Privacy Policy

GDPR · Last updated: 7 September 2026

Your privacy matters to us, and the information you share with an aesthetic clinic is among the most sensitive there is. This policy explains what personal data The Royal Aesthetics collects, why we collect it, how long we keep it and what rights you have under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Romanian Law no. 190/2018.

1. Who is responsible for your data

The data controller is:

S.C. ROYAL AESTHETICS BY KASEM S.R.L.

Trade Register No.: J2026044890009

Sole Registration Code (CUI): 55240086

Registered office: Sat Afumați, Comuna Afumați, Județul Ilfov, Strada Linia de Centură, Nr. 17, Ap. 126, Romania

Email: contact@theroyalaesthetics.com

For any question about this policy or about how we handle your data, write to us at contact@theroyalaesthetics.com with the subject line “Data protection”.

2. Scope of this policy

This policy applies to personal data we process through the website theroyalaesthetics.com, through our contact and appointment forms, by email, telephone and messaging apps, through our social media pages, and in the course of providing consultations and treatments at our clinic.

3. What data we collect

3.1 Data you give us

Identification and contact data — name and surname, email address, telephone number, country or city of residence, preferred language.
Appointment data — the procedure you are interested in, preferred dates, the content of your message, and any notes taken during a consultation enquiry.
Health data — medical history, current medication, allergies, previous procedures, photographs of the treatment area, clinical assessments, consent forms and treatment records. This is a special category of personal data under Article 9 GDPR and receives heightened protection.
Billing data — invoicing name and address, tax identifiers where applicable, and payment references. We do not store full card numbers; card payments are handled by our payment provider.
Marketing preferences — your newsletter subscription status and consent records.

3.2 Data collected automatically

Technical data — IP address, browser type and version, device type, operating system, screen resolution, referring URL and approximate location derived from IP.
Usage data — pages viewed, time on page, links clicked, form interactions and scroll behaviour.
Cookie data — identifiers stored on your device. See our Cookie Policy.

3.3 Data from third parties

We may receive your contact details from social media platforms when you send us a message or fill in a lead form, and from advertising platforms in aggregated, non-identifying form.

4. Why we process your data and on what legal basis

Purpose	Data used	Legal basis
Responding to enquiries and consultation requests	Identification, contact, appointment data	Steps taken at your request prior to entering a contract — Art. 6(1)(b) GDPR
Scheduling and managing appointments	Contact and appointment data	Contract performance — Art. 6(1)(b) GDPR
Medical assessment, treatment planning and delivery of care	Health data, clinical photographs	Provision of health care and management of health care services by or under the responsibility of a health professional bound by professional secrecy — Art. 9(2)(h) GDPR, together with Art. 6(1)(b)
Obtaining and recording informed consent	Health data, signed consent forms	Legal obligation — Art. 6(1)(c) and Art. 9(2)(h) GDPR
Using before-and-after photographs in marketing	Clinical photographs	Your explicit, separate and freely withdrawable consent — Art. 9(2)(a) GDPR
Invoicing, accounting and tax reporting	Billing data	Legal obligation — Art. 6(1)(c) GDPR
Newsletters and marketing communications	Email address, marketing preferences	Your consent — Art. 6(1)(a) GDPR
Website analytics and service improvement	Technical and usage data	Your consent for non-essential cookies — Art. 6(1)(a) GDPR
Website security, fraud and abuse prevention	Technical data, logs	Our legitimate interest in keeping the site secure — Art. 6(1)(f) GDPR
Establishing, exercising or defending legal claims	Any relevant data	Legitimate interest — Art. 6(1)(f); for health data, Art. 9(2)(f) GDPR

We never use your health data or clinical photographs for advertising without your separate, explicit and clearly documented consent. Consent given for marketing use of images can be withdrawn at any time, and we will stop using the images in any material we still control.

5. Who we share your data with

We do not sell your personal data. We share it only with:

Our medical and clinical staff, each bound by medical confidentiality, strictly on a need-to-know basis.
Partner clinics, laboratories, anaesthetists and hospitals where required for your treatment, and only with your knowledge.
Service providers acting as processors on our instructions — website hosting, email delivery, CRM and appointment tools, analytics providers, and payment processors. Each is bound by a data processing agreement under Art. 28 GDPR.
Professional advisers — accountants, auditors, lawyers and insurers, where necessary.
Public authorities, where we are legally obliged to disclose data.

6. International transfers

Some of our service providers — including our website host and certain analytics and communication tools — are established outside the European Economic Area, in particular in the United States. Where personal data is transferred outside the EEA, we rely on an adequacy decision of the European Commission or on Standard Contractual Clauses adopted under Art. 46(2)(c) GDPR, together with supplementary technical measures where appropriate. You may request a copy of the relevant safeguards by writing to us.

7. How long we keep your data

Category	Retention period
Website enquiries that do not lead to treatment	Up to 3 years from the last contact
Medical records and consent forms	For the minimum period required by applicable Romanian healthcare legislation, and in any case for as long as necessary to defend potential medical liability claims
Clinical photographs used in marketing	Until you withdraw consent, and then removed from material under our control
Invoices and accounting records	10 years, under Romanian Accounting Law no. 82/1991
Newsletter subscriptions	Until you unsubscribe, plus 3 years to evidence consent
Server logs and security records	Up to 12 months
Cookies	As stated in our Cookie Policy

When a retention period ends, data is securely deleted or irreversibly anonymised.

8. How we protect your data

We apply technical and organisational measures appropriate to the risk, including encryption of the website in transit (HTTPS), access controls and role-based permissions, separation of clinical records from marketing systems, confidentiality undertakings for all staff, secure storage of physical records, regular backups, and periodic review of our processors. No system is perfectly secure, but we take our obligations under Art. 32 GDPR seriously, and we will notify you and the supervisory authority of a personal data breach where the law requires it.

9. Your rights

Under the GDPR you have the right to:

Access your personal data and obtain a copy of it.
Rectify inaccurate or incomplete data.
Erasure (“right to be forgotten”), subject to our legal obligation to retain medical and accounting records.
Restrict processing in certain circumstances.
Data portability — receive data you provided to us in a structured, machine-readable format.
Object to processing based on our legitimate interests, and to object to direct marketing at any time.
Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Not be subject to decisions based solely on automated processing producing legal or similarly significant effects. We do not carry out such automated decision-making or profiling.

To exercise any of these rights, email contact@theroyalaesthetics.com. We will respond within one month; that period may be extended by two further months for complex requests, and we will tell you if that happens. We may ask you to confirm your identity before disclosing health data.

10. Complaints to the supervisory authority

If you believe we have not handled your data lawfully, you may lodge a complaint with the Romanian supervisory authority:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, 010336 București, Romania

Website: www.dataprotection.ro

You may also complain to the supervisory authority of your own EU country of residence.

11. Cookies and tracking

Our use of cookies, pixels and similar technologies, and how to change your choices, is described in our Cookie Policy.

12. Children

Our services are directed at adults. We do not knowingly collect personal data from anyone under 18 without the involvement and consent of a parent or legal guardian. Treatments for minors, where lawful and clinically appropriate, are only carried out with documented parental or guardian consent.

13. Third-party websites

This website may link to third-party sites and social media platforms. We are not responsible for their privacy practices, and we encourage you to read their policies before sharing data with them.

14. Changes to this policy

We may update this policy to reflect changes in our practices or in the law. The date at the top of the page shows when it was last revised. Where changes are material, we will draw them to your attention by a notice on the website or by email.

15. Contact

Questions, requests and complaints about data protection: contact@theroyalaesthetics.com. See also our Legal Notice, Terms & Conditions and Medical Disclaimer.