I. GENERAL INFORMATION

This Privacy Policy sets out how Aesto clinic, operated by Meditsinski tsentar ESTO EOOD, company ID 208710029, processes, stores and protects users' personal data in accordance with Regulation (EU) 2016/679 (the GDPR), the Bulgarian Personal Data Protection Act and applicable Bulgarian law.

Personal data controller:

Meditsinski tsentar ESTO EOOD

Company ID: 208710029

Address: Sofia 1000, Vitosha district, 77B Kumata Street, floor 4, apt. 7, Bulgaria

Managing director: Viktor Georgievski

Email: office@aesto.bg

Website: https://aesto.bg

II. DEFINITIONS

Personal data means any information by which an individual can be identified, directly or indirectly.

Processing means any operation involving the collection, storage, organisation, use, disclosure, restriction or erasure of personal data.

Health data means sensitive personal data relating to a patient's physical or mental condition.

Data subject means any individual whose data is processed by Aesto clinic.

III. WHAT PERSONAL DATA WE PROCESS

Aesto clinic may process the following categories of personal data:

first name and surname;

phone number;

email address;

delivery and billing address;

IP address;

booking and order information;

payment information;

medical information and health status, where needed to carry out a medical or aesthetic treatment;

photographs provided with the patient's consent;

on-site behaviour data collected through cookies and analytics tools.

IV. PURPOSES OF PROCESSING

Personal data is processed for the following purposes:

booking and managing appointments;

providing medical and aesthetic services;

processing orders;

issuing accounting documents;

communicating with clients;

sending marketing messages after explicit consent;

improving our services and the user experience;

protecting the legitimate interests of Aesto clinic;

compliance with legal obligations.

V. LEGAL BASIS FOR PROCESSING

Personal data is processed on the following legal bases:

performance of a contract;

a legal obligation;

explicit consent;

protecting vital interests;

the controller's legitimate interest;

providing healthcare services.

VI. SPECIAL CATEGORIES OF DATA

When performing medical and aesthetic treatments, Aesto clinic may process data about patients' health.

This data is processed only by authorised staff, medical professionals or people bound by a duty of confidentiality.

VII. RETENTION PERIOD

Personal data is kept for as long as is necessary to fulfil the purposes for which it was collected, and in line with statutory requirements.

Accounting records are kept for up to 10 years in accordance with the law in force.

Medical records are kept in accordance with the applicable healthcare legislation.

VIII. DISCLOSURE OF DATA TO THIRD PARTIES

Aesto clinic may disclose personal data to:

accounting and legal advisers;

courier companies;

payment operators;

IT and hosting providers;

marketing platforms;

public authorities, where there is a legal basis.

All third parties process the data in compliance with the GDPR and applicable security measures.

IX. COOKIES AND ANALYTICS TOOLS

The site uses cookies and similar technologies to:

the site working properly;

traffic analysis;

statistics;

marketing and advertising;

personalising content.

Aesto clinic may use tools such as:

Google Analytics;

Meta Pixel;

Google Ads;

remarketing and analytics systems.

The User can manage or disable cookies through their browser settings.

X. DATA SECURITY

Aesto clinic applies technical and organisational measures to protect personal data against:

unauthorised access;

loss;

unlawful disclosure;

destruction;

abuse.

Payment transactions are carried out through secure systems and encrypted connections.

XI. YOUR RIGHTS

Every user has the right:

to access their personal data;

to rectification;

to erasure (the right to be forgotten);

to restriction of processing;

to object;

to data portability;

to withdraw their consent at any time;

to lodge a complaint with the Commission for Personal Data Protection.

XII. CONTACTING THE DATA CONTROLLER

For questions about the processing of personal data: