PRIVACY POLICY

Privacy Policy

Natural Aesthetics and Skin Spot

1. Who we are and what this policy covers

This Privacy Policy explains how Natural Aesthetics Inc, trading as Natural Aesthetics and as Skin Spot (“we”, “us”, “our”), collects, uses, stores, shares and protects your personal information, and what your rights are.

It applies to every patient of our clinics in Green Point, Somerset West and Tyger Valley, every customer of skinspot.co.za, every visitor to naturalaesthetics.co.za or skinspot.co.za, and anyone who contacts us by telephone, WhatsApp, email or social media.

We are a responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA). We process personal information in accordance with POPIA, the Promotion of Access to Information Act 2 of 2000 (PAIA), the Electronic Communications and Transactions Act 25 of 2002, the National Health Act 61 of 2003 and the ethical rules of the Health Professions Council of South Africa (HPCSA).

This policy forms part of our Terms and Conditions, which are published on both our websites.

2. Information Officer

We have appointed an Information Officer, registered with the Information Regulator in terms of section 55 of POPIA, who is responsible for how we handle personal information.

Any request, question or complaint about your personal information may be sent to the Information Officer at [email protected], marked for the attention of the Information Officer, or by post to 173 Main Road, Green Point, Cape Town, 8051.

3. What personal information we collect

We collect only the information we need to provide safe care, to sell and deliver our products, to run our business and to meet our legal obligations. Depending on your relationship with us, this may include:

• Identity and contact information: name, surname, date of birth, ID or passport number, cellphone number, email address, home address and emergency contact details.
• Health information: your medical history, current medications, allergies, pregnancy or breastfeeding status, previous procedures, lifestyle information, the treatments you receive, clinical notes, prescriptions, consent forms and clinical photographs. This is special personal information under section 26 of POPIA and is handled with additional care as set out in clause 5.
• Financial and transaction information: what you have purchased, invoices, payments, deposits, refunds, loyalty points and gift vouchers. We do not store your card details; payments are processed by PayFast.
• Communication records: your messages to us and ours to you by email, WhatsApp, SMS and telephone, including complaints and feedback.
• Online information: your Skin Spot account details, order history, and technical data such as IP address, device and browser type and the pages you visit, collected through cookies as described in clause 9.
• Marketing preferences: whether you have subscribed to or opted out of our newsletters and promotions.

We collect this information directly from you, from the forms you complete before treatment, from your use of our websites, and, with your consent or where the law allows, from another healthcare practitioner involved in your care.

4. Why we collect it and the lawful basis

We process your personal information for the following purposes:

• To assess whether a treatment is safe and suitable for you, to provide the treatment, and to manage any reaction, complication or follow-up. Lawful basis: your consent, and the legitimate provision of healthcare by registered practitioners.
• To keep the clinical records we are required to keep by the National Health Act and the HPCSA. Lawful basis: compliance with a legal obligation.
• To take bookings, deposits and payments, to process and deliver product orders, to administer gift vouchers and loyalty points, and to issue invoices. Lawful basis: performance of our contract with you.
• To communicate with you about your appointments, treatments, orders, aftercare and any complaint. Lawful basis: performance of our contract with you and our legitimate interests.
• To send you newsletters, promotions and information about our treatments and products. Lawful basis: your consent, or, where you are an existing patient or customer, our legitimate interest in marketing similar products and services to you, subject always to your right to opt out under clause 8.
• To operate, secure and improve our websites and to measure the performance of our advertising. Lawful basis: our legitimate interests and, for non-essential cookies, your consent.
• To comply with the law, to respond to regulators, to defend or bring legal claims, and to notify our medical indemnity insurers where required. Lawful basis: compliance with a legal obligation and our legitimate interests.

5. Your health information

Your health information is special personal information under POPIA. We process it only with your express consent, which you give when you complete our medical history and consent forms, or where processing is necessary for the provision of healthcare by a registered practitioner and is protected by the practitioner’s duty of confidentiality.

Your clinical records are confidential. Only the Practitioners involved in your care, and the staff who need access to administer your bookings and payments, may access them. Every member of our staff is bound by a confidentiality obligation.

We will not disclose your health information to any third party except with your written consent, where required by law or a court, where necessary to protect your life or health, to another healthcare practitioner at your request or in an emergency, or to our medical indemnity insurers and legal advisers where necessary to deal with a complaint or claim.

Clinical photographs form part of your clinical record and are stored securely. They are used only for your care, treatment planning and record-keeping. We will never use a clinical photograph for education, training, marketing or social media without your separate written consent, which you may withdraw at any time.

6. Who we share your information with

We do not sell or rent your personal information to anyone. We share it only with the service providers we use to run our clinics and our online store, each of whom processes it on our instructions and under a written agreement that requires them to protect it and to use it only for the purpose we specify. These fall into the following categories:

• Our practice management and booking system, which holds your patient record, bookings and invoices.
• Our digital forms provider, through which you complete your medical history and consent forms.
• Our patient communication platform, through which we send and receive WhatsApp, email and SMS messages.
• Our email marketing platform, which holds your name, email address and marketing preferences.
• Our payment gateway, which processes your card and EFT payments.
• Our website hosting and development providers, who operate our websites and the Skin Spot account system.
• Our cloud productivity, analytics and advertising platforms, which support our business email, documents, website analytics and advertising measurement.
• Our workflow automation tools, which support internal administrative processes.
• Our courier partners, who receive your name, delivery address and telephone number to deliver Skin Spot orders.

We may also share limited information with our professional advisers, including our accountants, auditors and legal advisers, with our medical indemnity insurers in the event of a claim or complaint, and with the agency that manages our advertising and email campaigns on our behalf, none of whom receive your clinical records. We will disclose information where the law, a court or a regulator such as the HPCSA requires it.

7. Transfers outside South Africa

Some of the service providers described in clause 6, in particular our email marketing, digital forms, cloud productivity, analytics, advertising and workflow automation providers, store information on servers outside South Africa. Where this happens, the transfer is made in terms of section 72 of POPIA: the provider is bound by contractual terms and privacy laws that give your information a level of protection substantially similar to POPIA, or the transfer is necessary to perform our contract with you.

Your clinical records are held in our practice management system and in our own secure systems. Health information is not transferred outside South Africa for marketing purposes.

8. Marketing communications

We send newsletters and promotional messages by email, and by WhatsApp only where you have opted in, in accordance with section 69 of POPIA. We do not send marketing by SMS. If you are a new subscriber we send them only with your consent. If you are an existing patient or customer we may send you information about similar treatments and products, and you may opt out at any time.

You can unsubscribe at any time using the link in any email, by replying STOP to a WhatsApp message, or by contacting us. Opting out of marketing does not affect the appointment reminders, aftercare instructions, order updates and other service messages we need to send you.

9. Cookies and website tracking

Our websites use cookies and similar technologies. Essential cookies keep the sites working, remember your cart and keep you logged in to your Skin Spot account. Analytics and advertising cookies, including Google Analytics, Google Tag Manager and the Meta pixel, tell us how the sites are used and measure whether our advertising is effective. You can block or delete cookies in your browser settings; blocking essential cookies may prevent parts of the sites from working.

10. How long we keep your information

• Clinical records, including consent forms and clinical photographs: for at least six years from the date the record was last used, or, for a patient who was under 18 at the time of treatment, until the patient reaches the age of 24, in accordance with HPCSA guidelines. Records may be kept for longer where a treatment has a long-term effect or where they are needed for a legal claim.
• Financial and transaction records: for at least five years after the end of the tax year to which they relate, as required by tax and company law.
• Marketing information: until you opt out, and for a short period afterwards so that we can record and honour your opt-out.
• Website and cookie data: for the periods set by the relevant provider, typically between one and 26 months.

When information is no longer needed we delete it or de-identify it securely.

11. How we protect your information

We take reasonable technical and organisational measures to protect your personal information against loss, damage, unauthorised access and unlawful processing. These include encrypted connections to our websites and systems, access controls so that staff see only what their role requires, secure cloud storage with our service providers, confidentiality obligations on all staff, and regular review of who has access to what.

If we become aware of a security compromise that affects your personal information, we will notify the Information Regulator and, where required by section 22 of POPIA, notify you as soon as reasonably possible.

12. Your rights

Under POPIA and PAIA you have the right to:

• Be told what personal information we hold about you and request a copy of it. Requests for clinical records are handled under our PAIA Manual and the HPCSA rules on access to records, and a reasonable fee for copies may apply.
• Ask us to correct information that is inaccurate or incomplete.
• Ask us to delete information that we are no longer entitled to keep. We cannot delete clinical records during the retention periods in clause 10, because the law requires us to keep them.
• Object to processing based on our legitimate interests, and object at any time to direct marketing.
• Withdraw a consent you have given, such as consent to marketing or to the use of a photograph. Withdrawal does not affect processing that took place before it.
• Complain to the Information Regulator if you believe we have not handled your information lawfully. The Information Regulator can be contacted through www.inforegulator.org.za.

To exercise any of these rights, contact the Information Officer using the details in clause 2. We will respond within 30 days. We may ask you to verify your identity before we act on a request.

Our PAIA Manual, which explains how to request access to records, is available on request from the Information Officer.

13. Children

We do not knowingly collect personal information from anyone under 18 without the consent of a parent or legal guardian. Where a person under 18 is treated with a parent or guardian’s consent, the parent or guardian provides and is responsible for the information on their behalf.

14. Changes to this policy

We may update this policy from time to time. The current version is always published on our websites. Material changes will be announced on our websites and, where appropriate, by email.

Contact: Natural Aesthetics, +27 21 433 0967, WhatsApp +27 69 910 0540, [email protected]. Skin Spot: [email protected]. Information Officer: [email protected], marked for the attention of the Information Officer.