Privacy Policy

Last updated: 26 August 2026

Aeconic Aesthetic Clinic (“Aeconic”, “we”, “us”) is a doctor-led skin clinic in Berawa, Canggu. This policy explains what personal information we collect through aeconicaesthetic.com and in the course of treating you, why we collect it, who can see it, and what you can ask us to do with it.

Health information is treated as specific personal data under Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP), and separately protected by medical confidentiality rules. We handle it accordingly — the standard applied to your consultation notes is higher than the one applied to a newsletter sign-up, and this policy keeps the two clearly apart.

1. Who we are

Aeconic Aesthetic Clinic operates at Jl. Subak Sari No. 30a, Tibubeneng, Kec. Kuta Utara, Kabupaten Badung, Bali 80361, Indonesia. We are the controller of the personal data described here.

Questions about your data, or about anything in this policy, can go to aeconicclinic@gmail.com or WhatsApp +62 811 2503 3440, Monday to Saturday, 10:00–17:00 WITA.

2. What this policy covers

It covers two separate things:

• Website and enquiry data — what happens when you browse the site, send a WhatsApp message, submit a form or subscribe to updates.
• Clinical data — what we record once you become a patient, including your medical history, examination findings, treatments and clinical photographs.

Clinical records are held separately from the website, under medical confidentiality, and are not accessible through it.

3. Information we collect

3.1 When you contact us

• Your name, phone number, email address and the content of your message.
• What you tell us about your skin concern, including any photographs you send us before a visit.
• Your travel dates or departure date, where you share them so we can time treatment around your trip.
• Your email address if you subscribe to clinic updates.

3.2 When you become a patient

• Identity and contact details, date of birth, and emergency contact where relevant.
• Medical history: existing conditions, medications, allergies, previous aesthetic treatments, and whether you are pregnant or breastfeeding.
• Examination findings, skin mapping, the doctor’s assessment, and the treatment plan and written quote issued to you.
• Products and devices used, including brand, batch number and dose, which we are required to record.
• Clinical photographs taken before, during and after treatment.
• Payment records for treatments received.

3.3 Collected automatically on the website

• IP address, browser, device type, operating system and language.
• Pages and treatment pages viewed, filters used, time on site, and the search or link that brought you here.
• Cookie and analytics identifiers, described in section 6.

4. Health data and your consent

Medical history, examination findings, treatment records and clinical photographs are health data. We collect them only where they are necessary to assess whether a treatment is safe and suitable for you, to carry it out, and to review the result.

We ask for your explicit consent before treatment, after the doctor has explained what is proposed, what it will and will not achieve, and what the risks are. You can refuse or stop at any point, including after consenting, and doing so will not affect the care you receive. Certain treatments are not appropriate during pregnancy, breastfeeding, active infection or with particular medical conditions — which is why we ask, and why we sometimes decline.

5. Clinical photographs

Before-and-after photography is part of how we assess results, and we take it for every patient whose plan involves visible change. Those photographs are clinical records.

Publishing them is a separate decision, and a separate consent. No photograph of you appears on this website, our Instagram, or anywhere else unless you have given specific written permission for that use. Consent to be treated is never taken as consent to be published.

You can withdraw publication consent at any time by messaging us. We will remove the image from our own website and social accounts. Where an image has already been reshared or archived by third parties, we will do what we reasonably can, but we cannot guarantee removal from platforms outside our control. Withdrawing publication consent does not delete the photograph from your clinical record, which we are required to keep.

6. Cookies and analytics

Cookies are small files stored on your device. We use them to:

• Run the site — deliver pages, remember your treatment filter selections, and process form submissions. These are strictly necessary.
• Measure performance — understand, in aggregate, which treatment pages and area guides people read, so we know what to improve.
• Measure campaigns — where we advertise, to see which ads bring people to the site.

Analytics tell us that a page about, say, chemical peeling was viewed — not that you viewed it. We do not link browsing behaviour on this website to your patient record, and we do not build advertising audiences from your treatment history.

You can block or delete cookies in your browser at any time. Blocking strictly necessary cookies will stop parts of the site from working.

7. WhatsApp and messaging

WhatsApp is our main booking channel. Messages between you and the clinic are encrypted in transit by WhatsApp, but the service is operated by a third party that processes connection and account metadata under its own privacy terms.

If you send photographs of your skin before a visit, we treat them as confidential and store them with your enquiry. If you would rather not share images over WhatsApp, say so and we will arrange the assessment in clinic instead — it costs you nothing and changes nothing about your treatment.

8. Why we use your information

Purpose	Basis under UU PDP
Answering enquiries and scheduling consultations	Steps taken at your request
Assessing suitability and performing treatment	Explicit consent / performance of a contract
Keeping medical records and product traceability	Legal obligation
Reviewing results and planning follow-up sessions	Explicit consent / performance of a contract
Publishing before-and-after photographs	Separate written consent, withdrawable
Sending clinic updates and offers	Your consent, withdrawable at any time
Site security, spam prevention and analytics	Legitimate interest / your consent
Accounting and tax records	Legal obligation

9. Who can see your information

We do not sell your data, and we do not share your treatment history with anyone for marketing purposes. Access is limited to:

• Clinic staff — the doctor and clinical team, on a need-to-know basis, plus reception for scheduling and payment.
• Healthcare professionals you are referred to — only with your knowledge and agreement.
• Service providers — hosting, email, form handling, messaging and analytics, acting on our instructions.
• Our website development partner — see section 10.
• Authorities and professional bodies — where disclosure is required by Indonesian law, a valid legal process, or in a medical emergency.

10. Website development and maintenance partner

Core Freelancers is our appointed digital partner and carried out the redesign of aeconicaesthetic.com. It continues to maintain and improve the site. In that role, Core Freelancers has authorised technical access to the website — the content management system, hosting environment, plugins and page templates — and, where necessary for troubleshooting, to website enquiry data such as form submissions.

This access does not extend to clinical records. Patient medical histories, consultation notes and clinical photographs are held under medical confidentiality, separately from the website, and are not reachable through it.

Core Freelancers acts as a data processor: it handles website data only on our instructions, solely to build, secure, fix and improve the site, and is bound by confidentiality obligations. It does not use your data for its own purposes and does not sell or share it.

11. How long we keep it

• Medical records and clinical photographs — retained for at least five years from your last treatment, as required by Indonesian medical records regulations, and often longer where a treatment plan runs across years.
• Consent forms — kept with the corresponding record for the same period.
• Enquiries that don’t lead to a visit — up to two years from our last contact.
• Payment and accounting records — as required by Indonesian tax law, generally ten years.
• Newsletter data — until you unsubscribe, plus a short suppression record so we don’t contact you again.
• Analytics and server logs — in aggregated or shortened form, generally up to 26 months.

12. Your rights

Under UU PDP you can ask us to:

• Tell you what data we hold about you and why.
• Give you access to it, including a copy of your medical record.
• Correct anything inaccurate or incomplete.
• Delete data we no longer have grounds to keep.
• Stop sending you marketing, or withdraw any consent you have given.
• Restrict or object to particular processing.

Email aeconicclinic@gmail.com or ask at reception. We may need to verify your identity before releasing medical information. We cannot delete records we are legally required to retain, but we can stop using them for anything beyond that requirement — for example, removing a published photograph while keeping the clinical original on file.

13. Security

The website runs over an encrypted HTTPS connection with restricted administrator access and regular updates. Clinical records are kept on access-controlled systems and in secured storage at the clinic, available only to staff who need them. Clinical photographs are stored separately from public marketing assets so the two cannot be confused.

No system is entirely risk-free. If a breach affects your personal data, we will notify you and the relevant authority as required by law.

14. Patients under 18

Aesthetic treatment at Aeconic is intended for adults. Where we accept a patient under 18 for a limited, clinically appropriate treatment, a parent or legal guardian must consent and be present at the consultation, and their consent governs the handling of that patient’s data. We do not publish photographs of minors.

15. International patients

Many of our patients are visitors and expatriates. Your data is processed in Indonesia under Indonesian law, and some of our service providers — hosting, email, messaging and analytics — process data on servers outside Indonesia. Where that happens, we take reasonable steps to ensure a level of protection consistent with UU PDP. If you are covered by data protection laws in your home country, contact us and we will do our best to accommodate a request made under them.

16. Third-party links, reviews and social media

Our pages link to Google Maps, Google reviews and our Instagram account. Content embedded from those platforms behaves as though you had visited them directly: it may set cookies and collect data about you, particularly if you are logged in. Reviews you leave on Google or Instagram are public and governed by those platforms, not by this policy.

17. Changes to this policy

We may update this policy as our services, tools or legal obligations change. The version published here is the one in force, and the date at the top shows the latest revision. If a change materially affects how we handle patient data, we will say so at your next visit.

18. Contact