Legal
Privacy Policy
Last updated: 02 August 2026
1. Who is responsible for your information
The clinic operating this site ("the Clinic") is the responsible party (data controller) for personal information you provide when you book or interact with this site. The GlowFlow platform processes information on behalf of the Clinic as its operator (processor) in terms of the Protection of Personal Information Act, 4 of 2013 ("POPIA").
2. What we collect
Depending on how you use the site we may collect: your name, contact details (mobile, email), date of birth, South African ID number where required for medical record-keeping, appointment history, treatment preferences, product purchase history, marketing preferences, and basic technical information such as your device type and approximate location (from your IP address).
3. Why we process it
We process your information to confirm and manage your bookings, to provide the treatment you have requested, to keep accurate clinical records as required by South African health regulations, to send transactional emails relating to your appointments, to send marketing communications where you have consented, and to comply with our legal obligations.
4. Your POPIA rights
You have the right to access the personal information we hold about you, to ask us to correct or delete it, to object to processing, to withdraw consent to marketing at any time, and to lodge a complaint with the Information Regulator (South Africa). To exercise any of these rights, contact the Clinic using the details on its public profile.
5. Sharing
We do not sell your information. We share it only with: the Clinic's treating staff, the GlowFlow platform that hosts the booking infrastructure, payment processors when you choose to pay online, and email and messaging providers used to send appointment notifications. We require these recipients to keep your information confidential.
6. Retention
Clinical records are retained for the minimum period required by South African health regulations. Marketing data is retained until you unsubscribe or ask us to delete it.
7. Security
We apply reasonable technical and organisational safeguards to protect personal information, including encryption in transit, row-level access controls in the database, and role-based access for staff. Sensitive identifiers such as your South African ID number are restricted to authorised clinic staff only.
8. Marketing & unsubscribe
Promotional emails are sent only with your consent. Every promotional email contains an unsubscribe link in the footer. Clicking it stops further promotional emails — you will still receive transactional emails about bookings you have made.
9. Contact
Privacy queries and POPIA requests should be sent to the Clinic using the contact details on its public profile.