Privacy Policy

Privacy Policy

Solaya Aesthetic and Wellness Center

Solaya Aesthetic and Wellness Center ("Solaya," "we," "us," "our") respects your privacy and is committed to protecting your personal data in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission (NPC).

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have over it.

1. Scope

This policy applies to all clients, prospective clients, and website/social media visitors who provide personal data to Solaya through consultations, bookings, treatments, our website, social media pages, or any other official channel.

2. Personal Data We Collect

2.1 Personal information, such as: full name, date of birth, sex/gender, contact number, email address, home address, and government ID (where required for verification, age-restricted treatments, or promo redemption).

2.2 Sensitive personal information, including:

  • Medical and health history (allergies, medications, prior procedures, pregnancy status, skin/medical conditions);
  • Photos and/or videos taken before, during, or after treatment for clinical documentation and progress tracking;
  • Information collected during consultations relevant to treatment suitability.

2.3 Transaction data, such as payment method, purchase history, package/session records, and billing details. We do not store full credit/debit card numbers; these are processed by our payment partner(s).

2.4 Technical data, if you interact with our website or social media: IP address, browser type, and cookies (see Section 8).

3. How We Collect Personal Data

We collect personal data directly from you when you:

  • Book a consultation or appointment (in person, by phone, or online);
  • Fill out intake forms, medical history forms, or consent forms;
  • Make a purchase or payment;
  • Communicate with us via call, SMS, email, or social media;
  • Browse or interact with our website or booking platform.

4. Purposes of Processing

We collect and process your personal data to:

  1. Assess treatment suitability and provide safe, appropriate aesthetic and wellness services;
  2. Maintain accurate medical and treatment records;
  3. Process payments, packages, and refunds under our Payment, Cancellation & Refund Policy;
  4. Communicate appointment confirmations, reminders, and follow-up care instructions;
  5. Respond to inquiries, complaints, or feedback;
  6. Send promotional or marketing communications, where you have given consent, which you may withdraw at any time;
  7. Comply with legal, regulatory, tax, and reporting obligations (e.g., BIR, DOH, or NPC requirements);
  8. Protect the safety, security, and legal rights of Solaya, our staff, and our clients.

We do not process your personal data for any purpose incompatible with those stated above without first informing you and, where required, obtaining your consent.

5. Legal Basis for Processing

We process your personal data based on:

  • Your consent, obtained through intake/consent forms and, where applicable, marketing opt-ins;
  • Necessity for a contract, i.e., to provide the treatment or service you booked;
  • Compliance with legal obligation, such as recordkeeping requirements for medical/aesthetic procedures; and
  • Vital interest, in limited situations involving your health and safety during treatment.

Sensitive personal information (Section 2.2) is processed only with your explicit consent, obtained through our intake and treatment consent forms, or as otherwise permitted under the Data Privacy Act.

6. Sharing and Disclosure

We do not sell your personal data. We may share it only with:

  • Our licensed physicians, nurses, and aesthetic practitioners, as necessary to deliver your treatment;
  • Payment processors and billing partners, solely to process transactions;
  • Government agencies or regulators, when required by law, court order, or lawful request (e.g., DOH, BIR, NPC);
  • Service providers (e.g., appointment/booking software, IT support) under confidentiality and data protection agreements, who process data only on our instructions;
  • A successor entity, in the event of a business transfer, merger, or acquisition, subject to the same privacy protections.

Any third party we share data with is contractually bound to protect it and to use it only for the purpose disclosed.

7. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes in Section 4, or as required by applicable law (e.g., medical record retention rules, tax/audit requirements). Clinical photos and medical history are retained for the period required for continuity of care and legal recordkeeping, after which they are securely disposed of or anonymized.

8. Cookies and Website Data

If our website or booking platform uses cookies or similar technologies, these are used to improve site functionality, remember preferences, and understand site usage. You may disable cookies through your browser settings, though some site features may not function properly as a result.

9. Data Security

We implement organizational, physical, and technical security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including:

  • Restricted, role-based access to client records;
  • Secure storage of physical intake/consent forms and clinical photos;
  • Password-protected and access-controlled digital systems;
  • Staff training on confidentiality and data privacy obligations.

10. Your Rights

Under the Data Privacy Act of 2012, you have the right to:

  • Be informed that your personal data is being processed;
  • Access your personal data on file;
  • Correct or update inaccurate or outdated data;
  • Object to processing, including for direct marketing;
  • Withdraw consent, without affecting the lawfulness of processing before withdrawal;
  • Request erasure or blocking of data, subject to legal retention requirements;
  • Data portability, where applicable;
  • File a complaint with the National Privacy Commission if you believe your rights have been violated.

To exercise any of these rights, contact us using the details in Section 12.

11. Data Breach Notification

In the event of a personal data breach that poses a real risk of serious harm, Solaya will notify the National Privacy Commission and affected clients within the period required by law, and will take appropriate steps to contain and remediate the breach.

12. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or your personal data, you may contact:

Data Protection Officer / Privacy Contact Solaya Aesthetic and Wellness Center Email: solayaaestheticcenter@gmail.com Phone: 0459828293 Address: 2nd Flr. A Mallari Bldg 4, Capas-Concepcion Rd, Dutung-A-Matas, Concepcion, Tarlac

13. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be posted at our clinic and/or official website, with the "Last updated" date revised accordingly.

14. Acknowledgment

By providing your personal data to Solaya Aesthetic and Wellness Center, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and processing of your personal data as described herein.