A way in.
Use an emailed code or a password. Choose the right business when you work at more than one.
Account access & security
Your account. Your access.
Understand how sign-in works, recover access when you need it and bring us your security questions.
A way back.
Request a password reset. Completing it ends earlier sessions on your devices.
A clear boundary.
We do not claim SOC 2 or ISO 27001 certification or HIPAA compliance, or offer a Business Associate Agreement.
Account controls
Sign-in and recovery, explained.
Choose how to sign in
Use an emailed six-digit code or your email and password. If you work at several businesses, choose which to open. Google or Apple sign-in requires a linked identity or a confirmed matching account email.
Code and password retry limits
Ordinary wrong-password or unknown-account sign-in attempts receive the same answer. Password attempts pause after ten wrong tries in 15 minutes; password reset stays available. The pause for that email ends with the 15-minute window. A code works once for ten minutes, is replaced by a newer code, and stops after five wrong attempts. Resends are limited to once a minute and five in 30 minutes.
Keep the session predictable
Stay signed in across reloads and browser tabs, for at most seven days. Completing sign-out ends that browser sign-in across its tabs.
How sessions are handled
The web session uses a cookie page scripts cannot read, without renewal credentials in browser storage. Reusing an already renewed sign-in ends that sign-in and records an event. Opening a reset link removes its secret from the address bar.
Recover your account
Reset requests use the same answer for unknown accounts. Request a reset email, or send one from a team member’s record. Its link works once for 24 hours; setting a new password ends earlier sessions on every device. After resetting, continue into your account or business choice. Use 15–128 characters, including spaces, with no required symbol mix; common breached passwords are refused.
The same account on iPhone
On iPhone, sign in with the emailed code or password. The session stays in the keychain when the app closes; signing out from your profile stays signed out after reopening. The same seven-day limit applies.
Report a concern
Tell us what you found.
Include the affected page and steps to reproduce the problem. Leave passwords, payment details and client information out of the first message.
Questions about trust
Know the boundaries.
Is EstheticSense SOC 2 or ISO 27001 certified?
No. EstheticSense does not currently claim SOC 2 or ISO 27001 certification. We will update this page only after a certification is complete and the public statement has been reviewed.
Is EstheticSense HIPAA compliant?
We do not make that claim, sign Business Associate Agreements, or make a practice compliant. EstheticSense is positioned for light-medspa operations, not as a hospital-grade clinical EHR.
What should stay outside EstheticSense?
Diagnosis, prescribing, procedure management, clinical decision support, licensure verification, and other clinical-authority workflows should remain in the systems and hands responsible for them.
Where can I review privacy and retention terms?
The Privacy Policy is the public reference for data categories, purposes, retention, and user choices. Contact us when procurement requires a more specific review.
How do I report a security concern?
Email support@estheticsense.io with the affected surface and clear reproduction details. Avoid including unnecessary personal or sensitive information in the first message.
Ready to evaluate?
Have a specific requirement?
Tell us which control or data-handling question your business needs reviewed.