Privacy Policy

Skinmedicine Inc. is the personal information controller for personal data collected through this website and our related customer, professional-verification, order, training, and support processes. Our principal business address is in Quezon City, Metro Manila, Philippines. Complete contact details are provided in Section 12 and on our Customer Service / Contact Information page.

Depending on how you interact with us, we may collect:

• Identity and account data: name, username, account credentials, and customer identifiers.
• Professional and sensitive personal data: birth date, Professional Regulation Commission license number and status, profession or specialty, clinic or hospital affiliation, and documents or results used to verify eligibility.
• Contact and delivery data: email address, telephone number, billing address, shipping address, and recipient details.
• Transaction data: products, quantities, prices, discounts, invoices, payment status, returns, refunds, and customer-service records. Payment card details are generally handled by our payment providers rather than stored by us in full.
• Training and inquiry data: program interests, messages, consent choices, and information submitted through forms.
• Device and usage data: IP address, browser and device information, cookie identifiers, pages viewed, referring pages, timestamps, and website interactions.
• Security and compliance data: login activity, fraud indicators, audit records, and information required to comply with law or protect the website.

We collect personal data directly from you when you create an account, register as a professional, place an order, subscribe, submit a form, attend training, request support, or otherwise communicate with us. We also collect data automatically through cookies and similar technologies and may receive data from Shopify, payment providers, couriers, identity or professional-verification providers, analytics providers, social sign-in providers, and other service providers involved in your requested transaction.

If you provide another person's data, such as a delivery recipient's details, you must be authorized to do so and should direct that person to this notice.

We process personal data only when permitted by law and for declared, specific, and legitimate purposes, including:

• creating and administering accounts, receiving orders, taking payment, delivering goods, issuing receipts, and providing returns or support, where processing is necessary to perform or prepare to enter a contract;
• verifying professional eligibility and enforcing restrictions for regulated products, based on your specific consent where required and our legal and legitimate compliance interests;
• complying with tax, accounting, consumer-protection, product-safety, recall, regulatory, law-enforcement, and other legal obligations;
• protecting customers, preventing fraud, securing systems, diagnosing errors, and establishing or defending legal claims, based on legal obligations or legitimate interests that do not override your rights;
• responding to inquiries, administering training, and improving products, services, and website performance;
• sending marketing communications when you have consented or another lawful basis applies. You may unsubscribe at any time.

When we rely on consent, it must be freely given, specific, informed, and evidenced in written, electronic, or recorded form. You may withdraw it prospectively, subject to lawful processing that does not depend on consent.

We may disclose only the personal data reasonably necessary to:

• Shopify and providers that host, secure, operate, analyze, or support the online store;
• payment processors, banks, fraud-prevention providers, couriers, warehouses, and fulfillment partners;
• professional-license or identity-verification providers and relevant government or professional registries;
• email, form, customer-support, training, analytics, and marketing service providers acting under our instructions;
• professional advisers, auditors, insurers, prospective transaction parties, and successors, subject to appropriate confidentiality and safeguards; and
• courts, regulators, law-enforcement bodies, and public authorities where disclosure is authorized or required by law.

We do not sell personal data. Our service providers may use it only for authorized purposes and must provide appropriate protection.

Some technology, payment, communications, analytics, verification, or support providers may process personal data in other countries. Skinmedicine Inc. remains accountable for personal data under its control and uses contracts or other reasonable safeguards intended to provide a comparable level of protection for domestic and international processing, as required by the Data Privacy Act.

We and our providers use essential cookies to operate accounts, checkout, security, preferences, and shopping features. Subject to your choices and applicable law, we may also use analytics or marketing cookies to understand and improve the website and measure communications. Browser controls can block or delete cookies, but essential features may then not work correctly.

Automated tools may help flag fraud or return a professional-verification status. We do not intend to make a decision with legal or similarly significant effects solely by automated processing without the safeguards and disclosures required by law. You may ask for information about, or human review of, a significant automated decision concerning you.

We retain personal data only for as long as necessary for the purpose disclosed, for legitimate business needs, or to comply with tax, accounting, consumer, product-safety, prescription or regulated-product, dispute, and other legal requirements. Retention periods vary by record type and consider the sensitivity of the data, the transaction lifecycle, limitation periods, security needs, and regulatory obligations.

When data is no longer required, we securely delete, anonymize, or dispose of it using safeguards appropriate to its sensitivity. Backup copies may remain for a limited cycle before secure deletion.

We use reasonable and appropriate organizational, physical, and technical safeguards based on the nature of the data, processing risks, business size and complexity, current practices, and implementation cost. Measures include access controls, confidentiality duties, provider oversight, system safeguards, vulnerability and incident processes, and appropriate transmission security.

No system is completely secure. If a breach triggers notification duties, we will notify the National Privacy Commission and affected data subjects promptly and provide the information required by law, subject to any authorized delay.

Subject to the Data Privacy Act, its implementing rules, and lawful limitations, you may exercise the rights to:

• be informed about processing of your personal data;
• object to processing, including direct marketing and certain automated processing;
• access your personal data and relevant processing information;
• correct inaccurate or incomplete data;
• suspend, withdraw, block, remove, or request destruction of data in circumstances provided by law;
• receive electronically processed data in a structured, commonly used format where data portability applies;
• withdraw consent without affecting processing already lawfully completed;
• be indemnified for damage caused by inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data; and
• lodge a complaint with the National Privacy Commission.

To protect you, we may verify identity and authority before acting on a request. We will explain any lawful reason for denying or limiting a request.

This website and its regulated-product purchasing functions are not directed to children. We do not knowingly collect a child's personal data through professional registration or purchasing flows. If you believe a child submitted personal data without appropriate authority, contact our Privacy Officer so we can assess and take appropriate action.

Contact the Skinmedicine Inc. Privacy Officer:

• Email: [PRIVACY OFFICER EMAIL]
• Telephone: [PRIVACY CONTACT NUMBER]
• Postal address: [COMPLETE PRIVACY OFFICE POSTAL ADDRESS]

Please include enough detail to identify your request but do not send passwords or unnecessary sensitive data. If you are not satisfied with our response, you may lodge a complaint with the National Privacy Commission.

We may update this notice to reflect changes in law, technology, providers, or our processing. We will post the revised notice with a new date and provide an additional notice when a material change requires it. Information already collected remains subject to the notices and lawful bases applicable to its processing.