This page explains what happens to the information you share with a studio that uses REV23, including your ID and release form.
What we collect
Your studio may collect and keep:
- Your name, contact details, address, date of birth, and emergency or physician contact details.
- Your government ID number, issuer, expiration date, and image, and sometimes a second form of ID. For a minor, it may also collect a parent or guardian's contact details, ID, and signature.
- Medical information relevant to the procedure, release-form answers and signatures, procedure photos, and notes or files the studio adds to your record.
- Consultation requests and reference images you submit; appointment requests, changes, and booking history; and messages sent to you through REV23.
- Purchases, payments, deposits, tips, refunds, and credit or gift-card balances, as described below.
What is collected depends on the services and forms your studio uses.
Where it's stored
REV23 stores client records on Microsoft Azure. Text and form data, including ID numbers and medical answers, are held in Azure SQL. ID images, photos, signed form PDFs, and attachments are held in private Azure Blob Storage. Each Cloud has its own database and private storage container. Other Clouds cannot access your records through REV23.
How it's protected
These protections apply whether you use your phone, a kiosk, or a studio device:
- Encrypted connections and storage. Connections use TLS encryption. Azure SQL uses Transparent Data Encryption to encrypt its database and backups at rest; Azure Blob Storage encrypts files at rest.
- Protected service access. REV23 uses Azure Key Vault and managed identities to control how its services access credentials and stored data.
- Private ID images. The storage container is not public. When authorized staff need an ID image, REV23 issues a read-only signed link for that specific file. The link expires and cannot change or delete the file.
- Individual staff permissions. Staff sign in with their own accounts. Access to client, medical, and form information is checked against their permissions.
If REV23 discovers a security incident affecting client information, it will notify the studio so the studio can contact affected clients.
Who can see your information
Authorized staff at your studio can see the client information needed for their work; not every staff member can see every record. Browsing medical records and viewing ID images require additional permission. Staff authorized to view or review a completed form can see the ID and medical information included in that form without gaining general access to medical records. Authorized REV23 personnel may access client records when needed to operate or support the service. REV23 service providers and integrations your studio connects may process information as described below. REV23 does not sell studio client records or use them for advertising or marketing.
Some appointment and form links allow limited actions without signing in. Signing a form also requires confirming your date of birth. Keep these links private.
Data sent to other services
REV23 uses these providers and studio-selected connections to deliver services:
- Studio integrations, such as Zapier, can receive customer contact details, birthdate, appointment information, and payment or credit details through event notifications when the studio connects them. The studio chooses which integrations to connect.
- Twilio receives your phone number and the contents of texts sent through REV23, including any links. Twilio may shorten links and record when they are opened.
- SendGrid receives your email address and the contents of emails sent through REV23, which may include appointment details or an itemized receipt.
- Payment processors, such as Stripe or Fiserv, process card payments. For online Stripe deposits, REV23 also sends your name, email, phone number, and a deposit description to the studio's Stripe account.
- Google Places receives address text as you enter it when address suggestions are shown.
- Calendar and push services may receive your name, booked service, and appointment time when authorized studio staff enable those features. Staff calendars omit client details by default. Push notifications may appear on a staff device lock screen.
Text messages (SMS)
If you give your mobile number, your studio may use REV23 to text you about appointments, deposits, and aftercare. REV23 also sends verification codes you request. REV23 does not send marketing texts.
Message frequency. How often you hear from your studio depends on your appointment and aftercare activity, so the number of messages varies.
Rates. Message and data rates may apply, depending on your mobile plan.
Opting out. Reply STOP to any message to stop receiving texts at any time, or reply HELP for help. Opting out of texts does not affect your ability to book or receive service.
Studio SMS information. Mobile information and consent collected for this studio SMS program are not shared or sold to third parties or affiliates for marketing, or transferred to other marketing programs. Twilio processes your number and message to deliver texts.
Monitoring and performance
REV23 collects app performance, error, and limited web request information to keep the service working. These reports and logs do not include form answers or ID images.
How long we keep it, and how deletion works
Depending on where your studio operates, it may be legally required to keep client records for years. Your studio decides how long it must keep your ID, signed forms, and other records under local law; ask the studio for its retention period. REV23 restricts who can delete signed forms but does not determine or enforce each jurisdiction's legal retention period.
If your studio stops using REV23, its Cloud and client records may be permanently deleted. Ask your studio for copies of records you need before its Cloud closes.
You can ask your studio to correct or clear contact details and notes on your active record. Signed release forms, including the ID and medical information captured in them, are preserved as signed and cannot be selectively edited. An authorized studio owner can delete a full customer record, including its forms and files; the studio is responsible for deciding when that is legally permitted. Some delivery records, including message content and the recipient phone number or email address, may remain after the customer record is deleted for audit purposes.
REV23 keeps encrypted backups for recovery. An update or deletion takes effect in the live system, while older copies may remain in backups until they expire.
Your requests
Contact your studio to ask what it holds about you, request a copy of your signed form or other records, correct information, request deletion where permitted, or change your communication preferences. The studio is responsible for your client record and can ask REV23 for technical help. You can stop texts by replying STOP.
Payment information
Your studio's payment provider processes card and digital-wallet payments. Full card numbers, expiration dates, and security codes go to the processor and are not stored by REV23. REV23 records the payment method, card brand and last four digits when available, amounts, tips, discounts, refunds, and references needed for receipts and accounting.
REV23 also records booking deposits, store-credit and gift-card balances, and their use. Stripe may send you a receipt for an online deposit.
Questions about this page
For questions or requests about your specific record, contact your studio. For questions about how REV23 handles information, or if you cannot reach your studio, email support@rev23.com. REV23 may need to work with the studio to address a request about its client records.
Last reviewed: 2026-09-29.