Privacy Policy

Skinesthetics by M.D.(“we”, “us”) is an aesthetic clinic in Manila. We treat your personal and health information as confidential. This policy explains what we collect, why, where it is kept, how long we keep it, and the rights you have under the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC).

We are the personal information controller for the data described here. Our Data Protection Officer is Darwin Romero R.N.; contact details are at the end of this page.

• Identity and contact details — your name, mobile number, email address, and date of birth.
• Booking and inquiry details — the services you ask about or book, appointment dates and times, your skin concerns, and any notes you send us through our booking, inquiry or chat forms.
• Health information (sensitive personal information) — your intake form answers, such as medical conditions, allergies, current medications and skincare, pregnancy or breastfeeding status, previous procedures, and an emergency contact.
• Clinical photos — before-and-after photos of the treated area, taken only with your consent.
• Treatment records — treatments performed, products used, practitioner notes, aftercare instructions and treatment plans.
• Payment records — amounts, deposits, packages and payment method. We do not store card or bank account numbers.
• Feedback — satisfaction survey answers you choose to give after a visit.
• Website chat — messages you type into the chat assistant on our website.

Our public website does not use advertising or analytics cookies. The only cookies set are those needed for our staff to sign in to the clinic system.

• To provide safe care — assessing whether a treatment is suitable for you, performing it, documenting it, and following up on your results.
• To manage appointments — confirming, reminding, rescheduling and cancelling bookings, and sending you calendar invites and receipts by email.
• To answer inquiries — replying to questions you send through our website, chat or messaging channels.
• To keep records the law requires — medical, financial and tax records.
• To improve our service — reviewing anonymised feedback and clinic trends.

We process health information and photos on the basis of your consent, which we ask for when you first become a patient, and because it is necessary for the medical treatment you request. Other information is processed to fulfil your booking and to comply with our legal obligations. We will never sell your data. Before-and-after photos appear on our website or social media only if you give separate, written marketing consent.

To support — never replace — our practitioner's judgement, we use artificial-intelligence tools for some tasks:

• Photo analysis — with your consent, clinical photos may be sent to Anthropic (Claude) for a skin assessment that our practitioner reviews.
• Summaries and drafting — Groq helps draft aftercare notes, treatment-plan suggestions, reminders, and clinic-wide summaries. Contact details such as your phone number, email and address are removed before data is sent.
• Website chat— the chat assistant on our website is powered by Groq. Please don't share medical details there; book a consultation instead.

We use these providers through their business API services, under terms that do not permit them to use your data to train their models. Every AI output is reviewed by our practitioner before it affects your care. You may ask us not to use AI tools on your records at any time — it will not affect the care you receive.

Your information is stored and processed by these service providers on our behalf, under contracts that require them to keep it secure and confidential:

• Supabase — our main patient database (Singapore region), including records, intake forms and appointments.
• Google Drive — clinical photos, in a private clinic account.
• Google Calendar— appointment times with your name, in the practitioner's private calendar.
• Anthropic and Groq — AI analysis, as described above.
• Resend — delivery of appointment emails.
• Vercel — hosting of our website and clinic system.

Some of these providers process data outside the Philippines (including in Singapore and the United States). Where they do, we rely on contractual safeguards so your data stays protected to the standard the Data Privacy Act requires.

Access to the clinic system is limited to authorised clinic staff through Google sign-in, data is encrypted in transit, and every change to a patient record is logged.

• Patient records (health information, photos, treatment and payment records) — for as long as you are our patient, and afterwards for as long as Philippine medical-record, tax and accounting rules require.
• Inquiries that did not become a booking — up to 2 years from your last contact.
• Website chat conversations — up to 12 months.

When a retention period ends, we securely delete or anonymise the data. Backup copies are overwritten on a short rolling cycle.

Under the Data Privacy Act, you have the right to:

• Be informed about how your data is collected and used — which is what this page is for.
• Access the personal data we hold about you and get a copy of it.
• Correct anything that is inaccurate or out of date.
• Erasure or blocking — ask us to delete or stop processing your data. Some records may need to be kept for the periods the law requires; if so, we will tell you which records and why, and restrict them so they are not used for anything else.
• Object to processing, and withdraw consent at any time, including consent for photos, AI analysis and marketing.
• Data portability — receive your data in a commonly used electronic format.
• Claim damages and file a complaint with the National Privacy Commission.

To use any of these rights, contact our Data Protection Officer using the details below. We may need to confirm your identity first. We aim to respond within 15 working days, and there is no charge for a reasonable request.

We treat patients under 18 only with the consent of a parent or legal guardian, who may exercise these rights on the minor's behalf.

If a security incident puts your personal data at real risk, we will notify you and the National Privacy Commission within the timeframes the law requires.

We may update this policy when our services or the law change. The effective date at the top shows the latest version. Significant changes will be communicated to current patients. See also our Terms of Service.

• Clinic: Skinesthetics by M.D.
• Data Protection Officer: Darwin Romero R.N.
• Email: skinestheticsmdr@gmail.com
• Address: 968 Anonas Blvd. Anonas LRT City Center, Brgy. Bagumbuhay, Quezon City, 1109
• Or message us through the contact section of our website.