Privacy Policy

Aurelle + Aesthetics ("Aurelle", "we", "us", "our") is committed to protecting your personal data in accordance with the Personal Data Protection Act 2012 of Singapore (the "PDPA"). This Privacy Policy explains how we collect, use, disclose and safeguard your personal data when you visit our website, contact us, book through our booking partner, or receive treatments at our clinic. It supplements our website Terms & Conditions.

Where we rely on consent, we will make the relevant purposes clear to you at the point of collection. For certain processing we rely on deemed consent or other bases permitted under the PDPA. By providing your personal data for a stated purpose, you consent to its use for that purpose.
 

1.1 Personal data we collect
 

Depending on how you interact with us, we may collect:

• Identity and contact data: your name, email address, mobile number, and (where you choose to provide it) your social media handle.

• Booking and appointment data: the treatments you book, appointment dates and times, and related notes, captured through our third-party booking platform (Fresha) and our enquiry forms.

• Health and treatment information: information relevant to your treatment and suitability, which may include skin or body concerns, treatment history, allergies, medication, and pregnancy or breastfeeding status, that you share during consultation. We collect this only to deliver your treatment safely.

• Payment-related data: payment is processed by our booking platform and/or payment service providers. We do not store full card numbers on our own systems.

• Marketing preferences: your consent (or withdrawal of consent) to receive offers and updates.

• Website and technical data: IP address, device and browser type, and usage information collected through cookies and analytics tools when you visit our website.

1.2 How we collect personal data
 

We collect personal data directly from you (through our website forms, WhatsApp, telephone, email, in-clinic consultation and our Fresha booking page), automatically through cookies and analytics when you use our website, and occasionally from third parties such as referrals or where you interact with our social media pages.
 

1.3 Health information: how we collect and protect it
 

We collect health and treatment information only with your express consent, obtained at consultation (including via your signed consultation and consent form), and we use it solely to assess suitability and to deliver your treatment safely. Access to your treatment records is restricted to staff directly involved in your care. We take reasonable steps to keep this information accurate and complete, as it informs decisions about whether a treatment is safe for you; please keep it up to date and tell us of any changes.
 

1.4 Purposes for which we use your personal data
 

We use your personal data to: provide, personalise and carry out your treatments safely and assess suitability; manage bookings, appointments, confirmations, reminders and rescheduling; respond to your enquiries and provide customer care; process payments and maintain transaction records; send appointment reminders and, where you have consented, marketing information; maintain, improve and secure our website and services; and comply with applicable laws and lawful requests and protect the safety of our clients and staff. We will only use your personal data for the purposes for which it was collected, or a directly related purpose, unless we obtain fresh consent or are otherwise permitted by law.
 

1.5 Marketing messages and the Do Not Call rules
 

Appointment reminders and confirmations are service messages relating to your booking. Marketing and promotional messages sent to your Singapore telephone number (by call, SMS or other addressed channels) are sent only where you have given clear and unambiguous consent, or where permitted under the Do Not Call provisions of the PDPA, including the ongoing-relationship exemption for related products and services. You can opt out of marketing at any time by replying STOP to a marketing message, using any unsubscribe facility provided, or contacting our Data Protection Officer. Opting out of marketing will not stop service messages about appointments you have booked.
 

1.6 Withdrawing consent
 

You may withdraw your consent for any purpose at any time by contacting our Data Protection Officer. We will act on your request within a reasonable time and tell you of the likely consequences (for example, that we may be unable to provide a particular service, as we cannot manage a booking without your contact details). Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
 

1.7 Disclosure of personal data
 

We do not sell your personal data. We may disclose it to: our booking platform (Fresha) and payment service providers, to manage appointments and process payments; IT, cloud hosting, communications and analytics service providers who support our operations under appropriate confidentiality obligations; professional advisers (such as accountants, insurers and lawyers) where reasonably necessary; and government agencies, regulators or law enforcement where required or permitted by law.
 

1.8 Transfer of personal data outside Singapore
 

Our booking platform (Fresha) and certain cloud, communications and analytics providers may store or process personal data outside Singapore. Where we transfer personal data overseas, we rely on contractual arrangements requiring the recipient to provide a standard of protection comparable to the PDPA, consistent with section 26 of the PDPA and the related transfer requirements.
 

1.9 Cookies and analytics
 

Strictly necessary cookies are required for our website to function. Analytics and any marketing cookies are used only with your consent, which you can give or withdraw through any cookie banner we provide or through your browser settings. Disabling some cookies may affect how the website works.
 

1.10 Retention
 

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law (for example, for tax, accounting or insurance purposes). When personal data is no longer needed, we take reasonable steps to securely dispose of or anonymise it.
 

1.11 Protection and accuracy of your personal data
 

We make reasonable security arrangements to protect personal data in our possession or control against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. We also take reasonable steps to keep personal data accurate and complete for the purposes for which it is used. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
 

1.12 Data breach notification
 

If a data breach occurs that is likely to result in significant harm to affected individuals, or is of a significant scale, we will notify the Personal Data Protection Commission (PDPC) and affected individuals as required under the PDPA. We maintain a data breach response process to assess, contain and report incidents within the timeframes prescribed by law (including notifying the PDPC as soon as practicable, and in any case within 3 calendar days of assessing a notifiable breach).
 

1.13 Your rights: access and correction
 

Subject to the PDPA, you may request access to the personal data we hold about you and information about how it has been used or disclosed, and you may request correction of any error or omission. We will respond as soon as practicable, and ordinarily within 30 days; if we cannot, we will tell you the time by which we will respond. Any fee for an access request will be reasonable and notified to you in advance, and we will not begin processing it until you agree to the fee. To make a request, please contact our Data Protection Officer.
 

1.14 Data Protection Officer
 

For any questions, requests or complaints about this Policy or your personal data, please contact our Data Protection Officer.

Name: Tang Ting
Email: info@aurelleaestheticsg.com
Phone: +65 8987 7055
Address: 138 Robinson Road, #03-13 Oxley Tower, Singapore 068906.
 

1.15 Third-party links and platforms
 

Our website and communications may link to third-party platforms (such as Fresha, WhatsApp, Google Maps and social media). Those platforms are governed by their own privacy policies, and we are not responsible for their practices. Please review their policies before providing personal data to them.
 

1.16 Minors
 

Our services and website are intended for individuals aged 18 and above. We do not knowingly collect personal data from anyone under 18 through our website. If you believe a minor has provided us with personal data, please contact us and we will take appropriate steps to delete it.
 

1.17 Changes to this Policy
 

We may update this Policy from time to time, for example to reflect changes in our services, our partners or the law. We will post the updated Policy on this page and update the "Last updated" date. We will not apply changes retrospectively in a way that reduces your protections without an appropriate basis. Your continued use of our website or services after changes take effect constitutes acceptance of the revised Policy.