cookies page or in the site footer. Saying no stops future analytics and removes analytics cookies from your browser. It does not undo earlier analytics; email us if you would like those deleted.

We keep analytics no longer than we need them to understand how Toggled is used. We also keep a small record of your consent choice and of which account milestones have been counted, so nothing is counted twice. It contains no clinic or client content and is deleted with your account.

Who helps us run Toggled

We use trusted service providers for hosting and storage, AI content generation, email and optional analytics. The providers that receive personal information are Supabase, Vercel, Cloudflare, OpenAI, Brevo and PostHog. Each receives only the information needed for its part of the service.

Where your information is processed

Toggled is run from Gibraltar and serves UK clinics. Your workspace is stored in the EU (Ireland). Our AI provider processes information in the United States, and our hosting, email and other providers may also process information in the US and other countries. This means a client photo you upload is processed outside the UK, including by AI in the US.

Even where a provider stores information in the EU, its own support teams or subcontractors may access it from elsewhere. International transfers must be covered by a recognised legal safeguard, such as an adequacy decision or approved contract clauses. Email hello@trytoggled.com for the locations and safeguards that apply to your information.

Client photos and information

Your clinic decides which client photos to upload and why. We store them and analyse them with AI only to organise them and create the content your clinic asks for, not for Toggled’s own marketing. AI photo analysis is not a clinical assessment or a diagnosis.

Before uploading, you must hold the image rights and each client’s written consent to marketing use and AI processing by Toggled and its providers, including in the US. Before-and-after and practitioner content must use genuine photos you have chosen. Please do not upload medical records or anything that is not needed for the content.

How long we keep information

• Your workspace: account details, clinic profiles, campaigns, designs and uploaded photos stay while your account is open, unless you ask us to remove them. Photos do not expire automatically once a design is made.
• The waitlist: until launch updates finish or you unsubscribe. You can ask us to remove your entry at any time.
• Feedback: while we look into and resolve it.
• Security records: while needed to investigate faults, misuse or legal claims.
• Backups and provider logs: these follow each provider’s own retention cycle, so may last a short while after information is removed from your workspace.

During the beta, deletion of photos, projects and accounts is handled by hand: email hello@trytoggled.com with what you would like removed. A client should normally contact their clinic, which can ask us to remove that client’s information. Before the beta closes, we will explain how to download your work and request deletion. We may keep limited information where the law requires it, or to establish, exercise or defend legal claims.

Your rights

Subject to the law that applies, you can ask to access, correct, delete, restrict or receive a copy of your personal information, or object to certain uses. Where we rely on consent, you can withdraw it at any time.

Email hello@trytoggled.com to make a request; we aim to respond within one month. You can also complain to the data protection authority where you live or work: in Gibraltar, the Gibraltar Regulatory Authority; in the UK, the Information Commissioner’s Office.

Security and changes

We use access controls, private storage and account permissions designed to keep each clinic’s work separate. No online service can promise absolute security, so please use a strong, unique password and tell us straight away if you think your account has been compromised.

We may update this notice as Toggled develops. We will explain material changes through the service or by email where appropriate.