Privacy Policy
Last updated: October 13, 2026
This page explains what we collect from people who visit this site, book a call or contact us, and what we do with it. The site uses one tracking tool, Google’s ads tag, to measure which ads lead to booked calls. We don’t sell personal information.
Who we are and what this covers
In and Out Digital (“we,” “us”) runs Full Chair, a Google Ads service for med spas in the United States.
This policy covers people who visit this website, book a call with us or contact us by email or phone.
Med spas that hire us trust us with some of their callers’ information, such as call recordings. We handle that data on the spa’s behalf, under our services agreement and a business associate agreement (BAA) with the spa. It has its own section below.
Our Terms and Conditions cover the use of this site. If your spa becomes a client, the written services agreement and BAA govern our services.
What we collect
The site has no sign-up or contact forms. Here is what we collect, where it comes from and why.
| Source | What | Why |
|---|---|---|
| Visiting this site (server logs) | Your IP address, browser and device type, the page you asked for (including any campaign tags in the link), the page that sent you, and the date and time. | Our web host records this automatically to deliver pages and keep the site running and secure. |
| Google Ads tag | Cookies and identifiers that Google uses to recognise whether you arrived from one of our Google ads and whether you then booked a call. Google also receives your IP address and browser details. | To measure which ads lead to booked calls. Details and opt-outs are in section 5. |
| Campaign tags saved in your browser | The campaign tags from the link you arrived on (utm_source, utm_medium, utm_campaign, utm_term, utm_content), and a note that you booked a call, kept in your browser’s session storage until you close the tab. | So that if you book, Calendly records which ad or campaign brought you, and so the site doesn’t count the same booking twice. |
| Booking a call on Calendly | Your name, email address, the time you pick, your time zone, your answer to the booking question and the campaign tags above. The calendar appears on our page once you answer the ad-spend question; until then nothing is sent to Calendly. | To hold the call, confirm it with you and prepare for it. |
| Google Fonts | Google receives your IP address and browser details when your browser downloads our typefaces. | So the text shows in our typefaces. |
| Vimeo | The founder video plays through Vimeo’s player. Vimeo receives your IP address and browser details when the player loads. We use Vimeo’s “do not track” setting, so Vimeo doesn’t build a viewing profile from it. | To show the video. |
| Email and phone | Your email address or phone number, and whatever you tell us. | To reply and follow up. |
Google, Calendly and Vimeo are separate companies. Their own privacy policies also apply when you use them.
How we use it
- To answer your emails and calls.
- To hold the calls you book and prepare for them.
- To see which ads and campaigns lead to booked calls, so we spend our own ad budget well.
- To keep the site working and secure.
- To follow up with you about Full Chair after you contact us. Ask us to stop at any time and we will.
- If your spa becomes a client: to deliver the service, bill you and keep business records.
- To comply with the law and protect our rights and other people’s.
Cookies, the Google Ads tag and your choices
This site runs one tracking tool: the Google Ads tag. We don’t run Google Analytics, a Meta pixel or a tag manager, and we set no cookies of our own.
What the tag does
When you arrive from one of our Google ads, Google sets a cookie in your browser. If you then book a call, the tag tells Google that a booking happened, with a reference number so the same booking isn’t counted twice. Google uses this to report which ads led to calls. Google may also use the information under its own policies, including to improve its advertising services. The tag runs only on inandoutdigital.com, not on test copies of the site.
Your choices
- Turn off ad personalisation and manage Google’s advertising cookies at adssettings.google.com (opens in a new tab).
- Opt out of interest-based advertising from many companies at optout.aboutads.info (opens in a new tab).
- Block or delete cookies in your browser settings. The site still works without them; only our ad measurement is affected.
If your browser sends a Global Privacy Control or Do Not Track signal, we are working out how to honour it. Until then, use the opt-outs above.
If we ever add another tracking tool, we’ll name it here, say what it collects and explain how to opt out before it goes live.
Data we handle for med spa clients
When a med spa hires us, we run call tracking for its ads, so we handle some information about the spa’s callers. We do this on the spa’s behalf, under our services agreement and a BAA we sign with the spa before launch. Our call-tracking vendor signs a BAA too. If this policy and a spa’s agreement disagree about that spa’s data, the agreement and BAA control.
What we handle
- Call logs: each caller’s phone number, the date, time and length of the call, whether it was answered and whether it was flagged as spam.
- Call recordings: callers first hear that the call may be recorded. A spa can choose not to record; then we keep the log and drop the audio.
- The spa’s patient list: we check callers’ numbers against it so calls from existing patients aren’t counted as new-patient calls.
- The weekly progress report: spend, calls and the front desk’s booking rate. It may mention specific calls.
- Callback Desk, if the spa adds it: the missed calls, after-hours calls and web forms that get a callback, the outcome of each callback and the bookings made in the spa’s calendar.
We use this data to run, measure and improve the spa’s ads and to report results to the spa. We don’t sell it, and we don’t use it to market to the spa’s callers or patients. If a spa leaves, it keeps its ad account, booking page and call recordings.
If you’re a patient or caller
The spa decides how your information is used. Please read your spa’s own notice of privacy practices and send questions about your calls to the spa. If you contact us instead, we’ll pass your request to the spa.
If you’re a spa owner
If your spa becomes a client, we also keep your business contact details, the access you give us to your Google Ads account, and our agreement and billing records. The card you keep on file is held by our payment processor. Your Google Ads budget goes from your own card to Google, in your own ad account; we never hold it.
The booking page we build for your spa is yours. Your spa’s own privacy policy should cover the people who visit it.
How long we keep it
We keep personal information only as long as we need it for the purposes in this policy, or as the law requires. Then we delete it.
- Booking details and emails: while we’re talking with you, and for a reasonable time afterwards for our records.
- Client agreements and billing records: as long as tax and business-record laws require.
- Client call data: as our services agreement and BAA with the spa require.
How we protect it
We take reasonable steps to protect the information we hold, and we limit access to the people who need it. For patient-related call data, we sign a BAA with the spa, and our call-tracking vendor signs one too.
No website, email or phone system is perfectly secure. If something goes wrong with patient-related data, we’ll tell the affected spa as our BAA requires. If you think something is wrong, tell us right away.
Your rights and how to make a request
You can ask us to tell you what personal information we hold about you and give you a copy, correct anything that’s wrong, delete it (unless the law requires us to keep it, such as billing records), or stop following up with you about Full Chair.
Depending on where you live, your state’s privacy law may give you these rights and others. You don’t need to name a law to ask.
Email umar@inandoutdigital.com with “Privacy request” in the subject line, or call +1 (210) 618-9158. We may ask you to confirm it’s you, for example by replying from the email address you booked with. Someone you authorise can make a request for you; we may ask for proof.
We’ll reply within the time the law allows. If we can’t do what you asked, we’ll explain why, and you can ask us to reconsider. We won’t treat you differently for asking.
To cancel or reschedule a call, use the links in your Calendly confirmation email or contact us.
Patients and callers of our client spas: see If you’re a patient or caller.
Children
This is a business website for med spa owners. We don’t knowingly collect personal information from children under 13. If you think a child has given us information, contact us and we’ll delete it.
Changes to this policy
We’ll update this policy when our site or practices change, and we’ll change the date at the top when we do. If a change is significant, we’ll say so on this page.