Privacy Policy

Hermosa Hermonia ("we", "us", "our") is committed to protecting the privacy and personal information of our clients and website visitors. This Privacy Policy explains what personal data we collect, how we use it, with whom we share it, and your rights under applicable law, including the Digital Personal Data Protection Act 2023 (India).

By using our website or booking our services, you agree to the collection and use of your data as described in this policy. If you have any questions, please contact us at HermosaHermonia@gmail.com.

1. Who We Are (Data Controller)

Hermosa Hermonia is the data controller for the personal information described in this policy. Our contact details are:

2. Information We Collect

We collect the following categories of personal information:

2.1 Information You Provide Directly

• Contact information: Name, phone number, email address, and location (for appointment and communication purposes)
• Appointment details: Preferred treatment, appointment date, time, and any special requests or instructions
• Health and medical information: Medical history, current medications, allergies, skin or hair concerns, and any information relevant to safe treatment delivery (collected during consultation)
• Payment information: Transaction amounts and payment method type (we do not store full card numbers or UPI credentials)
• Communications: Messages sent to us via WhatsApp, email, contact forms, or social media

2.2 Information Collected Automatically

• Usage data: Pages visited, time spent, browser type, operating system, referring URL, and IP address (anonymised for analytics)
• Device data: Browser type and version, device type, screen resolution
• Cookies and tracking technologies: As described in our Cookie Policy

2.3 Information from Third Parties

• If you book or contact us via social media platforms (Instagram, Facebook), we may receive limited information shared through those platforms in accordance with their policies.
• Google Analytics provides us with aggregated, anonymised website usage statistics.

3. Legal Basis for Processing

We process your personal data on one or more of the following legal bases:

• Performance of a contract: To schedule and deliver your appointment and treatments
• Consent: For marketing communications (where you have opted in), photography use, and health information processing
• Legitimate interests: To improve our services, manage client relationships, and maintain website security
• Legal obligation: To comply with applicable laws and regulations

4. How We Use Your Information

We use your personal information for the following purposes:

• To confirm, manage, and deliver your appointments and treatments
• To communicate appointment reminders, aftercare instructions, and follow-up messages
• To assess treatment suitability and plan safe, personalised protocols
• To process and record payments
• To respond to your enquiries and messages
• To send promotional offers, news, or updates — only if you have opted in
• To analyse website traffic and improve the user experience
• To comply with our legal and regulatory obligations

We never sell your personal information to third parties.

5. How We Share Your Information

We share your personal information only in the following limited circumstances:

• Service providers: Third-party providers who assist us with appointment scheduling, communications, website hosting, and analytics — bound by confidentiality and data processing agreements
• Payment processors: To process transactions securely; these providers do not retain your financial data beyond the transaction
• Legal requirements: If required by law, court order, or governmental authority
• Business transfers: In the event of a merger or acquisition, your data may be transferred as part of that transaction, with notice provided

We never share your health information with any third party without your explicit consent, except where required by law.

6. Health & Sensitive Information

We collect health-related information (medical history, medications, skin/hair conditions) to ensure we deliver safe, appropriate treatments. This information is treated with the highest level of confidentiality. It is accessible only to the practitioners directly involved in your care and is never used for marketing or shared with any third party.

By providing health information during your consultation, you consent to its use for the purpose of delivering your treatment. You may request deletion of this information at any time, subject to any legal retention requirements.

7. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes outlined in this policy and to comply with our legal obligations:

• Client records and health information: 5 years from your last appointment, as required by standard professional practice
• Financial records: 7 years, as required by Indian tax and financial regulations
• Marketing opt-in records: Until you unsubscribe or withdraw consent
• Website analytics data: 26 months (Google Analytics default)

After the applicable retention period, your personal information is securely deleted or anonymised.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• HTTPS encryption for all data transmitted to and from our website
• Access controls limiting data access to authorised personnel only
• Secure storage for paper-based records (locked cabinets)
• Regular review of data security practices

No method of transmission over the internet or electronic storage is completely secure. In the event of a data breach that poses risk to your rights, we will notify you and relevant authorities in accordance with applicable law.

9. Your Rights (DPDP Act 2023 & General Rights)

Under applicable Indian law, including the Digital Personal Data Protection Act 2023, you have the following rights regarding your personal data:

• Right to access: Request a copy of the personal data we hold about you
• Right to correction: Request correction of inaccurate or incomplete personal data
• Right to erasure: Request deletion of your personal data (subject to legal retention requirements)
• Right to withdraw consent: Withdraw previously given consent at any time without affecting the lawfulness of processing before withdrawal
• Right to grievance redressal: File a complaint about how your data is being handled
• Right to nominate: Nominate another individual to exercise your data rights in the event of your death or incapacity

To exercise any of these rights, please contact us at HermosaHermonia@gmail.com. We will respond within 30 days.

10. Marketing Communications

We may send you information about offers, new treatments, and studio updates if you have opted in to receive them. You can unsubscribe at any time by:

• Clicking "unsubscribe" in any email we send you
• Messaging us on WhatsApp with "STOP"
• Emailing us at HermosaHermonia@gmail.com

Transactional communications (appointment confirmations, reminders, aftercare messages) are not marketing and will continue regardless of marketing preference.

11. Photography & Before/After Images

We may take before-and-after photographs during treatment sessions for clinical documentation purposes and, with your separate written consent, for use in marketing materials, social media, or client education. You may withdraw consent for the use of your images at any time by contacting us.

12. Third-Party Websites

Our website contains links to third-party websites (e.g., social media, Google Maps). This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party websites you visit.

13. Children's Privacy

Our services are not directed at individuals under 18 years of age. We do not knowingly collect personal information from minors. Clients under 18 require parental or guardian consent before treatment.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make significant changes, we will update the "last updated" date at the top of this page. We encourage you to review this policy periodically.

15. Contact & Grievance Officer

For any questions, concerns, or rights requests regarding this Privacy Policy, please contact:

We will acknowledge your query within 3 business days and respond fully within 30 days.