Privacy Policy

Last updated: August 5, 2026

1. Who We Are

Apex Reactivation ("we," "us," "our") is a sole trader business operated by Robert Thompson, based in the United Kingdom, providing performance-based dormant patient/lead reactivation services to cosmetic and aesthetic clinics located in Florida, United States.

2. Our Role: We Are a Data Processor, Not a Data Controller

When you engage Apex Reactivation, we act as a data processor on behalf of your clinic, who remains the data controller of your patients' personal information.

This means:

  • Your clinic is responsible for having a lawful basis and appropriate consent to collect and share patient contact information with us in the first place.

  • We only use the personal data you provide us for the specific purpose of dormant patient outreach and reactivation, strictly on your documented instructions, and will not use it for any other purpose — including our own marketing or promotional activities.

  • We do not sell, rent, or independently repurpose any patient data we process.

• A signed Data Processing Agreement (DPA) must be in place between Apex Reactivation and your clinic before any patient data is shared with us or processing begins.

3. What Data We Process

To deliver our service, we process the following categories of data provided by your clinic:

  • Patient/lead names

  • Phone numbers (mobile, for SMS/WhatsApp outreach)

  • Basic treatment or visit history flags relevant to identifying "dormant" status (e.g., last visit date, treatment type), where provided

  • Message engagement data generated during outreach (delivery status, replies, opt-outs)

We do not request or require sensitive health records, medical charts, or clinical notes. If such information is inadvertently included in data provided to us, we will flag this to the clinic and request it be removed from future exports.

4. How Data Flows Through Our Systems

Our outreach process works as follows:

  1. Your clinic provides us with a list of dormant patient contacts.

  2. That list is processed through our automation platform (currently Pabbly) to route contacts into our messaging systems.

  3. Outreach messages are sent via Twilio (SMS) and the WhatsApp Business API (via Meta) on your clinic's behalf.

  4. Patient replies and engagement are used solely to manage the outreach campaign and report results back to your clinic.

Important note on data retention by our service providers: While we do not maintain a standalone patient database ourselves, the third-party platforms we rely on to deliver this service — Pabbly, Twilio, and Meta (WhatsApp Business API) — may retain logs of messages and contact data (including names, numbers, and message content) for a period of time in accordance with their own privacy and retention policies, independent of our instructions. We select reputable providers and, where possible, configure settings to minimize retention, but we do not control these providers' underlying infrastructure or default log retention periods.

Links to our providers' privacy policies:

These providers act as our subprocessors. We will update this list if we change providers.

5. Legal Basis for Processing (UK/EU Context)

Where UK GDPR applies to us as a processor, we process personal data only on the documented instructions of the data controller (your clinic), in line with Article 28 of the UK GDPR.

6. US Patients and TCPA Compliance

Because our outreach targets patients located in the United States via SMS and WhatsApp, the Telephone Consumer Protection Act (TCPA) applies. Your clinic warrants and confirms, as a condition of using our service, that:

  • Prior express written consent has been obtained from each patient to receive automated or marketing text messages, where required under TCPA.

  • Patients have a clear and functioning way to opt out of communications, and we will honor all opt-out requests immediately and permanently.

  • The contact list provided to us has been lawfully compiled and does not include patients who have previously opted out or are on a do-not-contact list.

We are not responsible for verifying the original consent obtained by the clinic, but we will not knowingly message any contact flagged as opted-out or non-consenting.

7. How Long We Keep Data

We do not retain patient contact lists beyond the duration of an active outreach campaign, plus 30 days for reporting and reconciliation purposes, after which data is deleted from any systems under our direct control. Retention by third-party providers (Pabbly, Twilio, Meta) is governed by their own policies, as noted in Section 4.

8. Data Security

We take reasonable technical and organizational measures to protect data in transit and while under our instruction, including relying on providers with industry-standard security practices. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Patient Rights

Patients whose data we process on behalf of a clinic may exercise their data rights (access, correction, deletion, objection) by contacting their clinic directly, as the data controller. We will support and cooperate with the clinic in fulfilling any such request that relates to data we hold or have processed.

10. International Data Transfers

As a UK-based processor handling personal data of US patients on behalf of US clinics, data is transferred between the United Kingdom, the United States, and the countries in which our subprocessors (Pabbly, Twilio, and Meta) operate. We rely on the documented instructions of the controller and the contractual and technical safeguards provided by our subprocessors. Where required, we will enter into appropriate transfer mechanisms.

11. Changes to This Policy

We may update this Privacy Policy from time to time as our processes, providers, or legal obligations change. The "Last updated" date at the top of this page reflects the most recent revision.

12. Contact Us

For questions about this Privacy Policy or how we handle data, contact: contact@apexreactivation.com