Privacy Policy

Effective date: 15 July 2026
Website: https://eliodermal.co.za
Responsible party: Eliö Dermal
Telephone/WhatsApp: (071) 283-3760
Email: lishe@eliodermal.co.za
Address: Unit 28, Second Floor, Joubert Plaza 1, 100 Meade Street, George, Western Cape, South Africa

1. Introduction

Eliö Dermal respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store, share and protect personal information when you:

Visit our website;
Contact us;
Submit an enquiry;
Make an appointment;
Attend a consultation;
Receive a treatment;
Purchase a product or package;
Subscribe to marketing communications;
Enter a promotion; or
Interact with us through social media or another platform.

We process personal information in accordance with the Protection of Personal Information Act 4 of 2013, commonly known as POPIA, and other applicable South African laws.

2. Who Is Responsible for Your Information?

For the purposes of POPIA, Eliö Dermal is the responsible party that determines how and why personal information is processed.

Contact details:

Eliö Dermal
Unit 28, Second Floor
Joubert Plaza 1
100 Meade Street
George, Western Cape
South Africa

Telephone/WhatsApp: (071) 283-3760
Email: lishe@eliodermal.co.za
Website: https://eliodermal.co.za

3. What Is Personal Information?

Personal information is information relating to an identifiable person or, where applicable, an identifiable organisation.

It may include:

Names;
Contact details;
Identification information;
Photographs;
Appointment information;
Transaction information;
Online identifiers; and
Information about a person’s health, skin or treatment history.

Certain information, including health information, may be classified as special personal information and requires additional protection.

4. Information We May Collect

4.1 Contact and Identity Information

We may collect:

Full name;
Email address;
Telephone or WhatsApp number;
Date of birth;
Age;
Address;
Emergency contact information; and
Parent or guardian details where applicable.

4.2 Appointment Information

We may collect:

Requested treatment;
Appointment date and time;
Booking history;
Cancellation and rescheduling information;
Preferred practitioner;
Special requests; and
Booking notes.

4.3 Consultation and Health Information

Because we provide skincare and aesthetic treatments, we may collect relevant information about:

Skin concerns;
Skin type and condition;
Allergies;
Sensitivities;
Medical history;
Medication and supplements;
Pregnancy or breastfeeding;
Previous treatments and procedures;
Reactions to products or treatments;
Lifestyle factors;
Current skincare routine;
Products currently being used;
Treatment contraindications;
Treatment progress; and
Preparation and aftercare compliance.

We only request information reasonably necessary to assess treatment suitability, provide services safely and maintain appropriate client records.

4.4 Treatment Records

We may keep records of:

Consultations;
Treatment plans;
Treatments performed;
Products used;
Product batch details where relevant;
Treatment settings and protocols;
Client consent;
Advice and aftercare instructions;
Reported side effects or reactions; and
Follow-up communications.

4.5 Photographs

With appropriate consent or another lawful basis, we may collect:

Skin analysis photographs;
Before-and-after photographs;
Treatment progress photographs;
Images voluntarily submitted by clients; and
Marketing photographs.

Clinical photographs and marketing photographs may be subject to separate consent choices.

4.6 Payment and Transaction Information

We may collect:

Amounts paid;
Payment dates;
Payment references;
Invoice information;
Products or services purchased;
Deposit information;
Refund information; and
Limited payment confirmation information.

Card and banking details may be processed directly by a third-party payment provider. Eliö Dermal may not receive or store complete card information.

4.7 Website and Device Information

When you use the website, we or our service providers may collect:

IP address;
Browser type;
Device type;
Operating system;
Pages visited;
Referring website;
Time spent on the website;
Approximate location based on IP address;
Cookie identifiers; and
Website interaction data.

4.8 Communications

We may keep records of communications sent through:

Website forms;
Email;
Telephone;
WhatsApp;
SMS;
Social media;
Booking platforms; and
In-person consultations.

4.9 Marketing Preferences

We may collect information about:

Newsletter subscriptions;
Marketing consent;
Preferred communication channels;
Promotions entered;
Messages opened or links selected; and
Requests to unsubscribe.

5. How We Collect Personal Information

We may collect information:

Directly from you;
Through website forms;
Through our booking system;
During consultations and treatments;
Through telephone, WhatsApp or email;
Through social media;
When you purchase a product or voucher;
From a parent or legal guardian;
From a person booking on your behalf;
From a payment service provider;
Automatically through cookies and website technologies; or
From another source where you have authorised the disclosure or where the law permits it.

Where possible, we collect personal information directly from the person concerned.

6. Why We Process Personal Information

We may process personal information to:

Respond to enquiries;
Schedule and manage appointments;
Send appointment confirmations and reminders;
Conduct consultations;
Assess treatment suitability;
Identify contraindications;
Develop personalised treatment plans;
Provide treatments safely;
Recommend appropriate homecare;
Monitor treatment progress;
Maintain client and consent records;
Process payments and issue invoices;
Manage deposits, cancellations and refunds;
Provide customer support;
Handle complaints;
Contact clients about reactions or follow-up care;
Administer promotions and packages;
Improve our website and services;
Protect our systems and prevent fraud;
Comply with legal, tax and regulatory requirements;
Establish, exercise or defend legal claims; and
Send marketing communications where permitted.

7. Lawful Grounds for Processing

Depending on the circumstances, we may process personal information because:

You have consented;
Processing is required to provide a service or fulfil an agreement with you;
Processing is necessary to take steps at your request before entering into an agreement;
We have a legal obligation;
Processing protects a legitimate interest of yours;
Processing is necessary for our legitimate business interests and does not unjustifiably interfere with your rights; or
Another lawful ground under POPIA applies.

Where we rely on consent, you may withdraw it. Withdrawal will not invalidate processing that occurred lawfully before consent was withdrawn.

8. Health and Special Personal Information

Skin consultation records may include health-related information and other special personal information.

We process this information only where permitted by law, including where:

You provide appropriate consent;
Processing is necessary to provide safe and appropriate services;
Processing is required to establish, exercise or defend a legal right;
Processing is required by law; or
Another lawful justification applies.

We restrict access to health and treatment information to persons who reasonably require it.

9. Information About Children

We do not knowingly collect personal information from children without appropriate authority.

Where a client is under 18, we may require consent or involvement from a competent person, such as a parent or legal guardian.

We may process a child’s information where:

A parent or guardian has provided appropriate consent;
Processing is required or permitted by law;
It is necessary to protect the child’s legitimate interests; or
Another lawful ground applies.

Parents and guardians should not submit unnecessary information about a child.

10. Marketing Communications

We may send information about:

Treatments;
Products;
Promotions;
Packages;
Events;
Skincare advice; and
Clinic updates.

We will send electronic marketing where:

You have consented;
You are an existing client and the communication is permitted by law; or
Another lawful basis applies.

You can unsubscribe at any time by:

Selecting the unsubscribe option in an email;
Replying to a message;
Contacting us directly; or
Asking us to update your communication preferences.

Service communications, such as appointment reminders and treatment follow-ups, are not necessarily marketing messages and may still be sent where required to provide the service.

11. Cookies and Similar Technologies

Our website may use cookies and similar technologies.

Cookies are small files stored on your browser or device. They may be used to:

Operate the website;
Remember preferences;
Improve website performance;
Understand how visitors use the website;
Secure website forms;
Measure marketing performance;
Integrate social media; and
Support booking or payment functionality.

Cookies may include:

Essential Cookies

These are required for the website to operate correctly and cannot always be disabled.

Analytics Cookies

These help us understand website traffic and user behaviour.

Functional Cookies

These remember choices and enable additional website features.

Marketing Cookies

These may be used to measure advertising or display relevant content.

You can control cookies through your browser settings and, where available, the website’s cookie banner. Disabling cookies may affect website functionality.

12. Website Analytics

We may use analytics services to understand:

How visitors find the website;
Which pages are viewed;
How long visitors remain on the website;
Which devices and browsers are used; and
Whether website functionality is operating effectively.

Analytics information may be aggregated or pseudonymised where appropriate.

13. How We Share Information

We do not sell personal information.

We may share information with trusted service providers that assist us with:

Website hosting;
Website maintenance;
Appointment scheduling;
Email delivery;
SMS or WhatsApp communication;
Cloud storage;
Payment processing;
Bookkeeping and accounting;
Marketing systems;
Customer relationship management;
IT support;
Security;
Professional advice; and
Legal or regulatory compliance.

We may also disclose information:

With your consent;
To a parent or guardian where appropriate;
To a healthcare practitioner where you request or authorise it;
Where necessary to address a serious health or safety concern;
Where required by law, court order or regulatory authority;
To investigate fraud or unlawful conduct;
To enforce an agreement or protect legal rights; or
In connection with a sale, transfer or restructuring of the business.

Service providers are expected to process personal information only for authorised purposes and to protect it appropriately.

14. Booking, Social Media and Payment Platforms

Our website may connect to third-party booking, payment, map, analytics or social media platforms.

When you use one of these services, the provider may collect personal information independently under its own privacy policy.

You should review the provider’s terms and privacy information before using the service.

15. International Transfers

Some website, booking, communication, cloud-storage or analytics providers may process information outside South Africa.

Where personal information is transferred across borders, we take reasonable steps to ensure that the transfer complies with POPIA. This may include using providers in countries with adequate protection or implementing appropriate contractual safeguards.

16. Information Security

We use reasonable technical and organisational measures designed to protect personal information against:

Loss;
Damage;
Unauthorised destruction;
Unlawful access;
Unauthorised disclosure; and
Unlawful processing.

Measures may include:

Password protection;
Access restrictions;
Secure hosting;
Software updates;
Malware protection;
Secure payment providers;
Staff confidentiality;
Backups; and
Limiting access to treatment records.

No electronic system is completely secure, and we cannot guarantee absolute security.

17. Security Incidents

If we reasonably believe that personal information has been accessed or acquired by an unauthorised person, we will investigate the incident and take appropriate steps.

Where required by law, we will notify the Information Regulator and affected persons as soon as reasonably possible.

18. How Long We Retain Information

We keep personal information only for as long as reasonably necessary to:

Provide services;
Maintain treatment records;
Manage the client relationship;
Comply with legal and tax obligations;
Resolve complaints;
Enforce agreements;
Respond to possible claims; and
Fulfil the purposes described in this policy.

Different records may be retained for different periods.

When information is no longer required, we may securely delete, destroy or de-identify it, unless continued retention is required or permitted by law.

19. Accuracy of Information

We take reasonable steps to keep personal information accurate and complete.

You should inform us when your:

Contact details;
Health information;
Medication;
Allergies;
Pregnancy status; or
Other relevant circumstances change.

Providing incomplete or outdated information may affect our ability to provide safe and appropriate treatment.

20. Your Rights

Subject to applicable law, you may have the right to:

Ask whether we hold personal information about you;
Request access to your personal information;
Request correction of inaccurate or incomplete information;
Request deletion or destruction of information where legally permitted;
Object to certain processing;
Withdraw consent;
Object to direct marketing;
Request information about third parties that have had access to your information; and
Submit a complaint to the Information Regulator.

Some rights may be limited where we must retain information to comply with law, preserve evidence, protect another person’s rights or establish or defend a legal claim.

21. Access, Correction and Deletion Requests

To request access, correction or deletion of your personal information, contact:

Email: lishe@eliodermal.co.za
Telephone/WhatsApp: (071) 283-3760

We may ask you to verify your identity before processing a request.

We will not provide personal information to a person who cannot demonstrate that they are authorised to receive it.

22. Complaints to the Information Regulator

You may contact the Information Regulator if you believe that your personal information has been processed unlawfully.

The current contact and complaint details of the Information Regulator are available through its official website.

We encourage you to contact Eliö Dermal first so that we have an opportunity to investigate and address your concern.

23. External Websites

Our website may contain links to external websites.

We are not responsible for the privacy, security, availability or content of external websites. This Privacy Policy applies only to information processed by Eliö Dermal.

24. Changes to This Privacy Policy

We may update this Privacy Policy when:

Our services change;
Our website changes;
We introduce new systems or providers;
Our processing activities change; or
Legal and regulatory requirements change.

The latest version will be published on this website with an updated effective date.

25. Contact Us

Questions, requests or complaints regarding personal information may be directed to:

Eliö Dermal
Unit 28, Second Floor
Joubert Plaza 1
100 Meade Street
George, Western Cape
South Africa

Telephone/WhatsApp: (071) 283-3760
Email: lishe@eliodermal.co.za
Website: https://eliodermal.co.za