01 · Certifications
No badge before the audit.
We do not claim SOC 2, ISO 27001, HIPAA certification, “bank-grade,” or “military-grade” security.
Security · Public posture
Security, without borrowed credibility.
We name the certifications we do not hold, keep clinical authority out of the product story, and publish deeper control claims only after they pass review.
02 · Clinical boundary
Tools, not clinical authority.
EstheticSense does not diagnose, prescribe, direct treatment, verify licensure, sign BAAs, or make a practice compliant.
03 · Current review
Control detail is being certified.
Encryption, authentication, hosting, administrative logging, payment architecture, and response-process statements stay off this page until their exact launch evidence is accepted.
A useful review path
Ask the question. Get the current answer.
Security posture changes over time. Procurement and technical reviewers should request the current, scoped answer instead of relying on an old marketing badge.
- 01
Start with the public boundary.
Read this page and the Privacy Policy for the claims EstheticSense is prepared to make publicly.
- 02
Name the requirement.
Tell us the control, data category, jurisdiction, or procurement question your team needs reviewed.
- 03
Keep the answer scoped.
We will distinguish current evidence, a product boundary, and work that is still in certification.
Responsible reporting
Found a security concern?
Send the affected surface and clear reproduction steps. Do not include passwords, full payment data, or unnecessary client information.
security@estheticsense.com Security FAQ
Plain answers to the first questions.
Is EstheticSense SOC 2 or ISO 27001 certified?
No. EstheticSense does not currently claim SOC 2 or ISO 27001 certification. We will update this page only after a certification is complete and the public statement has been reviewed.
Is EstheticSense HIPAA compliant?
We do not make that claim, sign Business Associate Agreements, or make a practice compliant. EstheticSense is positioned for light-medspa operations, not as a hospital-grade clinical EHR.
What should stay outside EstheticSense?
Diagnosis, prescribing, procedure management, clinical decision support, licensure verification, and other clinical-authority workflows should remain in the systems and hands responsible for them.
Where can I review privacy and retention terms?
The Privacy Policy is the public reference for data categories, purposes, retention, and user choices. Contact us when procurement requires a more specific review.
How do I report a security concern?
Email security@estheticsense.com with the affected surface and clear reproduction details. Avoid including unnecessary personal or sensitive information in the first message.
Current, scoped answers
Bring your real security question.
We will answer from current evidence and say when a requirement is outside the product boundary.