Privacy Policy

Who we are

The Beauty Room by Nilu is a salon and aesthetic clinic at 69/1, Mihindu Place, Hiddellana, Ratnapura 70000, Sri Lanka. We decide how your personal information is used, which makes us the controller of that information.

If you have any question about this policy, or want to exercise any of the rights described below, please contact us using the details at the end of this page.

What we collect

When you book an appointment with us, online or in person, we collect:

• Your name, mobile number, WhatsApp number and email address
• Your appointment details, such as the treatment, date, time and preferred specialist
• Any notes you choose to give us, such as allergies, sensitivities, preferences or inspiration. These may include information about your health
• A one-time verification code sent to your mobile, stored only in scrambled form and deleted automatically after a short period
• Whether you agreed to receive offers and promotions from us
• Your typed signature and a record of which policies you agreed to, stored with the date, the version of each policy, your browser details and your IP address, so the agreement can be evidenced later
• For clinic appointments, the consultation and medical history recorded for your safety
• Basic technical information when you browse the site, such as device, browser, pages viewed and approximate location from your IP address

Health and sensitive information

Some of what you tell us is health information: allergies, skin conditions, medication, pregnancy, or your medical history at a clinic consultation. Sri Lankan law treats this as especially sensitive, and so do we.

We use it for one purpose only, which is to treat you safely. It is seen only by Nilu, the specialist treating you and, for clinic treatments, Dr Nilmini Jayaweera. It is never used for marketing, never sold, and never shared for any purpose unrelated to your care. You can ask us to correct or delete it at any time.

Why we use your information

Under the Personal Data Protection Act No. 9 of 2022 we must have a lawful reason for using your information. Ours are:

• To provide the treatment you asked for, which is necessary to perform our agreement with you
• To confirm, remind and reschedule appointments by SMS or email, which is necessary to perform our agreement and in our legitimate interest in reducing missed appointments
• To keep you safe during treatment, using health information, with your explicit consent given at consultation
• To verify your mobile number when booking online, in our legitimate interest in preventing mistaken and fraudulent bookings
• To send you offers and promotions, only with your consent, which you can withdraw at any time
• To understand how our website is used and improve it, in our legitimate interest
• To keep proper business and tax records, to meet our legal obligations

Who else handles your information

We use a small number of trusted providers to run the salon and the website. They process your information only on our instructions, and only for the purposes below. We never sell your data, and we do not share it with advertisers.

• Supabase, which stores our booking database, hosted in Singapore
• Vercel, which hosts our website
• Resend, which sends your booking confirmation and reminder emails
• Text.lk, which sends our SMS messages, including your verification code, confirmations, reminders and, if you opted in, offers
• Upstash, which protects our booking forms from spam and abuse
• Telegram, which delivers an instant new-booking alert to the owner, including your name and contact number
• Google Analytics and Google Tag Manager, for website statistics
• Microsoft Clarity, for anonymised heatmaps and recordings of how pages are used, so we can improve the site

Where your information is stored

Because we use the providers listed above, your information is stored on servers outside Sri Lanka, principally in Singapore, and in some cases in the European Union or the United States.

We choose established providers who commit contractually to protecting your information and to using it only on our instructions. By booking with us or using this website, you understand that your information is handled in this way.

How long we keep it

• Appointment and customer records, for as long as you are a client and up to six years afterwards, so we can meet business and tax obligations
• Clinic consultation and treatment records, for the longer period that responsible clinical record-keeping requires
• Mobile verification codes, for minutes only, then deleted automatically
• Signed consent records, for as long as we keep the booking they relate to
• Marketing contact details, until you opt out, after which we keep a minimal record so we do not contact you again by mistake
• Website analytics, according to the retention period set by each provider

Your rights

Under the Personal Data Protection Act you have the right to:

• Ask what personal information we hold about you, and get a copy
• Have inaccurate or incomplete information corrected
• Ask us to delete information we no longer need
• Withdraw your consent to marketing at any time
• Object to particular uses of your information
• Complain to the Data Protection Authority of Sri Lanka if you believe we have handled your information wrongly

Exercising your rights

Just contact us. A message is enough, and there is no form to fill in. We may ask a question or two to confirm it is really you, to protect your information. We will respond as quickly as we can, and always within the time the law allows.

Marketing, and how to stop it

We only send offers and promotions to people who asked for them. You are never added automatically.

You can stop them at any time by replying STOP to any promotional SMS, by telling us at your next visit, or by emailing us. Stopping marketing does not stop practical messages about your own appointments, because confirmations and reminders will still reach you.

Cookies and website analytics

Our website uses a small number of cookies and similar technologies. Some are essential for the site to work. Others help us understand which pages are useful, including Microsoft Clarity, which records anonymised page interactions such as clicks and scrolling.

These tools do not read your booking details. You can block or delete cookies in your browser settings, though some parts of the site may then work less well.

Keeping your information safe

• All traffic to and from our website is encrypted
• Access to the booking system is restricted to authorised staff accounts
• Administrator accounts are protected with two-factor authentication
• Mobile verification codes are stored scrambled, never in readable form
• Our booking forms are rate-limited to resist automated abuse

Children

We do not knowingly collect information from children. Anyone under 18 booking a clinic treatment must be accompanied by a parent or guardian, who gives consent on their behalf.

Changes to this policy

If we change how we handle your information, we will update this page and change the date shown at the top. Significant changes will be highlighted to you.