Effective 5 November 2026. This policy covers the Diamond Hair Clinic YouTube desktop app. It is separate from the clinic website’s general privacy policy.
Operator and purpose
Diamond Hair Clinic operates the app for authorized clinic staff. It uses YouTube API Services to verify the intended channel, upload an explicitly approved video and check the result. The app is awaiting Google verification. No channel authorization or live upload has succeeded through it.
Information used
After Google permits authorization, the app reads the authenticated channel identifier and title to confirm the intended channel. For an approved upload, Google receives the selected video, its title and description, category, visibility, subscriber notification choice, children’s audience setting and synthetic media declaration.
The app can read the selected video’s identifier, title, description, visibility and processing state. It compares metadata locally and stores a short operational result. It does not request comments, audience lists, advertising information or access to unrelated Google services.
Storage and access
OAuth application configuration and channel access and refresh tokens are stored in macOS Keychain. App working folders are restricted to the local macOS user. They contain a copy of the selected video, the operator’s request and temporary upload and verification records. Credentials, authorization codes and authentication headers are excluded from logs and reports.
Only authorized clinic operators should use the app or access these local records. The app does not sell Google user data or use it for advertising, credit decisions or AI model training. Its use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Google and AI assistance
Google processes sign-in, authorization and approved YouTube API requests under the Google Privacy Policy. Upload files go from the local app to Google.
Operators may use Codex to prepare commands and review wording. Operator instructions and the app’s generic completion or error notices can then be processed by OpenAI under the applicable account terms and data controls. The command output excludes API-derived channel names, returned video identifiers, private video metadata and credentials. Operators must not paste API response data or credentials into assistant conversations. The app does not send videos or API response bodies to OpenAI, and it does not certify the retention settings of an operator’s separate assistant account.
Retention
App-owned upload working copies, requests and cached API records expire 30 calendar days after preparation. A local maintenance job checks every 24 hours while the computer is available, and every app operation checks expiry before proceeding. Expired records are deleted rather than used. If the computer is asleep or off, maintenance resumes when it is available; an app command performs cleanup before use.
The app checks stored authorization during daily maintenance. When Google reports that authorization has expired or been revoked, the app deletes its stored channel tokens and app-owned working data and blocks further use until a new explicit authorization. Temporary network failures do not count as confirmed revocation. API access is refused if the daily maintenance job is unavailable or its successful check is more than 36 hours old.
Channel tokens are kept only while the connection remains authorized. The application configuration can remain in Keychain after disconnect because it identifies the app rather than a channel grant. A full local removal can delete it as well.
Delete data or disconnect
Ask an authorized clinic operator to run the app’s disconnect or delete-data control. Both stop further app access, attempt to revoke the stored Google authorization, remove channel tokens from Keychain and delete app-owned working copies and cached API records. Local cleanup proceeds even if Google cannot be reached. The result states whether manual revocation is still needed.
You can also remove access through Google Account connections. For a deletion request, contact the clinic through Contact Us and identify this app. We will process app-data deletion requests as soon as possible and within seven calendar days.
A minimal local record containing a request hash, dispatch flag and any unresolved-send flag remains to prevent a duplicate upload. It contains no video identifier, title, description, channel response, token or selected video. Deletion does not remove your original files, videos already stored by YouTube, or information you independently placed in a separate service. Manage uploaded videos through YouTube Studio.
Contact and changes
Use Contact Us for privacy questions. Do not send passwords or tokens. We will update the effective date when this app policy changes, and the app requires acceptance of its current policy version before a new authorization or upload request.