Privacy Notice

Responsible party

Sophias salon

Registration number

To be confirmed: registration number

Address

To be confirmed: address

Telephone

To be confirmed: telephone

Email

drsophieramsaroop.aesthetics@gmail.com

POPIA requires the responsible party to appoint an Information Officer. For this clinic that is:

• Identity and contact details: name, mobile number, email address, date of birth, and South African ID number where required for medical record-keeping.
• Health information: medical history, medication, allergies, pregnancy status and treatment notes.
• Clinical photographs taken before, during or after a procedure, where you have signed a consent form for them.
• Booking, treatment and purchase history.
• Marketing preferences and your consent or opt-out record.
• Technical information when you use this website: IP address, device type and pages visited.

Health information and biometric-adjacent records such as clinical photographs are special personal information under section 26 of POPIA. The clinic processes them under section 32, which permits a medical professional or healthcare institution to process health information where it is necessary for the proper treatment and care of the data subject, and additionally on the strength of the written consent you give on the intake and procedure consent forms. The categories involved are:

• Health and medical history disclosed on intake and consent forms
• Medication, allergy and pregnancy status
• Clinical photographs taken before, during or after a procedure
• South African ID number, where the clinic requires it for medical record-keeping

Clinical photographs are stored in a private, access-controlled location, are never published without a separate written marketing consent, and have their location and device metadata removed on upload.

• To confirm, change and manage your appointments.
• To provide the treatment you have requested safely, and to screen for contraindications.
• To keep the clinical records South African health regulations require.
• To take payment and issue invoices.
• To send transactional messages about bookings you have made — these are not marketing and continue regardless of marketing consent.
• To send marketing messages, only where you have given consent, and always with a way to opt out.
• To comply with legal, tax and professional-body obligations.

The GlowFlow database, file storage and application servers are hosted in Ireland, in the European Union. Personal information collected through this platform is therefore transferred out of South Africa and processed in the EU.

Section 72 of POPIA permits a cross-border transfer where the recipient is subject to a law that provides an adequate level of protection. Ireland is subject to the EU General Data Protection Regulation (GDPR), which upholds principles substantially similar to POPIA and includes further-transfer restrictions comparable to section 72.

The full list of third parties involved — email and SMS delivery, payments, hosting and optional AI features — is published and kept current on GlowFlow's sub-processor page. The clinic does not sell your information, and does not share it for third-party advertising.

The categories of information we hold are set out below. The retention period for each, and the legal basis that fixes it, are currently being confirmed with the clinic's professional and tax advisers. Until that confirmation is in place we do not delete records in these categories, and we will publish the confirmed periods here as soon as they are settled. You can ask us at any time what we hold about you and ask for it to be deleted, and we will tell you whether a statutory minimum prevents deletion.

Your information is held in an access-controlled system. Staff see only what their role requires, clinical files are stored privately and served only through short-lived links, and sensitive actions such as opening a consent record are logged. Connections to the site are encrypted in transit using TLS, and the database and file-storage provider states that data is encrypted at rest using AES-256.

If a security compromise affects your personal information, the clinic will notify you and the Information Regulator as soon as reasonably possible after establishing what happened, as section 22 of POPIA requires. GlowFlow notifies the clinic of any platform-side compromise as soon as reasonably possible after we become aware of it, and with reasonable regard for the needs of any law-enforcement investigation.

• Ask what personal information the clinic holds about you and receive a copy.
• Ask for information that is inaccurate, irrelevant, excessive or out of date to be corrected or deleted — subject to the minimum periods clinical records must be kept for.
• Object, on reasonable grounds, to processing.
• Withdraw marketing consent at any time, using the unsubscribe link in any marketing email or by contacting the clinic.
• Complain to the Information Regulator.

Send requests to the clinic at drsophieramsaroop.aesthetics@gmail.com. Formal access requests follow the clinic's PAIA manual. Requests sent to GlowFlow (admin@glowflow.online) are forwarded to the clinic, because GlowFlow may not release or delete clinical records on its own.

You have the right to lodge a complaint with the Information Regulator of South Africa about the way your personal information has been handled. That right exists under the Protection of Personal Information Act, 4 of 2013, and using it does not affect any other remedy available to you.

The Regulator's contact particulars are still being verified, so this page does not print them. The clinic will give you the current details on request, and they are published by the Regulator itself.

Regulator

Information Regulator (South Africa)

Physical address

To be confirmed: physical address

POPIA complaints

To be confirmed: popia complaints

Website

To be confirmed: website