Privacy Policy

1. Data controller

There are two controller roles for the data processed in PmuGo, under Article 26 GDPR (joint controllers for client data) and Article 28 (processor for the Studio’s own data):

• Controller of client data: the micropigmentation Studio that uses PmuGo. Each Studio is liable to its clients and to the AEPD for the data it enters into the platform.
• Data processor: PmuGo. PmuGo processes client data on the Studio’s behalf and following its instructions, exclusively to provide the Service.
• Controller of Studio (account user) data:PmuGo, for account, billing and support data.

Data Protection Officer (DPO) contact: support@pmugo.com.

2. Data we collect

We process the following categories of data:

a) Studio account data

• First and last name of the Studio’s responsible person.
• Professional email and contact phone.
• Studio trade name, address, tax ID.
• Billing data (payment processor: Whop).

b) Client data (entered by the Studio)

• Identity: first and last name, email, phone, date of birth.
• Contact details and communication preferences.
• Appointment, payment and package history.

c) Medical data (special category — Art. 9 GDPR)

• Medical forms: history, allergies, medication, pregnancy, skin conditions, etc.
• Fitzpatrick classification (skin type I–VI), undertone and sensitivity.
• Medical questionnaire result (SAFE / CONSULT / BLOCK).
• Informed consents signed by the client.
• Post-procedure follow-ups (healing, pigment retention, adverse reactions).

d) Photographs

• “Before” and “after” photos of each session.
• Follow-up photos at 1, 3, 7 and 14 days.
• Images linked to a procedure and treated area.

e) Pigment technical records

• Pigment brand, reference, color and batch number used.
• Amount applied and area treated.
• Application date (for traceability and batch recalls).

f) Payment data

• Amount, method, status and date of each transaction.
• Invoices issued and receipts.
• Packages and bundles purchased.

g) Technical data

• IP address, browser type and browsing data (cookies).
• Audit logs (sensitive actions on the platform).

3. Purpose

Data is processed for the following purposes:

• Managing appointments, scheduling and procedure follow-up.
• Complying with the Studio’s legal duty to keep health records.
• Issuing invoices and managing payments.
• Sending appointment reminders, post-procedure care and automatic follow-ups.
• Pigment traceability (batch → client) to handle market withdrawal alerts.
• Managing guarantees and included touch-ups.
• Complying with accounting and tax duties.
• Providing technical support to the Studio.

4. Legal basis

• Performance of a contract (Art. 6(1)(b) GDPR): providing the Service to the Studio and managing the relationship with the client.
• Consent (Art. 6(1)(a) + Art. 9(2)(a) GDPR): for processing health data, capturing images and sending commercial communications not strictly linked to the procedure.
• Legal obligation (Art. 6(1)(c) GDPR): for retaining health records and accounting and tax records required by applicable law.
• Legitimate interest (Art. 6(1)(f) GDPR): for fraud prevention, platform security and Service improvement.

5. Retention

Data is kept for as long as needed to fulfil the purpose for which it was collected and, in any case, for the legally required periods:

• Medical data (health records): for the applicable legal period (typically 6 years for aesthetic procedures; 10 years if the Studio qualifies as a healthcare center, under applicable law). Clients may request early erasure where no legal retention duty exists.
• Accounting and tax records: 6 years under Art. 30 of the Commercial Code and applicable tax law.
• Informed consents: for the medical-records retention period.
• Studio account data: for the duration of the contract plus an additional 30 days for export.
• Data of clients who exercise the right to erasure: identifying fields are anonymized (name, email, phone, date of birth, avatar), keeping the internal identifier to preserve the referential integrity of financial and legal history.

6. Recipients

PmuGo does not sell or share data with third parties for commercial purposes. It uses the following data processors, all under contractual clauses in line with Art. 28 GDPR:

• Supabase (supabase.com/privacy): database hosting, authentication and file storage (photographs).
• Whop (whop.com/privacy): payment and subscription processing.
• Google (policies.google.com/privacy): at the Studio’s request, access to and synchronization with its Google account via OAuth 2.0 to: create and sync appointments in its calendar (Google Calendar API), and generate video-call links for online consultations (Google Meet). Access is limited to the services and permissions the Studio authorizes when connecting its account; the Studio may revoke it at any time from the app or from its Google account settings.
• Resend (resend.com/privacy): sending transactional emails (reminders, magic links, notifications).

Data may be disclosed to the competent authorities (tax agency, health authorities, law enforcement) where there is a legal duty to do so.

Google data use. Use and transfer of information received from Google APIs is solely to provide and improve the features described in this policy, and follows the Google API Services User Data Policy, including the limited-use requirements: PmuGo does not sell or share the Studio’s Google account data, does not use it for ads or to build behavioral profiles, and does not transfer it to third parties except as described in this policy.

Limited-use requirements disclosure. The use of user data, whether raw or derived, received from Workspace APIs will comply with the Google User Data Policy, including the limited-use requirements. In particular, no user data received from Google APIs — raw, aggregated or derived — is used, transferred or sold to create, train or improve generalized or foundational machine-learning or artificial-intelligence models, nor transferred to third-party AI services that do so. The booking conversational assistant only processes information entered manually by the Studio and messages from end clients; Google Calendar data never reaches that assistant.

7. GDPR rights

Clients —and the Studio as a user— may exercise the following rights at any time:

• Access: to know what data we hold and how it is processed.
• Rectification: to correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”): to request deletion of data, unless a legal retention duty applies (medical history, accounting records).
• Portability: to receive data in a commonly used structured format (JSON) to move it to another provider.
• Objection: to object to processing based on legitimate interest or consent, including communications.
• Restriction of processing: to request suspension of processing while a complaint is resolved.
• Withdrawal of consent: at any time, without affecting the lawfulness of prior processing.

To exercise them, clients may use the form in the client portal (“My profile → Privacy”) or write to support@pmugo.com. We reply within a maximum of 30 days. In case of disagreement, complaints may be filed with the Spanish Data Protection Agency (AEPD).

8. International transfers

Some of the processors listed above may carry out international data transfers to countries outside the European Economic Area (EEA), in particular the United States. In such cases, transfers take place under:

• European Commission adequacy decisions.
• Standard contractual clauses approved by the Commission (Decision 2021/914).
• The EU-U.S. Data Privacy Framework, where the processor is certified.

PmuGo requires appropriate contractual safeguards from its processors and monitors compliance. You may request a copy of the contractual clauses by writing to support@pmugo.com.

9. Security measures

PmuGo applies technical and organizational measures appropriate to the processing risk, in line with Art. 32 GDPR:

• TLS 1.2+ encryption in transit and encryption at rest at storage level.
• Per-Studio isolation through row-level security (RLS) policies in the database.
• Authentication via magic link (no passwords) for clients and available 2FA for Studio accounts.
• Audit logging of sensitive actions (medical-history access and modification, exports, erasures).
• Separation of privileges: the service-key database client is only used server-side; the browser never has access to other parties’ data.
• Periodic access reviews and penetration testing.
• Incident response plan with notification to the AEPD within no more than 72 hours, in line with Art. 33 GDPR.

10. DPO contact

For any question about personal-data processing, exercising rights, or requests about this Policy, you can contact our Data Protection Officer:

• Email: support@pmugo.com
• Subject: “Data protection — PmuGo”

In your request, state the right you wish to exercise and provide enough documentation to verify your identity. We reply within a maximum of 30 calendar days, in line with Art. 12(3) GDPR.