Clinic Web POS Dashboard — Web application (Laravel)
This point-of-sale dashboard records treatment and product transactions for a beauty clinic. It handles customer contact details and payment status, but never card or bank credentials — those stay with the payment provider.
Clinic Web POS Dashboard is software that an organization installs and runs on its own infrastructure. The clinic operating a given installation decides what data is entered into it and is the data controller for that installation. This page documents what the application itself collects and processes by design; it is the reference policy for the software, and an operator may publish additional terms on top of it. As the developer, I have no access to any production database unless an operator explicitly grants it for maintenance.
| Data | Why |
|---|---|
| Customer contact data | Name and phone number, entered by the cashier when a receipt or a customer history is needed. Optional — a walk-in sale can be recorded without it. |
| Transaction records | Treatments and products purchased, price, discount, therapist, date, and payment method — for receipts, revenue reports, and commission calculation. |
| Payment records | Midtrans order ID, amount, method, and status. No card number, CVV, or bank credentials is ever stored. |
| Staff accounts | Name, role (admin, cashier, therapist), and a hashed password. |
| Stock data | Product quantities and movements — no personal data. |
| Technical logs | IP address, user agent, and action timestamps, for audit and troubleshooting. |
This is a sales dashboard, not a medical record system. It records what was purchased, not a diagnosis or clinical notes. Where a treatment name itself hints at a customer’s condition, the clinic should treat that record with the same care as any health information and restrict who can view it using the built-in roles.
| Service | What it does |
|---|---|
| Midtrans (PT Midtrans) Privacy policy ↗ | Processes payments (QRIS, virtual account, e-wallet, card). Card and banking details are entered on Midtrans’ own page — this application never sees or stores them. |
When a customer pays by QRIS or another online method, they are handed to Midtrans, which collects and processes the payment credentials directly. This application receives back only an order ID, an amount, and a status (pending / settled / failed). Cash transactions involve no third party at all.
The application uses cookies only for functionality:
There are no advertising cookies, no third-party analytics or tracking pixels, and no cross-site profiling. Clearing cookies simply logs you out.
Data is visible to clinic staff according to their role. It is not sold or shared with advertisers. It may be disclosed to the payment provider (for reconciliation) or to authorities where the law requires it.
Sales records are normally kept for as long as the clinic’s bookkeeping and tax obligations require. A customer may ask the clinic to remove their contact details from the customer list; the underlying transaction stays in the books as an anonymous sale.
The application applies standard protections: passwords are stored as one-way hashes (never in plain text), access is limited by role, and all traffic between client and server is expected to run over HTTPS/TLS.
No system is perfectly secure. Server hardening, backups, and access management for a live installation are the responsibility of the organization operating it.
The dashboard is a staff-facing tool. It is not directed at children, and customer records are created by staff, not by minors registering themselves.
You have the right to ask for access to, correction of, or deletion of your personal data, and to object to certain processing.
Because your data lives in the installation run by the organization you deal with, address those requests to that organization first — they hold the data and can act on it. If you cannot reach them, or you believe the application itself is at fault, contact the developer at mhdlutfidev@gmail.com and I will assist technically.
If this policy changes, the “Last updated” date at the top of this page will be revised. Material changes will be reflected in the application release notes.
Questions, complaints, or privacy requests about this application:
I aim to respond within 7 business days.