← Back to Home

Privacy Policy

Last updated: November 11, 2026

1. Information We Collect

We collect the following personal information solely for the purpose of providing spa services:

  • Identity: First name, last name, and username (for registered accounts).
  • Contact: Phone number used for booking confirmation and reminders.
  • Medical Notes: Allergies, skin conditions, pregnancy status, or other health preferences you voluntarily provide for your safety during treatments.
  • Booking History: Appointments, services availed, and payment records.

2. How We Use Your Information

Your information is used strictly for:

  • Appointment scheduling, confirmation, and reminders;
  • Ensuring your safety by matching services to your disclosed medical conditions;
  • Processing payments and generating sales reports for business operations;
  • Maintaining your account and booking history for your convenience.

3. Who Can Access Your Data

Access is limited by role under our Role-Based Access Control (RBAC) system:

You Can view and edit your own profile, medical notes, appointment history, and payment records.
Receptionist Can access your contact details and medical notes as needed to confirm bookings and ensure service safety.
Therapist Can view medical notes only for customers assigned to their own confirmed appointments.
Administrator Has full access for system management, user support, and compliance oversight.

4. Data Security

We implement the following safeguards:

  • Passwords are hashed using bcrypt before storage;
  • All data transmission is encrypted via HTTPS/TLS;
  • Session cookies are secured and HTTP-only in production;
  • The database is hosted on access-restricted infrastructure.

5. Your Rights Under RA 10173

As a data subject, you have the right to:

  • Be informed of what data is collected and why;
  • Access and correct your own personal information;
  • Object to processing and request deletion of your data (subject to legal and operational retention requirements);
  • File a complaint with the National Privacy Commission if you believe your rights have been violated.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, and reporting requirements. When data is no longer needed, it may be anonymized or securely disposed of in line with NPC guidance.

7. Contact

For questions, corrections, or deletion requests regarding your personal data, please contact the Spa Alexandria Administrator.