Privacy policy

Last updated: 21 September 2026

Who controls your data

The controllers are Hello Beauty Clinic s.r.o., company number 19748205, VAT number CZ19748205, and Hello Beauty Clinic Plus s.r.o., company number 23629614, both registered at Pod Všemi svatými 1665/5, 301 00 Plzeň, Czech Republic. Together they run the clinic for aesthetic medicine, sonography, dermatology and plastic surgery at that address.

On anything to do with personal data, write to info@hellobeautyclinic.cz or call +420 720 827 850. We have not appointed a data protection officer, as the law does not require one of us.

What we collect

Only what the care you receive cannot be delivered without:

• Contact details from the enquiry form – your name, email, phone number and the text of your message.
• Appointment details – the date, the treatment and any notes about it.
• Medical records – your history, the course and outcome of a treatment, and before-and-after photographs. This is a special category of data, kept under the Czech Health Services Act.
• Billing details – name, address and company number where we issue an invoice.
• Website usage – truncated IP address, device and browser type, pages visited. None of this is measured unless you accept it in the cookie banner.

Photographs are taken only with your express consent, and used for marketing only if you give a separate consent for that. Either can be withdrawn at any time.

Why we process it, and on what basis

• To answer your enquiry and arrange an appointment – Art. 6(1)(b) GDPR, steps prior to a contract and its performance.
• To provide care and keep records of it – Art. 6(1)(c) and Art. 9(2)(h) GDPR, together with Act No. 372/2011 Coll. on health services.
• To meet tax and accounting obligations – Art. 6(1)(c) GDPR.
• To protect our legitimate interests, such as defending against claims – Art. 6(1)(f) GDPR.
• To measure website traffic and advertising – Art. 6(1)(a) GDPR, on your consent alone.
• To send you marketing messages if you ask for them – Art. 6(1)(a) GDPR.

We do not use your data for automated decision-making or for profiling that would have legal effects for you.

How long we keep it

• An enquiry that leads to no treatment – at most 3 years from the last message.
• Medical records – for the period set by Decree No. 98/2012 Coll., usually 5 to 10 years after the last care given.
• Accounting documents – 10 years, under the Czech VAT Act.
• Marketing consent – 10 years, or until you withdraw it.
• Website usage – as set in each measurement tool, at most 14 months.

Who else sees it

We do not sell personal data. It reaches only those without whom the clinic or the site would not run, and only as far as it has to:

• Resend – delivering the email from the enquiry form.
• Telegram – notifying reception of a new enquiry.
• Vercel – hosting this website.
• Google Ireland Limited – traffic measurement (Google Analytics), advertising measurement (Google Ads) and the map on the contact page. Loaded only after you consent.
• Meta Platforms Ireland Limited – advertising measurement on Facebook and Instagram. Loaded only after you consent.
• Our accountants, laboratories and partner medical facilities – as far as a given procedure requires.

Some of these processors may handle data outside the European Economic Area. Where they do, the transfer is covered by the European Commission's standard contractual clauses.

Cookies and measurement

The site itself sets only the technical cookies it cannot work without, and those need no consent. Every measurement and advertising script — Google Analytics, Google Ads, Google Tag Manager and the Meta Pixel — loads only once you press "Accept all" in the cookie banner. Until then, not one of them is loaded.

You can change your mind at any time: clear this site's cookies in your browser and the banner will ask again.

Your rights

Over your own data, the GDPR gives you the right:

• of access – to learn what we hold about you, and to have a copy;
• to rectification – to have anything inaccurate corrected or anything incomplete filled in;
• to erasure – to have data deleted where it is no longer needed and no legal duty, such as archiving medical records, stands in the way;
• to restriction – while the accuracy of the data or the lawfulness of the processing is being settled;
• to portability – to receive your data in a machine-readable format, or have it passed to another controller;
• to object to processing based on a legitimate interest;
• to withdraw consent at any time, without affecting what was done before;
• to complain to a supervisory authority.

How to exercise them

Write to info@hellobeautyclinic.cz or to the clinic's address. We answer within a month. To be sure we are not handing your data to someone else, we may ask you to confirm who you are.

If you are not satisfied with how we handled it, you can complain to the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.

The consent wording

This is the text the tick-box on the enquiry form refers to.

By checking the button you agree to the processing of personal data. I agree to the processing of all personal data provided and the free movement of such data, the protection of personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons (including data entered in the course of communication with our company) by our company, which is the controller, and to their subsequent processing (possibly also through a processor), and I further agree to the processing of said personal data for the subsequent business and marketing purposes of the controller, with the proviso that additional data may be associated with such data. I voluntarily grant this consent for a period of 10 years. However, I can withdraw my consent at any time in writing at the address of the controller. I confirm that I have been informed of my rights in relation to the management and processing of personal data by our company, in particular that I have rights under Regulation (EU) 2016/679, i.e. that the provision of data is voluntary, that I can withdraw my consent at any time free of charge at the address of the controller, that I have information about the processing, the right of access to personal data, the right to rectification, the blocking of incorrect personal data, their destruction and so on, as well as the right to contact the Office for Personal Data Protection in the event of a suspected breach of my rights.