Privacy Policy

This policy explains what information the American Institute of Modern Trichology ("AIMT," "we") collects when you use our websites and courses, how we use it, and the choices you have. The short version: we collect what's needed to run your courses and nothing more, and we don't sell your data.

1. What we collect

Account information. Your email address, the name you provide for your certificate, and a securely hashed password, stored with our authentication provider (Supabase).

Course progress. Which modules and checkpoints you've completed, your answers to course checkpoints, and your study state, so your progress follows you across devices.

Cadence conversations. Messages you exchange with Cadence, our AI study companion, including the learning context Cadence keeps to personalize your experience. These are processed by our AI provider (Anthropic) to generate responses.

Payment information. Payments are processed entirely by Stripe. We never see or store your card number — we receive only confirmation of purchase, your email, and the purchase details needed to grant course access.

Readiness Profiles. If you submit the optional Head Spa Readiness form, we securely store your first name, email, readiness score, category scores, priority area, and whether you opted in to education or certification updates. This is separate from anonymous website measurement. Your individual question answers are not stored in our lead database. We use your email to deliver the results you requested. Promotional follow-ups are limited to people who checked the optional marketing box.

Technical logs. Basic operational events (sign-ins, purchases, errors) used to keep the platform reliable and secure.

Website measurement. Our own first-party measurement records a small set of events when you use our pages — for example that a page was visited, that the Readiness Score was started or completed, or that checkout began — together with a random identifier stored in your browser, the campaign tags in the link you arrived from (such as utm_source), and the domain of the site that referred you. For enrolled students, it also counts whether course tools such as the Smart Service Sidekick and downloadable resources are used. It never includes your Readiness answers, course or checkpoint answers, Cadence conversations, your name or email address, or your IP address, and it is not shared with advertising platforms.

2. How we use it

To deliver your courses, sync your progress, power Cadence, issue and verify certificates, provide support, process payments and refunds, keep the platform secure, and understand in aggregate which of our content and campaigns bring people to AIMT. If you submit a Readiness Profile, we also save it to deliver your requested results and, only with your opt-in, contact you about practitioner education and certification opportunities. That's the list. We do not sell or rent personal information for third-party advertising.

3. Who we share it with

Only the service providers that make the platform work: Supabase (accounts and course data), Stripe (payments), Cloudflare (hosting and delivery), Anthropic (AI responses for Cadence), and Vimeo (video delivery), and Resend (transactional email delivery). Each receives only what it needs for its function. We may also disclose information if required by law.

4. Cookies and local storage

We use browser storage to keep you signed in, to cache your course progress locally, and to hold the random first-party measurement identifier and campaign tags described in section 1. Cloudflare, our hosting provider, also records cookie-free, aggregate page-load and performance statistics. We do not use advertising cookies, advertising or marketing pixels, or cross-site trackers. If your browser sends a Global Privacy Control or Do Not Track signal, our own website measurement is switched off. If we ever add advertising or other third-party analytics tools, we will update this policy before they are enabled.

5. Certificate verification

When you complete a course, we create a completion record with your certificate name, course, completion date, and a unique credential ID. Anyone with your credential ID can confirm those details through our public verification page — the same information a paper certificate would show. If you'd prefer your credential not be publicly verifiable, contact us.

6. Retention

We keep your account and course data while your account is active, so your lifetime course access and credentials keep working. If you ask us to delete your account, we will remove your personal data, except records we're required to keep (such as purchase records for tax purposes) and credential records needed to preserve certificate integrity, which can be anonymized on request. We also retain submitted Readiness Profiles for delivery and follow-up purposes, and you may request their deletion or withdraw marketing consent by contacting us.

7. Your rights

You may request a copy of your personal data, correct inaccurate data, or request deletion by contacting us. If you are in a region with specific privacy rights (such as the EU/UK or California), we will honor the rights those laws provide.

8. Security

Data is encrypted in transit, access to student data is restricted through row-level security, and payment handling is delegated entirely to Stripe. No system is perfectly secure, but we design so that a problem in one layer doesn't expose everything.

9. Age

Our services are for adults. We do not knowingly collect information from anyone under 18.

10. Changes and contact

We'll post any updates to this policy here with a new date. Questions or requests: [email protected].