GlowUp Logic Privacy Policy

Effective 2026-10-26. This is the public version.

GlowUp Logic is software that helps therapy and home-health clinics build schedules, bill insurance, and plan their cash. This page says what we collect, why, who sees it, and how you can control it. We wrote it to be read.

Who we are

GlowUp Logic ("we") is run by Adam Silver, Founder. Contact for anything in this policy: adam@silverpeak-consulting.com.

What we collect

We collect data from our customers, who are clinics. We do not collect data from the general public and we do not run ads or trackers.

• Account data. Names, work emails, and roles of the clinic's staff who use the product. Passwords are stored only as salted hashes.
• Clinic operations data. Schedules, staff availability, clients' appointments and insurance authorizations, claims, and payments. Some of this is protected health information (PHI). We handle it for the clinic as its service provider, under a business associate agreement (BAA) where the law requires one. We use it only to run the clinic's service.
• Bank data, if the clinic owner links a bank. Through Plaid we read the account name and type, balances, and transactions (up to 730 days back, about two years) for the business account the owner picks. We use this to build the clinic's cash plan. We never see or store the bank password. The link is read-only: we cannot move money.

How a bank link works, and your consent

Only a clinic owner or administrator can link a bank. Patients and clients never see this step. The owner opens a Plaid Link page, chooses their bank, signs in on the bank's own screens, and picks the account. We record who agreed and when.

By linking, you agree to Plaid's End User Privacy Policy (https://plaid.com/legal/#end-user-privacy-policy). Plaid handles your bank sign-in and shares the data above with us.

To stop it: tell us at the contact above, and we disconnect the link and delete the data as described below. You can also remove our access at your bank or at https://my.plaid.com.

Why we use it

• To run schedules, billing, and the cash plan for the clinic that signed up.
• To keep the product safe and fix problems.
• We do not sell data. We do not use bank data or PHI for advertising. We will not use customer data to train AI models.

Who we share it with

Only the helpers we need, and only what each needs:

• Plaid, for the bank link.
• Availity, for checking insurance and sending claims, for the clinic that asks us to.
• Our hosting provider, which stores the data and runs the product.
• An AI service (Anthropic), only if a clinic turns on the optional payment-statement reader. A business associate agreement with that vendor is signed before any clinic turns the feature on. It receives only paper statements that a clinic uploads as images. Bank data from Plaid is never sent to any AI vendor.

We share data with the authorities only if the law requires it.

How long we keep it

Full detail is in our Data Retention and Deletion Policy. In short:

• Bank data: kept while the link is active, with up to 24 months of history. When a link ends, the access token is deleted immediately and the stored bank data within 30 days.
• Health and billing records: kept at least 7 years, because the law asks clinics to keep records.

How we protect it

• Each clinic's data is walled off from every other clinic's in the database.
• Staff roles limit who sees what. Administrators must use a second factor (an authenticator app) to sign in to admin screens.
• Connections to Plaid use HTTPS. Bank access keys are kept out of our code and database.
• Every change is recorded in an audit trail.
• Application-level encryption of Plaid access tokens is in progress, due 2026-10-31.

No system is perfect. If your data is exposed, we tell the affected clinic and Plaid within 72 hours of confirming it.

See our Security overview.

Your choices

A clinic can ask to see, export, correct, or delete its data, or to disconnect a bank, at any time. We answer within 10 business days. People who are clients of a clinic should ask the clinic first, since the clinic controls their records.

Changes

If we change this policy in a way that matters, we update the date above and tell clinic owners by email.