Privacy notice

• We ask only for what a visit needs: what it’s for, a preferred time, whether you’d like a call or a WhatsApp message, a name and a mobile number. The form also notes the page you sent it from.
• We use those details to arrange that visit. News comes only if you tick the box for it.
• The form asks which service you’d like, never for health details, and we don’t sell personal data.
• The website sets no cookies and runs no analytics or advertising tags.
• You can ask to see, correct or delete the data we hold, or withdraw consent, at any time.

Leevora Aesthetics is an aesthetic clinic, salon and wellness space at Subhash Nagar metro station in West Delhi, now open.

The business that runs Leevora Aesthetics decides why and how personal data is used. Under the Digital Personal Data Protection Act, 2023 (the DPDP Act), this makes it the data fiduciary. You, as the person the data is about, are the data principal.

It covers leevoraaesthetics.com, the reservation form, and messages you send us by phone, WhatsApp, email or Instagram.

Records made at the clinic during a consultation or treatment are different. A separate notice covers them, and we give it to you there before anything is recorded.

We use personal data only for the purpose it was given for. If we ever wanted to use it for something new, we would ask first.

We never sell personal data, and reservation details are never shared with advertisers. A few service providers handle data for us, only for the purposes above. The DPDP Act calls them data processors.

• our web hosting company, which runs the website and stores reservation requests and server logs
• our email provider, which carries email between us
• WhatsApp and Instagram, both owned by Meta, when you message us there or ask for news by WhatsApp

Inside Leevora Aesthetics, reservation requests are read by the front desk and the clinic manager, who arrange appointments. The person who sees you at the appointment reads them too.

We may also disclose personal data when the law requires it, for example to a court or to a government authority acting lawfully.

Reservation requests are kept on our web host’s servers, outside the public part of the website, and a copy reaches our clinic mailbox. Some providers, including Meta for WhatsApp and Instagram, may process data outside India. The DPDP Act allows this, except to any country the Government of India restricts.

We keep personal data only as long as its purpose needs it, or as long as the law requires, and then delete it.

If a reservation leads to a visit, what you sent becomes part of your client record, and the clinic’s own notice covers it from then on. If you withdraw consent, we stop using the data for that purpose and delete it, unless the law requires us to keep it.

The website is served only over an encrypted connection. Reservation requests are stored outside the public part of the web server, and only the people who arrange or give your appointment can read them.

If a breach affects your personal data, we will tell you and the Data Protection Board of India, as the law requires.

Under the DPDP Act, you can ask us:

• for a summary of the personal data we hold about you, what we do with it, and who we have shared it with
• to correct, complete or update it
• to delete it, unless the law requires us to keep it

You can also:

• withdraw consent at any time, as easily as you gave it. One message is enough, and for news the opt-out in any message works too. Withdrawing doesn’t undo what was done before, and stopping news never affects an appointment.
• nominate someone to use these rights for you if you die or become unable to
• raise a grievance with us, and if our answer doesn’t settle it, complain to the Data Protection Board of India

To use any of these rights, or to make a complaint, see the last section of this notice. We may ask you to confirm who you are before we act.

The DPDP Act also asks something of you: give accurate details, don’t use someone else’s identity, and don’t make false or frivolous complaints. If you book for someone else, please have their agreement first.

The reservation form is for adults. Anyone under 18 needs a parent or guardian to book, give consent and come along, and we use those details only to arrange that visit.

We don’t track children’s behaviour online or direct advertising at them.

Cookies are small files a website stores in your browser. This site sets none, and it loads no analytics or advertising tags such as Google Analytics or the Meta pixel.

If you press “Pause motion” on a moving picture, your browser remembers that choice until you close the tab. It stays on your device and is never sent to us.

If we add Google Analytics or the Meta pixel, this notice will change first. They will load only if you accept them, and a “Cookie settings” link at the foot of every page will let you change that choice at any time.

When this notice changes, the date at the top changes too. If a change affects how we use data you have already given us, we’ll tell you and, where the law requires, ask for consent again.

For questions, requests or complaints about personal data, tell us when we call or message you about your reservation, or reply to that message. You can also ask at the front desk.

If our reply doesn’t settle it, you can complain to the Data Protection Board of India.