Privacy Policy

1. Who we are, and how to reach us

AkariHeal is a beauty and relaxation studio in Thailand. This policy explains what personal information we hold about you, why we hold it, and what you can ask us to do with it. It is written to meet Thailand's Personal Data Protection Act B.E. 2562 (2019), the PDPA.

The data controller is [COMPANY LEGAL NAME], registration number [REGISTRATION NUMBER], registered at [REGISTERED ADDRESS], trading as AkariHeal.

For anything to do with your personal information, contact our data protection officer, [DPO NAME], at [DPO EMAIL], or write to the address above. We answer in Thai or English, whichever you prefer.

2. What this policy covers

This policy covers akariheal.com, the booking and account pages, the record we keep of your visits, and the information our specialists collect while caring for you in the studio.

It does not cover other companies' sites we link to. Once you leave ours, their policy applies instead of this one.

3. What we collect

When you create an account we collect your email address, and — if you give them — your phone number, the name you would like us to use, and the language you prefer to hear from us in. Your email address is required, because it is how we identify your account and how we send you booking confirmations.

If you sign in with LINE, LINE gives us your LINE user id, your display name, your profile picture and, where you have allowed it, your email address. We ask LINE for nothing beyond that. If you would rather we did not receive it, sign in with your email instead.

When you book, we record the branch, the treatment, the date and time, the specialist if you asked for one, and whatever you write in the note field on the booking form. That field is headed “Anything we should know?” and prompts you for allergies, skin conditions, or anything you would rather we avoided — so what you write there is often information about your health. Please tell us what matters for your safety during the treatment, and no more. Section 4 explains how we treat it.

When you visit, we record the visit, the treatment given, the specialist who performed it, and the notes described in section 4. We record what you paid, how you paid it — cash, bank transfer, or a card at the counter — the amount, and the payment reference. We take no card payments online and use no payment gateway, so we never receive or store your card number.

If you buy a prepaid package or a gift card, we record the purchase, the sessions remaining and how long they are valid. If you buy a gift card for someone else and give us their name, that name is another person's personal information. We use it only to issue the card and to check it when it is redeemed; we do not create an account for them and we do not contact them. Please let them know you have given us their name.

Our staff may keep short written notes on your account — that you prefer a particular specialist, say, or a particular time of day. These are working notes, not a private file. You can ask to see them at any time under section 11.

When you sign in, we store a record of the session including the browser or device you used and the IP address it connected from. When you ask for a sign-in link or code, we store your email address, a one-way hashed copy of the code, and how many times it has been tried. All of this exists to keep other people out of your account.

We keep an internal audit log of significant actions taken in our system: who did what, to which record, when, and from which IP address. The log stores a before-and-after snapshot of the record that changed, so it can contain copies of the information described above. It exists so that a mistake or a misuse can be traced.

4. Photographs and skin notes — sensitive information

Two of the things we hold are sensitive personal data under section 26 of the PDPA, and we handle them differently from everything else.

Photographs. With your explicit permission, a specialist may photograph your face and skin so that the condition of your skin can be compared between visits. The images are held in a private cloud storage bucket. They have no public address, they cannot be reached by guessing a link, and they are only ever delivered through a page that checks who is asking. They can be seen by you, by the specialist who treated you, and by the managers of the branch you visited. We never publish them, never use them in advertising or on social media, and never share them with anyone outside AkariHeal.

Our system will not store a photograph unless a record of your consent is attached to it. We ask out loud, in person, before the camera is switched on, and we record which wording you agreed to, when, how it was taken, and which member of staff took it. This consent is asked for on its own: accepting our Terms of Service or this policy is not consent to be photographed, and everything else we offer is available to you without a photograph ever being taken.

Skin notes. After each treatment a specialist writes a short note describing what they observed and what they used, so the next treatment can build on the last. Some of these notes are written for you and appear in your visit history. Others are marked internal and are visible only to our staff — working notes for the treatment record. You can still ask to see them, and to correct them, under section 11.

The note you write on the booking form is described in section 3. Where it describes an allergy or a skin condition we treat it as sensitive information too, and we use it only to keep you safe during your treatment. If you would rather not write it down, leave the field blank and tell your specialist in person when you arrive.

5. Why we use your information, and our lawful basis

Every use of your information needs a lawful basis under the PDPA. Where we rely on your consent you can withdraw it. Where we rely on something else, it is named below.

To take and hold your booking, deliver the treatment, run your prepaid package or gift card, and take payment. Basis: performance of our contract with you.

To send booking confirmations, changes, reminders and receipts. Basis: performance of our contract with you. These are service messages rather than marketing, and they cannot be switched off while you have a booking outstanding.

To take, store and show a photograph of your face and skin, and to keep the internal notes about your skin condition. Basis: your explicit consent, asked for separately and for this purpose alone.

To keep accounting records, tax invoices and receipts. Basis: our legal obligation under Thai revenue and accounting law.

To keep accounts and systems secure — sign-in records, rate limiting, and the audit log. Basis: our legitimate interest in preventing fraud and unauthorised access, weighed against your privacy. You can object under section 11, though we may need to keep some of it in order to protect other customers.

To understand which treatments are booked and how our branches are doing, and to calculate what we owe our staff. Basis: our legitimate interest in running the studio. We do this from booking and payment records, never from your photographs or your skin notes.

We do not send marketing messages. If we ever want to, we will ask for your consent separately first, and we will not treat your having booked with us as permission to market to you.

6. Cookies

We set only the cookies the site cannot work without: one that keeps you signed in, and two short-lived ones that let a LINE sign-in complete safely. Both are removed once they are no longer needed.

We use no analytics, no advertising pixels, no tracking scripts and no third-party fonts. Nothing on this site follows you to another site or reports your visit to anyone else. There is no cookie banner because there is nothing to ask you about.

7. Who we share it with

We do not sell your personal information. We do not trade it, and we do not give it to advertisers.

We use a small number of service providers who process information on our instructions and for no purpose of their own. Each is bound by a contract limiting what it may do with it.

Cloudflare, Inc. hosts our website and application, stores our database and our photographs, and provides rate limiting. It therefore has technical access to everything described in this policy. Cloudflare also keeps a log of requests made to our site, which includes IP addresses.

Resend delivers our transactional email — sign-in links, booking confirmations and receipts. It receives the recipient's email address and the full content of the message.

LINE Corporation provides the LINE sign-in option. If you use it, LINE knows you have signed in to AkariHeal. We send LINE nothing about your treatments.

We may also disclose information to our professional advisers, such as our accountant or a lawyer, where they need it and are bound to keep it confidential; and to a government authority, a court or a regulator where the law requires it of us.

Payment is taken at the studio or by bank transfer. We have no online card payment and no payment gateway, so no payment processor receives your information from us. Your own bank will of course see a transfer you make to us, under its own terms.

If our business is ever transferred to another owner, your information may transfer with it. We would tell you before that happened, and every right in this policy would stay with you.

8. Where your information is processed

Cloudflare and Resend both process personal data outside Thailand, on infrastructure in more than one country. This means your information — including your photographs, if you have consented to them — leaves Thailand.

The PDPA permits a transfer abroad only where the destination offers adequate protection or a recognised safeguard is in place. We rely on [CROSS-BORDER TRANSFER MECHANISM — to be confirmed by counsel], together with a data processing agreement with each provider. You may ask us for details of the safeguard we rely on at [DPO EMAIL].

LINE is operated from Japan, and LINE's own policy governs the account you hold with them.

9. How long we keep it

We keep information only as long as we have a reason to, and then delete it or make it anonymous. Where the law sets a minimum period, that period wins.

Account and contact details: [RETENTION PERIOD — account and contact details], counted from your last visit.

Bookings, visit records and the visit notes written for you: [RETENTION PERIOD — visit records].

Internal skin notes: [RETENTION PERIOD — internal treatment notes].

Photographs: kept until you withdraw your consent, or [RETENTION PERIOD — photographs], whichever comes first. Withdrawing consent deletes them at once — see section 11.

Payment, package, gift card and accounting records: [RETENTION PERIOD — accounting records], which is set by Thai revenue and accounting law and which we cannot shorten at your request.

Sign-in sessions and sign-in codes: sessions expire and are removed automatically; unused sign-in codes are removed shortly after they expire.

Audit log: [RETENTION PERIOD — audit log].

Consent records: kept for as long as we hold the information they permit, and for [RETENTION PERIOD — consent records] afterwards, so that we can show what you agreed to and when.

10. How we protect it

Photographs live in a private storage bucket. There is no public URL for them. The link our own pages use carries a record number rather than a file name, and the server checks who you are before it hands over an image; anyone not entitled to see a photograph is told it does not exist rather than that it is forbidden.

Sign-in sessions are stored as a one-way hash, so a stolen copy of our database would not let anyone impersonate you. Staff passwords are stored with PBKDF2-HMAC-SHA256 at 600,000 iterations and a unique salt — they cannot be read back, only checked.

Sign-in links and codes are single-use, short-lived, stored hashed, and rate limited, so a code cannot be found by guessing repeatedly.

Access is limited by role. A specialist can see the visits they took part in; a manager can see the branch they are responsible for. Significant actions are written to the audit log against the person who took them.

Our system refuses to store a photograph with no consent record attached. That rule is enforced by the database itself, not by staff memory.

The site is served over HTTPS.

No system is perfectly secure. If a breach ever puts your rights at risk, we will notify the Personal Data Protection Committee within 72 hours of becoming aware of it, and we will tell you where the law requires us to.

11. Your rights

The PDPA gives you the rights set out below. Exercising them is free. Write to [DPO EMAIL], or ask any member of our studio team and they will pass it on. We will confirm who you are before we act, so that nobody else can use these rights against you, and we will answer within 30 days.

Access and a copy. You can ask what we hold about you, why we hold it, and where we got it, and ask for a copy.

Correction. If something we hold is wrong, incomplete or out of date — including a note a specialist has written — you can ask us to put it right.

Erasure. You can ask us to delete what we hold. We will, except where we must keep something to meet a legal obligation such as tax and accounting, or to establish or defend a legal claim. We will tell you what we kept and why.

Portability. Where we hold information because you gave it to us, and we process it on the basis of consent or of our contract with you, you can ask for it in a machine-readable form, or ask us to send it to someone else where that is technically possible.

Objection. You can object to a use we base on legitimate interest. We will stop unless we can demonstrate grounds that override yours.

Restriction. You can ask us to keep your information but stop using it — while we are checking a correction you have asked for, for example.

Withdrawal of consent. Where we rely on your consent you can take it back at any time, and taking it back is as easy as giving it. Withdrawal does not undo what we lawfully did before you withdrew.

Photographs specifically. You can withdraw photograph consent yourself from your account page, or ask any member of our staff. When you do, we delete the images from storage as well as the permission — the pictures are gone, not merely hidden — and your account photograph is cleared at the same time. We can take no further photographs of you unless and until you agree again.

We may refuse a request, or charge for it, where it is manifestly unfounded or repetitive, and we will explain in writing if we do. You can complain about that decision — see section 14.

12. Children

Our services are intended for adults. Under Thai law a person reaches majority at 20. Where a customer is under that age, we ask for the consent of a parent or legal guardian, as the PDPA requires, before we collect information about them and before any photograph is taken.

If you believe a child's information has reached us without that consent, write to [DPO EMAIL] and we will delete it.

13. Changes to this policy

We update this policy when what we do changes. The date at the top tells you which version you are reading, and we keep the earlier versions.

If a change materially affects your rights we will tell you — by email to the address on your account, or by a notice on the site — before it takes effect.

Where a change affects something you consented to, your earlier consent stops counting and we ask again. A new policy never converts itself into permission you did not give.

14. Complaints

If you are unhappy with how we have handled your information, please tell us first at [DPO EMAIL]. Most things are quickest to fix directly.

You also have the right to complain to the Office of the Personal Data Protection Committee, which supervises the PDPA in Thailand. Its contact details are published at pdpc.or.th.

Nothing in this policy takes away a right you have under Thai law.