01
Who we are and when this policy applies
De Luxe Aesthetic Clinic (trading as De Luxe Aesthetic Clinic, “De Luxe”, “we”, “us” or “our”) is responsible for the personal data described in this policy. Our principal contact address is East Legon, Dr Tagoe Avenue, GA-375-8490, Accra, Ghana.
This policy applies when you visit our website, request a consultation, book a clinical procedure, apply to the Academy, use an approved student account, purchase or enquire about a product, communicate through email, telephone or WhatsApp, or otherwise interact with us.
We process personal data in accordance with Ghana’s Data Protection Act, 2012 (Act 843) and other applicable professional, health, consumer, accounting and regulatory requirements.
02
Personal data we collect
- Identity and contact data: name, email address, telephone number, address and preferred contact method.
- Clinical and booking data: requested procedure, appointment date, consultation notes, relevant health information, contraindications, consent, treatment history and before/after media where separately authorised.
- Academy and student data: course interest, qualifications or experience, application details, approval status, attendance, schedules, learning materials accessed, assignments, support conversations and certificate records.
- Order and transaction data: products, quantities, delivery information, order value, payment status, transaction reference, refunds and customer-service records.
- Account data: login email, password hash, role, account status and, where you choose Google sign-in, the basic profile information Google supplies with your permission.
- Technical data: IP address, device/browser information, timestamps, security logs, session identifiers, cookie data and pages or features used.
- Communications: enquiries, emails, calls, WhatsApp messages, feedback and support requests.
Clinical information may be sensitive personal data. We request only information reasonably needed to assess suitability, provide safe care, maintain professional records, or satisfy legal obligations. Please do not send unnecessary medical or identity documents through unsecured channels.
03
Why and how we use personal data
Depending on the interaction and applicable law, we process data with your consent, to take steps at your request or perform a contract, to comply with legal or professional obligations, to protect vital interests, and for legitimate interests that do not override your rights.
- responding to enquiries and arranging consultations or appointments;
- assessing suitability, obtaining consent, providing procedures and delivering aftercare;
- reviewing Academy applications, contacting applicants, approving student access and administering physical training;
- providing course schedules, materials, assignments, support and certificates to authorised students;
- processing orders, payments, delivery, refunds and transaction records;
- authenticating users, preventing fraud, securing the website and investigating misuse;
- meeting accounting, tax, insurance, health, safety, regulatory and legal requirements;
- improving services and measuring website reliability using appropriately limited technical information; and
- sending marketing only where permitted and allowing you to opt out at any time.
We do not make decisions that produce legal or similarly significant effects about you solely through automated processing.
05
Who receives personal data
We do not sell or rent personal data. We disclose only what is reasonably necessary to:
- authorised staff, trainers and practitioners who need the information to perform their duties;
- hosting, database, email, security, storage and technical service providers acting for us;
- Paystack or another disclosed payment processor, banks and payment networks when online payment is selected;
- Google when you choose Google sign-in, and Meta/WhatsApp when you contact or order from us through WhatsApp;
- delivery providers where required to fulfil an order;
- professional advisers, insurers, auditors or regulators; and
- law-enforcement bodies, courts or other parties where required by law or necessary to protect rights, safety and security.
Payment information
When online payments are enabled, payment-card or mobile-money credentials are entered on the payment provider’s secure interface and handled under that provider’s privacy terms. We receive transaction details such as the amount, status, payment channel and reference, but we do not intend to store complete card numbers, PINs or mobile-money authentication credentials.
International processing
Some technology providers may process information outside Ghana. Where this occurs, we take reasonable steps to use providers and safeguards that protect the information consistently with applicable law.
06
Retention and security
We keep personal data only for as long as needed for the purpose collected and for applicable legal, tax, accounting, insurance, professional-record, dispute or regulatory periods. Retention depends on the record: unsuccessful enquiries and applications are ordinarily reviewed for deletion after 24 months; transaction and treatment records may be held for up to seven years or longer where law or professional obligations require; active student and account records are retained while the relationship continues and for an appropriate period afterwards.
We use role-based access, authentication, encrypted HTTPS transport, protected file storage, backups, logging, software updates and administrative safeguards. No internet service is risk-free, so please use a strong unique password and notify us promptly if you suspect unauthorised account activity.
07
Your data-protection rights
Subject to applicable law and necessary identity verification, you may ask us to:
- confirm whether we process your data and provide access to it;
- correct inaccurate, incomplete, misleading or outdated data;
- stop, restrict, erase or destroy data where the legal conditions are met;
- explain the purpose and recipients of processing;
- honour withdrawal of consent for future consent-based processing;
- stop direct marketing; or
- consider an objection or complaint about our processing.
Withdrawal does not invalidate processing already performed and may not require deletion where records must be retained by law or for legitimate professional or legal claims.
Children
Our clinical and professional Academy services are not directed to children acting independently. Where a service may lawfully involve a person under 18, a parent or legal guardian must contact us and provide the required authority and consent.
08
Questions, requests and complaints
Email luxeaetheticsacademy@gmail.com, call +233552248636, or write to De Luxe Aesthetic Clinic, East Legon, Dr Tagoe Avenue, GA-375-8490, Accra, Ghana. Please use the subject “Privacy Request” and describe your request clearly.
You may also complain to Ghana’s Data Protection Commission at dataprotection.org.gh.
We may update this policy when our services, providers or legal duties change. Material changes will be published here with a revised effective date.