Privacy Policy

Who we are

Skin Zen Facial and Nail Spa ("Skin Zen", "we", "us") operates a facial, body and nail care spa in Quezon City, along with our website at skinzenspa.ph and our Facebook and Instagram pages.

We respect your privacy. This policy explains what personal information we collect, why we collect it, who can see it, and what rights you have over it. We handle personal information in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules.

What information we collect

When you book or visit us:

• Your name, mobile number, and email address
• The treatments you book and receive, and the dates of your visits
• Notes our spa staff record about your spa treatments, including preferences, products used, and any information you choose to share with us so we can serve you safely
• Payment records (we record that a payment was made and the amount; we do not store your card or bank account numbers)
• Signed consent or waiver forms for spa treatments, which we may keep as a scanned copy or photograph

When you message us:

• The contents of your conversation with us, whether on our website chat, Facebook Messenger, Instagram direct messages, SMS, or Viber
• The name and profile picture shown on your social media account, as provided to us by Meta
• Any contact details you give us during the conversation

When you visit our website:

• Basic technical information such as your browser type and the pages you view
• We do not sell this information or use it to build advertising profiles of you

When you respond to our ads:

• If you submit an enquiry through a Facebook, Instagram, Google or TikTok ad, we receive the contact details and answers you provided in that form

Doctor-led treatments

Some treatments at Skin Zen are provided by a visiting licensed physician who practises independently rather than as our employee.

Where that is the case:

• The physician keeps their own clinical records for the treatments they provide, as an independent professional responsible for those records under their own obligations. We do not hold, access or store them.
• We keep only the booking information — your name, contact details, the appointment date, and the service booked
• Requests about your clinical records should go to the treating physician. We will tell you who that is and how to reach them
• If this arrangement changes in future, we will update this policy and say so on this page

Our AI assistant

Our website chat and our Facebook and Instagram messages may be answered by an automated assistant rather than a member of staff.

You should know:

• The assistant answers questions about our services, prices and opening hours, and can help you start a booking
• Your messages are processed by a third-party AI service (Anthropic) to generate the reply. Your conversation is sent to that service for this purpose
• The assistant does not give medical advice, and will pass your conversation to a member of our team if you describe a skin concern, allergy, reaction, pregnancy, or medication
• A member of our staff can read your conversation and take over from the assistant at any time
• You can ask to speak to a person at any point

Why we collect it

We use your information to:

• Book, confirm and carry out your treatments
• Keep a record of your spa treatment history, so our staff can serve you safely and consistently on return visits
• Send you booking confirmations and appointment reminders
• Send you follow-up messages about treatments you have had, and occasional offers. You can ask us to stop at any time
• Answer your questions and respond to your enquiries
• Operate our loyalty programme
• Keep our own business records, including sales, staff performance and accounting
• Meet our legal and tax obligations

We will ask for your consent before sending you promotional messages, and you may withdraw that consent at any time without affecting your ability to book with us.

Who can see it

Your information is seen by:

• Our staff, limited to what they need to serve you
• A visiting physician, where you have booked a doctor-led treatment. We share only what is needed for that appointment
• Our service providers, who process information on our behalf under agreements that require them to protect it:
  • Supabase (secure database hosting)
  • Vercel (website hosting)
  • Anthropic (the AI service that generates our assistant's replies)
  • Meta Platforms (where you message us on Facebook or Instagram, your conversation also exists on their systems under their own privacy policy)
• Professional advisers and government authorities, where we are required by law to disclose information

Some of these providers store information on servers outside the Philippines. Where that happens, we take reasonable steps to ensure your information remains protected to a standard comparable to Philippine law.

We do not sell your personal information to anyone.

How long we keep it

• Spa treatment records and consent forms: five years after your last visit, so we have a safe history if you return
• Conversations with us: two years
• Accounting and tax records: as long as Philippine law requires
• Marketing contact details: until you ask us to stop, after which we keep only a note that you opted out

How we protect it

Our records are held in a password-protected system with access limited to authorised staff. Our website and database connections are encrypted. Staff accounts are individual, so we can see who accessed what.

No system is perfectly secure. If a breach occurs that puts your information at serious risk, we will notify you and the National Privacy Commission as required by law.

Your rights

Under the Data Privacy Act of 2012, you have the right to:

• Be informed about how we use your information
• Access the information we hold about you
• Correct anything inaccurate
• Object to our processing, including withdrawing consent to marketing
• Erasure or blocking of your information, where the law allows
• Damages if you suffer harm from our mishandling of your information
• Data portability, to receive your information in a usable electronic format
• Lodge a complaint with the National Privacy Commission

To exercise any of these, contact us using the details below. We will respond within a reasonable period. We may ask you to verify your identity first, so we do not disclose your records to someone else.

Deleting your information

To ask us to delete the information we hold about you, email us at skinzenph@gmail.com with the subject line "Data Deletion Request", including the name and mobile number you booked under.

We will delete what we are able to and tell you what we must keep, and why. Some records — accounting entries and treatment consent forms, for example — we are required to retain for a set period.

Children

Our services are intended for adults. We do not knowingly collect information from anyone under 18 without the consent of a parent or guardian. Where a minor receives a treatment, we require a parent or guardian to be present and to sign the consent form.

Changes to this policy

We may update this policy from time to time. The current version will always be on this page, with the date it was last updated at the top. Significant changes will be announced on our Facebook page.

Contact us

For privacy matters specifically, you may address your message to our Data Protection Officer at the same email.

You may also contact the National Privacy Commission at privacy.gov.ph.