Privacy Policy

Welcome to Dr Advance Skin. This Privacy Policy constitutes a legally binding agreement between you (“User”, “you”, or “your”) and Dr Advance Skin (“DAS”, “we”, “us”, or “our”), a medical aesthetics centre operating in Hong Kong.

Dr Advance Skin is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information when you visit our website, submit an enquiry, communicate with us, or receive our aesthetic treatments and related services (together, the “Services”).

This Policy is governed by the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (“PDPO”) and applicable data protection principles. Where you are located outside Hong Kong, additional local laws may also apply.

2.1 Information You Provide

We may collect the following categories of personal data that you voluntarily provide:

• Identity Data: name and other details you share when booking or attending a consultation
• Contact Data: email address, phone number, and WhatsApp number
• Enquiry Data: treatment of interest (such as DAS Eye Remodeling, DAS Contour Remodeling, DAS Skin, or DAS Lift), preferred language, campaign or page source, and any message you send us
• Health and Aesthetic Data: skin concerns, aesthetic goals, treatment history, lifestyle information, and other details you or your specialist record in connection with a consultation or treatment, including clinical photographs where taken for assessment or treatment records
• Communications: messages, feedback, and enquiries sent through our website forms, WhatsApp, telephone, or in person

We do not create public user accounts on this website, and we do not collect or store full payment card numbers through the website. Any in-clinic payment is handled separately at the centre.

2.2 Information Collected Automatically

When you use our website, we may automatically collect:

• Device and Technical Data: IP address, browser type and version, operating system, and device identifiers
• Usage Data: pages visited, features used, time spent, click-stream data, and referring URLs
• Cookie Data: as described in Section 4 below

2.3 Information from Third Parties

We may receive data about you from third-party sources, including:

• Social media platforms, if you contact us or interact with our official pages (for example Instagram or Facebook)
• Hosting, analytics, and communication partners who help us operate the Services
• Referral or campaign partners, where you have chosen to share your details with them

We use your personal data for the following purposes:

• Service Delivery: to respond to enquiries, arrange consultations, and provide, manage, and improve the treatments you request
• Treatment Personalisation: to assess your concerns and tailor aesthetic recommendations to your individual profile (with your consent where required)
• Communications: to send appointment updates, aftercare guidance, and, where permitted, newsletters or promotional materials — you may opt out at any time
• Safety and Security: to detect fraud, abuse, and threats to the security of our Services
• Legal Compliance: to comply with applicable laws, regulations, and lawful requests
• Analytics and Improvement: to understand how our website and Services are used and to improve functionality and user experience

We do not sell your personal data to third parties. We do not use your health or aesthetic treatment data for advertising profiling without your explicit consent.

We use cookies and similar technologies to operate our website, remember your language preference, and understand how visitors use our Services.

• Essential cookies: required for the website to function securely and to remember settings such as language
• Analytics and performance cookies: help us understand page views, referral sources, and technical issues so we can improve the site

You can control or delete cookies through your browser settings. If you disable essential cookies, some parts of the website may not work as intended. Where required, we will seek your consent before using non-essential cookies.

We may share your personal data with the following categories of recipients:

• Service Providers: third-party vendors who assist us in operating the Services (for example cloud hosting, form processing, messaging, and analytics), bound by confidentiality obligations
• Clinical and Care Team: specialists and staff involved in your consultation, treatment, or aftercare
• Integrations You Trigger: if you submit a campaign or sale-page enquiry, we may pass your details to the operational tools configured for that page so our team can follow up
• Legal Authorities: where required by law, court order, or regulatory authority
• Business Transfers: in connection with a merger, acquisition, or sale of assets — we will notify you of any change in data controller where required

We are based in Hong Kong. If you access our Services from outside Hong Kong, your data may be transferred to and processed in Hong Kong or other jurisdictions where our service providers operate.

Where such transfers occur, we take appropriate measures to ensure your data is protected to a standard consistent with the PDPO and applicable international standards, including the use of contractual safeguards.

We retain your personal data for as long as necessary to fulfil the purposes set out in this Policy, to provide the Services, to comply with legal obligations, and to resolve disputes. The criteria we use to determine retention periods include:

• The duration of your relationship with us and the nature of the Services provided
• Applicable statutory or regulatory retention requirements (for example tax, accounting, or health-record obligations)
• Limitation periods for potential legal claims

Upon expiry of the applicable retention period, your personal data will be securely deleted or anonymised.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These include:

• Encryption of data in transit (TLS) and, where appropriate, at rest
• Access controls and role-based permissions for our team and systems
• Regular review of our hosting and operational security practices
• Staff awareness of confidentiality when handling client and enquiry information

Despite our efforts, no method of data transmission or storage is completely secure. If you believe your information has been compromised, please contact us immediately.

Under the PDPO and applicable laws, you have the following rights in relation to your personal data:

• Right of Access: to request a copy of the personal data we hold about you (subject to a reasonable processing fee as permitted by law)
• Right to Correction: to request correction of inaccurate or incomplete data
• Right to Erasure: to request deletion of your data in certain circumstances
• Right to Opt Out: to opt out of direct marketing communications at any time
• Right to Withdraw Consent: where processing is based on consent, to withdraw that consent at any time (without affecting the lawfulness of prior processing)
• Right to Lodge a Complaint: with the Office of the Privacy Commissioner for Personal Data, Hong Kong (www.pcpd.org.hk)

To exercise any of these rights, please contact us using the details below. We will respond within 40 days as required by the PDPO.

The Services are not directed at or intended for use by children under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected personal data from a child without appropriate consent, we will take steps to delete such information promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by updating the “Effective Date” at the top of this document and, where appropriate, by sending you a notification.

We encourage you to review this Policy periodically. Your continued use of the Services after any changes constitutes your acceptance of the updated Policy.