Privacy Policy
At Hey Amy, your privacy is important to us. This Privacy Policy explains how we collect, use, and protect personal information when you visit or make a purchase from our website or when you book or receive treatments at our studio. We sell professional skincare products (including DermaFit Skin-Science) and provide in-clinic skincare and cosmetic treatments.
By using our website, booking a consultation, or receiving treatments, you consent to the collection and processing of your personal information as described in this policy. For certain types of information (including health or medical details, treatment notes, and before/after photographs) we will request explicit consent prior to collection, and processing of such information will be handled in accordance with POPIA and applicable guidance.
Information We Collect
-
When you make a purchase or attempt to make a purchase through our website, we collect personal information such as your name, billing and shipping address, payment details, email address, and phone number.
-
We collect certain data automatically, such as your IP address, browser type, time zone, and cookies that are installed on your device. We also track pages you visit, products you view, and your interactions with our site.
-
We do not store full payment card details on our servers. Payment processing is handled by secure third-party payment providers (e.g., PayFast). These providers are responsible for processing and storing payment data and comply with PCI-DSS standards. If you have questions about how your card info is handled, we can provide details of the payment processor used for your transaction.
-
When you place an order, we collect data about the products you purchase and how you prefer to receive them. In addition to product order details, we collect appointment and treatment information (date/time of appointment, therapist notes, recommended aftercare), which is used to manage bookings and provide safe, personalised care.
-
If you contact us via email, chat, or social media, we may collect additional information to respond to your inquiries or requests.
- Medical & health information (skin conditions, allergies, medications, treatment history)
- Treatment records and consent forms
- Before/after photos, diagnostic images and notes taken during consultations
Health and medical information is considered special personal information under POPIA and is processed only with your explicit consent and for the specific purpose of providing clinical care. Responsible processing of special personal information may require additional safeguards and, in some cases, authorisation from the Information Regulator.
How We Use Your Information
- Process and fulfill your orders, including sending confirmation emails and shipping updates.
- Personalize your shopping experience by showing products based on your preferences.
- Communicate with you about new products, promotions, or changes to our policies.
- Analyze website traffic to improve our services and optimize our website’s performance.
- Prevent fraudulent transactions and ensure a secure shopping environment.
- Manage and improve our customer service interactions.
Sharing Your Information
-
We work with third-party providers (e.g., payment processors, shipping carriers) to help us deliver our services. They only have access to necessary information to complete their tasks.
-
We may disclose your information if required by law or to protect our rights and comply with legal obligations.
Cookies and Tracking
Data Security
Retention / How long we keep your data – We retain personal data only as long as necessary for the purposes set out in this policy, or as required by law. Typical retention periods:
• Transaction & purchase records (for tax/audit): 7 years.
• Treatment records, consultation notes, consent forms and clinical photographs: minimum 6 years from the date the file becomes dormant; in certain clinical circumstances (minors or long-latency conditions) records may be retained for up to 25 years in line with healthcare guidance.
• Marketing preferences: until you withdraw consent.
Specific retention periods are documented in our internal retention schedule.
