How we collect, use, and protect your information

YSA Luxe ("YSA Luxe," "we," "us," or "our") operates an aesthetic and beauty clinic at SM San Lazaro, Manila. This Privacy Policy explains how we collect, use, share, and protect personal information when you interact with us through our website, our Facebook and Instagram pages, Meta lead ads, or in person — in compliance with the Data Privacy Act of 2012 (RA 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

1. Information we collect

When you book a consultation or ask about our services, we collect:

• Contact details — your name and contact number, and your email address where our booking form asks for it.
• Booking details— the service you're interested in, your preferred date and time, and any notes you choose to share with us.
• Facebook/Meta lead ad details— if you respond to one of our ads through Meta's Instant Forms, Meta shares the name and contact number you submitted there directly with us.
• Technical information — basic device and browser information, and which page or ad brought you to our site, collected automatically to help us measure our advertising and keep our booking process working properly.

We do not ask for or knowingly collect sensitive personal information (such as health records or medical history) through our website or ad forms. Any health or treatment details you share are given directly to our staff or physician, in person, as part of your in-clinic consultation.

2. How we use your information

We use the information above to:

• Confirm, schedule, and manage your appointment or consultation request;
• Contact you about your booking, including confirmations, reminders, and follow-up communications;
• Respond to questions or notes you send us; and
• Understand which of our ads and pages are actually leading to real bookings, so we can advertise responsibly and avoid wasting ad spend.

3. Legal basis for processing

We process your personal information on the basis of your consent — given when you voluntarily submit your name and contact details through our website's booking form or through a Meta lead ad form. You may withdraw this consent at any time by contacting us using the details in Section 7; this will not affect the lawfulness of anything already done with your information beforehand, but may mean we're no longer able to process or follow up on an existing booking request.

4. Sharing your information

We do not sell your personal information. We share it only in the following limited ways:

• With Meta (Facebook/Instagram), for advertising measurement.We advertise on Facebook and Instagram, and use Meta's Pixel and Conversions API to measure which ads lead to a real booking. A securely encrypted (hashed) version of your contact details may be shared with Meta for this purpose — Meta cannot read your actual email or phone number from this, only a scrambled version used for matching and ad optimization. This is a legitimate business purpose: it lets us measure our advertising honestly, and lets Meta show our ads to people more likely to be genuinely interested in our services, instead of showing them to everyone indiscriminately.
• With our own clinic staff, strictly to schedule and deliver the consultation or service you requested.
• When required by law — if disclosure is required by a valid order from a court, regulator, or government authority.

We do not share your information with any other third party for their own marketing purposes.

5. Data retention and security

We keep your booking information for as long as reasonably necessary to fulfill the purposes described in this policy — generally, for the duration of our ongoing relationship with you as a client, and for a limited period afterward to respond to follow-up questions and to meet our own recordkeeping and legal obligations. We periodically review and dispose of personal information that is no longer needed.

We apply reasonable organizational, physical, and technical safeguards to protect your information against accidental or unlawful loss, access, disclosure, or misuse — including restricting access to booking records to staff who need it to do their jobs, and using secure, access-controlled systems to store it.

6. Your rights as a data subject

Under the Data Privacy Act of 2012, you have the right to:

• Be informed that your personal information will be, is being, or was processed;
• Access your personal information that we hold;
• Correct any inaccurate or outdated information we hold about you;
• Object to the processing of your information, including withdrawing your earlier consent;
• Erasure or blocking of your personal information, under applicable conditions (for example, if it was unlawfully obtained or is no longer necessary for the purpose it was collected);
• Data portability, to obtain a copy of your data in an electronic format, where applicable; and
• Damages, for any damage sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal information.

To exercise any of these rights, contact us using the details in Section 7. We will respond within a reasonable time and in accordance with the requirements of the Data Privacy Act.

7. Contact us / Data Protection Officer

For questions about this Privacy Policy, or to exercise any of your rights above, you may reach our Data Protection Officer at:

YSA Luxe — SM San Lazaro, Manila (LG Floor)
Email: hello@ysaluxe.com
Phone: +63 920 972 7000

If you believe your data privacy rights have not been respected, you may also file a complaint with the National Privacy Commission (NPC) at privacy.gov.ph.

8. Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised "Last updated" date above.