Ask most med spa owners how many programs it takes to get through a normal day, and the answer is usually “more than I would like.” There is one for booking, another for charts, a card reader with its own app, a texting tool, and a spreadsheet someone made three years ago that nobody wants to touch. Each one made sense when you bought it. Together, they make every day a little harder than it needs to be.

Here are the five tools we see spas patch together most often, the problems they cause, and what to look for when you are ready to replace them.

1. A booking app that does not know your rooms or machines

Many spas start with booking software made for hair salons. It is good at putting a name in a time slot. It is not good at knowing that a laser treatment needs a laser-safe room, a certain machine and a provider with the right license. So the front desk keeps those rules in their heads. When someone new is covering the desk, or it is a busy Saturday, mistakes slip through. A patient gets booked into the wrong room, or with a provider who cannot do the treatment, and you find out when they walk in.

2. A separate charting program

Next comes a charting program, often from a different company than the booking app. Now each patient lives in two places. Change a phone number in one, and the other never hears about it. Staff copy details back and forth, and every copy is a chance for a typo. Worse, the chart cannot see the schedule, so nothing reminds a provider that today’s patient still has not signed their consent form.

3. Paper or PDF consent forms

Plenty of spas still hand patients a clipboard, or email a PDF and hope it comes back. Signed forms get scanned, misfiled or lost. If you are ever asked to prove that a patient agreed to a treatment before it happened, you want to find that form in seconds, with the date and time it was signed. You do not want to dig through a filing cabinet.

4. A card reader and a separate texting app

Payments often run through one company’s card reader, while reminders and marketing texts go out through another. Neither knows what the other is doing. You cannot easily tell which texts actually led to a booked and paid visit, and your end-of-day numbers have to be pieced together by hand.

5. The spreadsheet that holds it all together

Finally, there is the spreadsheet. It tracks Botox lot numbers, package balances or which patients are due for a touch-up. It works fine until the one person who understands it goes on vacation. A spreadsheet also cannot warn you about anything. It just sits there until someone remembers to open it.

What the patchwork really costs

Each tool has its own monthly bill, but the bigger cost is time. Every switch between programs takes a few seconds. Every copy and paste is a chance for an error. Spread that across a front desk, a few providers and a manager, every single day, and it adds up to hours a week. It also means nobody has a clear picture of how the business is doing without building a report by hand.

What to look for in a real replacement

When you start looking at all-in-one systems, keep it simple. Ask these questions in every demo:

• Is it one patient record? When you update a phone number once, does it change everywhere?
• Does booking understand your rooms, machines and staff licenses, or does it just fill time slots?
• Can a provider start a chart before the consent form is signed? The right answer is no.
• Are lot numbers and units recorded as part of the chart, not in a separate log?
• Can you see which marketing led to booked, paid visits, in the same system?
• If you ever leave, how do you get your data out?

It also helps to ask how the system was built. Some platforms began as salon software and added medical features later. Others started as general medical records and added spa features on top. Neither is wrong, but you will feel the difference every day. Look for one that was designed around how a med spa actually runs.

How we approach it at NEON

We built NEON so the schedule, chart, consent forms, payments and marketing share one patient record. Booking checks the provider, the room and the machine. Charts stay locked until consent is signed. Lot numbers are part of the chart. And if your team would rather ask than click, they can do much of that work from the Claude or ChatGPT account they already use.

Running a salon rather than a med spa? NEON Salon is built for hair, nail, blow dry, waxing and tattoo businesses from the start, without the medical record you don’t need.

The questions above work no matter which system you choose, though. The goal is not more software. It is fewer places to look, and fewer things your team has to remember.

Every med spa software company talks about AI now. Some promise an “AI employee” that answers your phones and books your patients. Others say their AI helps your team work faster. Those sound alike. They are not, and the difference matters for your patients, your staff and your license.

Two very different ideas

An “AI employee” is a program that acts on its own. It answers messages, books appointments and sometimes makes decisions without anyone at your spa seeing them first. It usually has a name and a friendly personality, and it is sold as a replacement for a person.

AI your team controls works differently. Your staff ask it to do something, like look up a patient, find an open slot or draft a reply. It does the work quickly, and a person stays in charge of anything that matters. Think of it as a very fast assistant who never forgets where anything is, but who checks with you before anything important goes out.

Why this matters more in a med spa

A clothing store can let a chatbot answer questions about sizes. A med spa is different. Your messages may include health information. Your bookings depend on licenses and medical history. A wrong answer about aftercare, or a booking with the wrong provider, is not just awkward. It can hurt someone, or cause trouble with your state board.

That does not mean AI is off-limits. It means you need to know exactly what it can do on its own, and what it cannot.

Five questions to ask any vendor

• What can the AI do without a person approving it? Ask for a specific list, in writing.
• What can it never do? For example, sign a chart, prescribe or give a refund.
• Does each staff member’s AI only see what their job allows? A front desk employee should not reach clinical notes just because they asked the AI.
• Is there a record of everything the AI does? You should be able to see what it changed, for which patient, and who asked.
• Whose AI is it? Are you paying for the vendor’s own assistant, or connecting a tool your team already uses?

If a salesperson cannot answer these clearly, that is your answer.

Warning signs to watch for

• The AI is described mostly by its name and personality, not by its limits.
• You hear “it handles everything,” but nobody can tell you what “everything” means.
• Messages go out to patients with no chance for staff to look them over first.
• The vendor cannot explain what happens when the AI gets something wrong.

The “whose AI is it?” question

Many spas already pay for Claude or ChatGPT for their team. Some vendors ask you to pay again for their own built-in assistant. Others let you connect the AI account you already have to their system. There is no single right choice, but it is worth asking. Using a tool your staff already know usually means less training, and you are not stuck with one vendor’s assistant if a better AI comes along.

Try it before you trust it

In any demo, ask the salesperson to show you three things live: the AI doing an everyday task, the AI being stopped from doing something it should not do, and the record of what it did afterward. A good system will show all three without hesitation. If they only want to show you the first one, ask why.

What a good day with AI looks like

When AI is set up well, your team barely notices it. The front desk asks who still needs to sign a consent form for tomorrow, and gets a list in seconds. A provider between rooms asks which product and lot she used on a patient’s last visit. A manager asks how the week is tracking against the goal. Nobody is replaced. Everybody just spends less time clicking and searching, and more time with patients. That is the real promise of AI in a med spa, and it does not require handing over the keys.

How NEON handles it

NEON takes the second approach. We did not build an AI employee. Instead, your team connects their own Claude or ChatGPT account to NEON, and each person’s AI can only do what their job allows. We publish the list of what it can and cannot do. Signing charts, prescribing and refunds are always left to a person. When the AI drafts a text to a patient, a staff member is the one who sends it.

The bottom line

AI can save your team real time every day. But in a med spa, the most important question is not “how smart is it?” It is “who is in charge?” Choose a system where the answer is always your team.

In most states, a med spa needs a medical director or supervising physician. Part of that job is reviewing what happens in the treatment rooms and signing off on it. On a busy week, that review can shrink to a quick stack of signatures. That is when problems slip through, and they usually do not show up until an audit, a complaint or a patient who had a bad outcome.

Rules differ a lot from state to state, so always check yours and talk with your own legal and medical advisors. But here is what a good review should catch, almost anywhere.

1. The right person did the treatment

Was the treatment done by someone whose license allows it, under the right supervision? This sounds obvious, but it gets messy when staff cover for each other, or when a new treatment is added and nobody updates who is allowed to perform it. The review should confirm that each treatment matches the provider’s license and your written protocols.

2. An exam happened before the treatment

Many states expect a proper medical exam, sometimes called a good faith exam, before a treatment like Botox or filler. The chart should show who did it, when, and what they found. If the exam is missing, or dated after the treatment, that is a gap.

3. Consent was signed first, and it was the right form

A signature on a generic form is not enough. The consent should match the specific procedure, be the current version of your form, and be signed before treatment began. Consent signed after the fact, or a general form used for a laser treatment, are some of the most common problems reviewers find.

4. The chart is complete

For injectables, the chart should list the product, the number of units or syringes, the areas treated, the lot number and the provider. For devices, it should note the settings and the machine used. Before and after photos and aftercare instructions belong in the chart too. A chart that just says “Botox, forehead” will not hold up well.

5. Problems were written down and followed up

If a patient had a reaction, bruising beyond the usual, or called with a concern, the chart should show what happened and what the team did about it. Reviews should look for these notes, not just the routine visits.

The gaps reviewers find most often

• Consent forms signed after the treatment, or not at all
• Old versions of consent forms still in use
• Missing lot numbers or unit counts
• Chart notes that sat unsigned for weeks
• Protocols or standing orders that expired and were never renewed
• Staff licenses or certifications that lapsed without anyone noticing

Questions to ask your medical director

A good working relationship with your medical director makes review smoother for everyone. A few questions worth asking together:

• How often will you review charts, and how many?
• Which treatments need a co-signature, and how quickly?
• When were our protocols and standing orders last updated?
• What should staff do, and who should they call, if a patient has a problem after hours?
• What would you want to see first if our state board asked for records?

Write the answers down and keep them where your team can find them. When everyone knows the plan, fewer things fall through the cracks.

Making review easier, not just faster

The best fix is a system that prevents most of these gaps before the review even starts. That means a chart that cannot be started until the right consent is signed. It means a list of unsigned notes the medical director can work through each week, instead of a surprise pile at the end of the month. It means lot numbers recorded when the injection happens, not filled in later from memory. And it means changes to a signed note are added as a dated amendment, so the original record is never quietly rewritten.

This is how we designed NEON. Consent is checked before the chart opens. Unsigned notes show up on one list. Lot numbers are part of the chart. And co-signing stays with a person every time, because that signature means something.

A simple monthly habit

Even with good software, set aside time each month for a short spot check. Pick five charts at random and ask: right provider, exam first, right consent, complete chart, any problems followed up? If all five pass, great. If not, you have found something to fix before someone else finds it for you.

A medical director’s signature is a promise that care was safe and properly documented. With the right habits and a system that catches gaps early, that promise becomes much easier to keep, for your director, your providers and your patients.

Every box of Botox, filler or other injectable has a lot number printed on it. It is a short code that tells the manufacturer exactly which batch the product came from. Most days, nobody at a med spa thinks about it. Then one day a manufacturer, distributor or the FDA announces a recall or a safety notice for a specific lot, and suddenly it is the only number that matters.

On that day, you need to answer one question fast: which of our patients received this lot? If your answer is “let me look through the charts,” you are not ready yet.

What a lot number actually tells you

A lot number links a product to the time and place it was made. If a problem is found with that batch, the lot number is how everyone in the chain, from the manufacturer to your treatment room, finds the affected product and the people who received it. Without it, you may have to contact every patient who got that product over several months, which is stressful for them and for your team.

What you need to record, every time

• The product name
• The number of units or syringes used
• The lot number
• The expiration date
• The areas treated
• The provider who gave the injection
• The patient and the date

The key is recording this for each patient, at the time of the injection. Writing down one lot number for the whole day, or filling it in at the end of the week, is where tracking falls apart.

Where it usually goes wrong

The most common problem is that the box gets thrown away before anyone writes the lot number down. Another is a separate notebook or spreadsheet for lot numbers that does not connect to the patient chart. When a recall comes, someone has to match notebook entries to charts by date and hope nothing was missed. A third is opening a second vial halfway through a busy day and only recording the first one.

Start when the product arrives

Good tracking starts before the injection. When a shipment arrives, log each product with its lot number and expiration date. Then, when a provider uses it, they choose from what is actually on your shelf instead of typing the code from memory. This also helps you use older stock first and catch anything that is about to expire.

Run a recall drill

Here is a simple test you can do this week. Pick a lot number you used a few months ago. Time how long it takes your team to list every patient who received it, with dates and units. If it takes more than a few minutes, or the list is not complete, now is the time to fix your process, not on the day of a real recall.

Have a plan for contacting patients

If a recall does affect your patients, follow the instructions from the manufacturer and any guidance from the FDA, and talk with your medical director about next steps. Decide ahead of time who will call patients, what they will say, and how you will record that each patient was contacted. Calm, clear communication protects your patients and your reputation.

Expiration dates matter too

Lot numbers get the attention during a recall, but expiration dates matter every day. Using a product past its date is a problem even when there is no recall at all. When stock is logged with its expiration date as it arrives, your team can see what is about to expire, use it first, and pull anything that has passed its date before it ever reaches a treatment room.

Make it part of everyone’s routine

Tracking only works if every provider does it the same way, every time. Build it into your opening checklist, your new-hire training and your monthly chart review. Make the right way the easy way. If recording a lot number takes a dozen clicks, people will skip it on a busy day. If it is part of charting the injection, it simply gets done.

How NEON helps

In NEON, inventory is received with lot numbers and expiration dates, and each injection is charted with the product, units, lot and provider. The face map on the chart carries the same details. So when you need to find every patient who received a lot, you search once and get the list, not a weekend of paperwork.

Most spas will rarely face a recall. But the day you do, you will be glad the answer is one search away.

Take ten minutes this week to run the drill. Whatever you learn, you will be better prepared than you were yesterday, and your patients will be better protected.

In med spa marketing, a recall campaign simply means reminding patients that it is time for their next visit. It is one of the most useful things you can send, because these patients already know and trust you. The trouble is that many spas send the same message to everyone on their list at the same time. That is not a recall. That is a blast, and patients can tell the difference.

Why visit history makes the difference

Your patients do not all need the same thing at the same time. Someone who had a neurotoxin treatment ten weeks ago is in a very different spot than someone who finished a series of laser treatments last month, or someone who bought a package and still has two sessions left. When your reminders are based on what each person actually had done, and when, the message lands at the right moment and feels like it was written for them.

Match the timing to the treatment

Different treatments have different natural return times. Many neurotoxin patients come back every few months. Filler usually lasts longer. Facials and skin treatments are often monthly. Series treatments, like microneedling or laser, have a set number of sessions spaced weeks apart. Work with your providers to set a sensible reminder window for each service, and let the schedule do the counting instead of a spreadsheet.

Ideas that work well

• A reminder a couple of weeks before a treatment usually wears off, with a link to book
• A note to patients with unused package sessions before the package expires
• A check-in after the last session of a series, asking how they feel about their results
• A thank-you after a first visit, with a simple way to book the next one
• A gentle “we miss you” for patients who have not been in for a long time

Keep it personal, short and private

Use the patient’s name and mention the service in general terms, like “your next appointment” or “your skin treatment.” Be careful with health details, though. Texts and email previews can be seen by other people, so keep specific treatment information out of subject lines and the first line of a text. Keep messages short, with one clear way to book.

Respect consent and opt-outs

Only text patients who have agreed to receive texts from you, and make it easy to stop. Honor opt-outs right away, everywhere. Healthcare marketing has its own privacy rules, so check with your compliance advisor about what you can send and how. A reminder should never be the reason a patient stops trusting you.

Measure bookings, not opens

It is tempting to judge a campaign by how many people opened it. What really matters is how many people booked, showed up and paid. Look for a system that can connect a reminder to the visit that followed. Over time, you will learn which messages and timing actually bring patients back, and you can stop sending the ones that do not.

Do not overdo it

More messages do not mean more bookings. If a patient gets several texts a week, they will tune you out or opt out. A few well-timed, relevant reminders will do more than a constant stream of specials.

A simple example

Picture a patient who comes in for neurotoxin every few months. About two weeks before she would usually start to notice it wearing off, she gets a short text: “Hi Maria, it is almost time for your next visit with Dr. Ana. Tap here to pick a time.” No coupon, no long story, just a helpful nudge at the right moment. If she has not booked a week later, one gentle follow-up email goes out, and then the messages stop.

Start small

You do not need ten campaigns on day one. Start with one or two of your most popular treatments, set the timing with your providers, and watch the results for a couple of months. Once you see what works, add the next one. Small, steady improvements beat a big launch that nobody keeps up with.

How NEON helps

Because NEON keeps marketing and the patient record in one place, you can build reminder lists from real visit history, like everyone whose last neurotoxin visit was a few months ago and who has no upcoming appointment. Campaigns are prepared for a staff member to review before they go out, and results are measured in booked visits, not just clicks.

Whatever system you use, the idea is the same: send the right reminder, to the right patient, at the right time. Your patients will notice.

Start with one treatment this month, keep the message short, and see what happens. You may be surprised how many patients were just waiting for a reminder.

When you look at software for med spas today, you will meet a lot of AI assistants with names. They have friendly avatars, cheerful greetings and sometimes their own job titles. It is a smart way to make technology feel approachable. When we started building NEON, we talked about doing the same thing. In the end, we decided not to.

A name makes it sound like a person

When software has a name, people start to treat it like a coworker. That can be fine for scheduling a haircut. In a med spa, it can blur an important line. If “Sophie” sends a patient a message, who is responsible for what it said? If “Max” moves an appointment, who decided that was okay? Your patients deserve to know that a real person at your spa is in charge of their care and their information.

We wanted that line to stay sharp. So instead of building a character, we focused on building clear rules.

Your team already has an AI

The other reason was simpler. Many med spa teams already use Claude or ChatGPT every day, to write emails, plan social posts or answer questions. They know how to talk to it. Asking them to learn a second, separate assistant inside their EMR, and paying for it on top, did not make much sense to us.

So we built the opposite. NEON connects to the Claude or ChatGPT account your team already uses. A provider can ask about tomorrow’s schedule from their phone. A manager can check yesterday’s revenue from the couch. The AI is the one they already know. NEON supplies the patient record and the rules.

Rules you can actually read

Without a mascot to lean on, we had to be clear about what the AI can and cannot do. We publish that list. Each person’s AI can only do what their job allows, so a front desk employee and a provider get different access. Anything that changes a record happens only when a staff member asks. And some things are always left to a person, like signing a chart, prescribing, or giving a refund. When the AI drafts a text to a patient, someone on your team sends it.

We think that is what trust looks like in healthcare. Not a friendly face, but clear limits you can check.

What we gave up

This choice has trade-offs, and we want to be honest about them. A named assistant is easier to show off in a demo. It looks impressive when it chats away on its own. Our approach is quieter. Your team asks, the AI does the work, and a person stays in charge. It also means you use your own Claude or ChatGPT account, which those companies bill separately, and there is a short setup to connect it.

For some spas, a fully hands-off AI might feel like the better deal. For a business where a wrong message or a wrong booking can affect someone’s health, we believe a person should always be in the loop.

Questions we hear a lot

Owners often ask whether the AI can see everything in the EMR. It cannot. It sees only what the person asking is allowed to see in their job. Others ask what happens if the AI gets something wrong. That is exactly why anything that reaches a patient, money or the chart waits for a person to say yes, and why every action is recorded with who asked for it. And many ask whether they have to use AI at all. They do not. NEON works as a full EMR on its own. The AI is simply another way in.

What it looks like day to day

In practice, it feels less like talking to a robot and more like having a very fast assistant who knows where everything is. “Is anyone missing a consent form for tomorrow?” “Move my 3 PM to Friday and draft a text to let her know.” “Which lot did we use on her last visit?” The answers come back in seconds, from the same record your team uses at the front desk. And if you would rather just click through the EMR yourself, that works too.

Built around people

NEON was designed by a nurse practitioner who runs med spas, for the providers and staff who keep them going. That is why the AI does not have a name. The people in your spa already do.

If you are comparing systems, we hope you will look past the friendly names and ask the harder question: who is in charge? At NEON, we built the answer into the product. It is always your team.

These Terms of Use (“Terms”) govern access to and use of the NeonData platform, including the NEON EMR + Aesthetics Ops, EMR MCP, and Shared IQ MCP products (together, the “Service”), provided by NeonData LLC (“NeonData,” “we,” “us”). By creating an account or using the Service, you agree to these Terms on behalf of yourself and, where applicable, the clinic or business you represent (“Customer”).

1. Eligibility & Account Registration

The Service is intended for licensed medical spas, aesthetic practices, and related businesses, and the individuals authorized by them. You must provide accurate registration information and are responsible for activity that occurs under your credentials.

2. Subscription, Fees & Payment

Access to the Service is provided on a subscription basis as set out in your order form. Fees are billed in advance and are non-refundable except as required by law or expressly stated in your agreement with NeonData.

3. Acceptable Use

• Use the Service only for lawful business purposes connected to operating a medical spa or aesthetic practice.
• Do not attempt to reverse-engineer, resell, or provide unauthorized third parties access to the Service.
• Do not use the Service to store or transmit content you do not have the right to use.

4. Patient Data & HIPAA

Where Customer uses the Service to create, receive, maintain, or transmit protected health information, that use is governed by a Business Associate Agreement (“BAA”) between NeonData and Customer. Customer remains responsible for its own compliance obligations as a covered entity or business associate under HIPAA and applicable state law.

5. Your Own AI Seats & MCP Access (EMR MCP, Shared IQ MCP)

EMR MCP and Shared IQ MCP allow Customer to connect a third-party AI seat (for example, a Claude or ChatGPT account that Customer separately licenses) to the Service under role-based permissions configured by Customer. NeonData is not responsible for the third-party AI provider’s own terms, availability, or output. Customer is responsible for the permission scopes it assigns to each connected seat and for reviewing AI-suggested actions before they are treated as final where NeonData indicates human review is required.

6. Intellectual Property

NeonData retains all rights, title, and interest in the Service, including its software, design, and documentation. Customer retains all rights to its own data, including patient records, entered into the Service.

7. Disclaimers & Limitation of Liability

The Service is provided “as is.” The Service supports clinical documentation and business operations but does not replace clinical judgment. To the maximum extent permitted by law, NeonData’s aggregate liability arising out of these Terms is limited to the fees paid by Customer in the twelve months preceding the claim.

8. Termination

Either party may terminate for material breach not cured within thirty days of written notice. Upon termination, NeonData will make Customer data available for export for a reasonable period as described in your order form.

9. Governing Law

These Terms are governed by the laws of the State of Arizona, without regard to conflict-of-law principles. Any disputes arising under these Terms shall be resolved exclusively in the state or federal courts located in Pima County, Arizona.

10. Changes to These Terms

We may update these Terms from time to time. Material changes will be communicated by email or in-product notice before taking effect.

11. Contact

Questions about these Terms can be sent to legal@neondata.co.

12. Text Messaging (SMS) Terms

NeonData EMR includes a patient communications feature through which participating clinics send text messages to their patients, such as appointment reminders, confirmations, and other care-related notifications. If you opt in to receive text messages from a clinic that uses NeonData, the following terms apply:

• Consent. You will only receive messages if you provided your phone number and agreed to receive text messages, either directly to the clinic or through its booking and intake process. Consent to receive text messages is not a condition of purchasing any goods or services or of receiving treatment.
• Message frequency varies based on your appointments and interactions with the clinic.
• Message and data rates may apply. Any such charges are billed by your mobile carrier.
• Opt out at any time by replying STOP to any message. You will receive one final message confirming your opt-out, after which no further messages will be sent to your number. You may also ask the clinic directly to remove your number.
• Help. Reply HELP to any message for assistance, contact the clinic that sends your messages, or email legal@neondata.co.
• Carrier liability. Mobile carriers are not liable for delayed or undelivered messages.

How mobile information is collected, used, and protected is described in Section 12 of our Privacy Policy, including our commitment that mobile information is never shared with third parties for marketing purposes.

NeonData LLC (“NeonData,” “we,” “us”) is committed to protecting the privacy of everyone who interacts with our website, our products, and our team — visitors, prospective customers, the clinics and businesses that subscribe to NEON (“Customers”), and Customers’ own patients (“Guests”). This notice explains what personal data we collect, why, and the choices available to you.

Personal data we collect

• Site visitors and prospects: name, email, phone, and company details submitted through forms such as Contact or Request a Demo.
• Customer users: account credentials, role and permission settings, and usage logs needed to operate the Service, including EMR MCP and Shared IQ MCP access.
• Guest data: where Customer uses NEON to store patient information, NeonData processes that data as a service provider / business associate on Customer’s behalf, under the terms of our Business Associate Agreement — not as the data controller.

How we use personal data

• To provide, maintain, and improve the Service.
• To respond to inquiries submitted through Contact, Get Support, or Careers.
• To send product updates and, where you’ve opted in, marketing communications.
• To meet legal, security, and compliance obligations.

Sharing of information

We do not sell personal data. We share data with subprocessors who help us operate the Service (such as cloud hosting and payment processing providers) under contractual confidentiality and security obligations, and with regulators or law enforcement where required by law.

Data security

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the data we handle, including encryption in transit and at rest, role-based access controls, and audit logging. See our Trust Center for more detail on our security and compliance posture.

Data retention

We retain personal data for as long as needed to provide the Service and to meet legal, accounting, or reporting obligations, after which it is deleted or anonymized.

Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal data, and to object to certain processing. To exercise these rights, contact us using the details below. If your data was submitted to us by a NEON Customer (for example, as a patient of a clinic that uses NEON), please contact that Customer directly, as they control how their patient data is used.

Cookies

Our website uses cookies and similar technologies as described in our Cookie Notice.

Children’s privacy

Our website and marketing are not directed to children, and we do not knowingly collect personal data from children.

International data transfers

Personal data may be processed in the United States. Where required, we rely on appropriate safeguards for any cross-border transfer of personal data.

Changes to this notice

We may update this notice from time to time. Material changes will be posted on this page with an updated effective date.

Google API Data

NeonData's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Google data is used only to provide and improve user-facing features of the Service
• Google data is not used to serve advertising
• Google data is not transferred to third parties except as necessary to provide the Service
• No human reads your Google data except with your explicit permission for support purposes

Intuit QuickBooks Data

When an account administrator connects QuickBooks Online, NeonData (doing business as PUZL) receives access to that company’s accounting data through Intuit’s API. We read reports and records only: profit and loss (by month and by day), balance sheet, cash flow, accounts receivable and payable aging, open invoices and bills, payments, and the chart of accounts. These include the names of customers and vendors that appear on invoices, bills and aging reports. We never create, change or delete anything in QuickBooks.

• QuickBooks data is shown only to administrators of the account that connected it. Location-level users and other customers cannot see it.
• It is used only to provide the reporting features of the Service, including answers from an AI assistant that you connect to your own account through our MCP server.
• It is not sold, not used for advertising, and not used to train artificial-intelligence models.
• It is not transferred to third parties except the infrastructure providers that host the Service.
• No person at NeonData reads it except with your permission, for support.
• The access credentials Intuit issues are encrypted at rest.

QuickBooks data stays in your account while QuickBooks is connected, and after a disconnect, until you choose Remove. Removing QuickBooks under Integrations deletes the QuickBooks data we copied, including stored backup versions, within one day.

12. Mobile Information and Text Messaging

When a clinic using NeonData EMR enables patient text messaging, we process patient phone numbers, opt-in consent records, and message content on behalf of that clinic, solely to deliver the messages the clinic initiates — such as appointment reminders, confirmations, and other care-related notifications.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, excluding aggregators and providers of the text-message services, and only to the extent necessary to deliver the messages you have consented to receive.

You can opt out of text messages at any time by replying STOP to any message, or by contacting the clinic that sends them. Reply HELP for assistance. Message and data rates may apply, and message frequency varies. Full messaging terms are in Section 12 of our Terms of Service.

How to Delete Your Data

You can remove your data from NeonData at any time. There are two steps, and you can do either independently.

1. Disconnect the source. Sign in at https://app.puzldata.com/portal, open your account page, find the connected source under Data Sources, and choose Disconnect. This immediately deletes the stored access credentials for that source and stops all further data collection. You can do this yourself, without contacting us.

2. Request deletion of data already collected. Email privacy@neondata.co from the address associated with your account, stating which account and which source you want erased. We delete the corresponding records within 30 days and confirm by email.

Facebook and Instagram. For data obtained through a connected Facebook Page or Instagram Business account, you may additionally revoke NeonData's access directly from Facebook: go to Settings & Privacy → Settings → Business Integrations, select NeonData, and choose Remove. Revoking access there stops future collection; email us as described above to also erase data already stored.

QuickBooks. Under Integrations, choose Remove on QuickBooks. This revokes our access at Intuit and deletes the QuickBooks data we copied, including stored backup versions, within one day. Disconnecting from inside QuickBooks Online also stops further collection, but data already copied stays until you choose Remove or email us as described above.

Deleting an account removes its ingested source data, stored credentials, and derived reporting. We may retain limited billing and audit records where required by law.

Contact us

Questions about this notice can be sent to privacy@neondata.co.

This notice explains how NeonData uses cookies and similar technologies on our website, and the choices available to you.

What are cookies

Cookies are small text files placed on your device when you visit a website. They help the site function, remember your preferences, and understand how the site is used.

How we use cookies

• Essential: required for core site functionality, such as navigation and secure areas of the site. These cannot be switched off.
• Performance: help us understand how visitors use our site, so we can improve it.
• Functional: remember choices you make, such as form progress, to provide a more personalized experience.
• Targeting: used to measure the effectiveness of our marketing, where enabled.

Third-party cookies

Some cookies are placed by third-party services we use for analytics and marketing. These providers have their own privacy and cookie policies.

Managing your preferences

Most browsers let you refuse or delete cookies. Doing so may affect the functionality of parts of our site.

Changes to this notice

We may update this notice from time to time, with the effective date revised accordingly.

Contact us

Questions about this notice can be sent to privacy@neondata.co.