Privacy policy

Data controller

The controller of the processing described in this policy is Skincare Agency SAS, 17 rue de la Trémoille, 75008 Paris, France, registered with the Paris trade register under number 894 968 874.

• Email: contact@skincareagency.com
• Telephone: +33 1 87 04 17 97
• Data protection officer: À_COMPLÉTER

This policy covers the processing carried out through this website and through the contact channels it offers. Processing relating to the medical consultation and to the patient record is covered by a separate notice, provided at the clinic.

Categories of data

This website requires no account and collects nothing without your knowledge. The data processed is the data you send us of your own accord when you get in touch, together with the data the infrastructure records technically in order to serve the pages.

The form on the contact page is an active collection channel. The information you enter there (name, email address, optional telephone number, subject and body of the message) is composed into an email and handed to the clinic mailbox. The website keeps no copy of it: none of it is recorded in a database, in a file or in an application log. Sending the form requires you to tick a dedicated box, which covers the handling of your enquiry alone. No box is pre-ticked, and no acceptance of commercial communications conditions the sending of your message.

• Identification and contact data: surname, first name, email address and telephone number, where you provide them.
• The content of your messages: the subject of your enquiry and the body of your messages, whichever channel you use (email, telephone, messaging, contact form).
• Appointment data: the slot requested, the reason for the consultation and your appointment history. This data is collected and hosted by Doctolib.
• Technical connection data: IP address, date and time of the request, pages requested, browser and device type, recorded in the server logs.
• Where applicable, data concerning your health: whenever the message you write describes a skin concern, a medical history, a current treatment or an aesthetic expectation.

The contact channels available to you (email, WhatsApp messaging, telephone, and any contact form on this website) let you describe your enquiry freely. You may therefore be led to mention a skin concern or a medical history. Such information constitutes data concerning health within the meaning of article 9 of the GDPR, and carries the reinforced protection that follows.

We never ask you for such information through these channels, and we process it only if you choose to send it to us. Where you do, it is processed on the sole basis of your explicit consent, given by the very act of sending it, and for the sole purpose of answering your enquiry.

We invite you to keep your message to what is strictly needed to direct your enquiry. A detailed account of your medical situation, your history and your treatments belongs in the consultation, which offers the confidential setting and the professional secrecy such an exchange requires. These contact channels are not designed for the transmission of detailed medical information or of health documents.

Purposes and legal bases

Each processing operation serves a defined purpose and rests on an identified legal basis.

• Answering the enquiries addressed to us and following up on the exchange: the legitimate interest of the clinic in handling the requests it receives (article 6.1.f of the GDPR).
• Processing the health information you choose to send us on that occasion: your explicit consent (article 9.2.a of the GDPR), which you may withdraw at any time.
• Arranging appointments and preparing the consultation: steps taken at your request prior to entering into a contract (article 6.1.b of the GDPR) and, for health data, the purposes of preventive medicine and the provision of care (article 9.2.h of the GDPR).
• Operating, securing and maintaining the website and keeping it available: the legitimate interest of the clinic in running a reliable service (article 6.1.f of the GDPR).
• Meeting our legal, accounting and tax obligations: legal obligation (article 6.1.c of the GDPR).

No decision producing legal effects concerning you is taken on the basis of automated processing, and no profiling is carried out.

Recipients and processors

Your data is intended solely for those members of the Skincare Agency team who need to know it, within the limits of their duties. It is never sold, rented or exchanged commercially with third parties.

The following act as processors or recipients, each for its own part:

• Doctolib: online booking and management of the clinic’s diary.
• WhatsApp: messaging, where you choose that channel to write to us.
• OVH: hosting of the website and technical access logs.
• Host of the clinic’s email service: OVH (OVH SAS, France).
• Audience measurement and statistics tools: this website uses none.
• Advertising networks and advertising tools: none are used on this website.
• Any other recipient or processor: none beyond those already listed above.

Doctolib, WhatsApp and the online shop are reached from this website through plain outbound links. As soon as you open one, you leave this website: the data you provide to those services then falls under their own privacy policies, which it is for you to consult.

Your data may finally be disclosed to administrative or judicial authorities where the law so requires, and to our advisers in the defence of our rights.

Retention periods

Your data is kept for no longer than is necessary for the purposes pursued, then deleted or archived in accordance with the following rules.

• Enquiries that lead to nothing further: three years from our last exchange with you.
• Messages received through the contact page form: they exist only as the email they produce, kept in the clinic mailbox under the rule above. The website itself keeps no copy of them.
• Health information you have sent us of your own accord: deleted as soon as it is no longer needed to handle your enquiry, and at the latest when that enquiry is closed.
• Appointment data managed by Doctolib: in accordance with the platform’s retention policy and the duration of the care relationship.
• Technical server logs: twelve months.
• Accounting records and documents subject to a legal obligation: the retention period imposed by the applicable regulation, that is ten years for accounting records.

Health data collected during a consultation at the clinic belongs to the patient record, whose retention follows the rules that apply to healthcare professionals. That record is created at the clinic and falls outside the scope of this website.

Your rights and how to exercise them

Under the GDPR and the French Data Protection Act, you have the following rights over your data:

• Right of access: to obtain confirmation that your data is being processed and to receive a copy of it.
• Right to rectification: to have inaccurate data corrected and incomplete data completed.
• Right to erasure: to request the deletion of your data in the cases provided for by the regulation.
• Right to restriction of processing and right to data portability.
• Right to object to processing based on our legitimate interest, on grounds relating to your particular situation.
• Right to withdraw your consent at any time, in particular for the health information you have sent us. Such withdrawal does not affect the lawfulness of processing carried out beforehand.
• Right to give directions as to what becomes of your data after your death.

These rights may be exercised by email to contact@skincareagency.com or by post to Skincare Agency SAS, 17 rue de la Trémoille, 75008 Paris, France. Please state the subject of your request and the channel through which you contacted us, so that we can locate the data concerned.

We reply within one month of receiving the request, extended to three months where the request is complex, in which case you are informed. Where there is reasonable doubt as to your identity, we may ask you for proof of it.

Complaint to the CNIL

If, having contacted us, you consider that your rights are not being respected, you may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés, on its website cnil.fr or by post to CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

Cookies and trackers

As at the date this policy was last updated, this website sets no advertising cookie, no audience measurement cookie and no third party tracker. It embeds no analytics tool, no tag manager, no advertising pixel and no third party content: the external services it mentions (Doctolib, WhatsApp, the online shop, the social media accounts) are reached through outbound links, which run no code on these pages.

The form on the contact page is no exception. It sets no cookie, calls no third party service and uses no captcha. The protections it applies against automated submissions rely on code run by this website alone, and on nothing else.

The only thing stored is what is strictly necessary for the website to work, namely the language you are reading, held in a session cookie named NEXT_LOCALE. It holds the language code alone, allows no tracking of your browsing and is passed to no one.

That cookie falls within the trackers exempt from consent under article 82 of the French Data Protection Act. No consent banner is therefore required as things stand, which is why this website carries none.

Adding an audience measurement tool, an advertising pixel or embedded third party content at a later date would require a prior consent mechanism, with refusing made as easy as accepting, and an update to this section.

Security

The website is served over HTTPS and hosted in secured data centres. We implement appropriate technical and organisational measures to preserve the confidentiality, integrity and availability of the data: encryption of communications, access restricted to authorised staff, regular updates and backups.

No measure can guarantee absolute security on the internet. Email and consumer messaging services offer limited safeguards: we recommend that you keep the transmission of health documents and detailed medical information for the consultation itself.

Transfers outside the European Union

The website and its technical logs are hosted by OVH SAS, a French company, on infrastructure located in the European Union. Doctolib states that it hosts health data with a certified health data host located in the European Union.

The WhatsApp messaging service is operated by Meta Platforms Ireland Limited. Exchanges passing through it may involve a transfer outside the European Union, framed by the standard contractual clauses of the European Commission and, for the United States, by the adequacy decision on the EU US Data Privacy Framework. If you would rather avoid that transfer, please use email or the telephone.

Beyond that case, no transfer of data takes place outside the European Union.

Contact

For any question about this policy or about the processing of your data, write to contact@skincareagency.com, call +33 1 87 04 17 97, or send a letter to Skincare Agency SAS, 17 rue de la Trémoille, 75008 Paris, France.

This policy may be amended to reflect changes to the website, to the services offered or to the applicable regulation. The date it was last updated appears at the top of the page.

Governing version

This English text is a translation provided for convenience. In the event of a discrepancy or a dispute, only the French version of this privacy policy is authoritative, and French law applies.