Data protection for businesses
Last updated 31 October 2026
What Aestheva does with your data and your clients' data, what your business is responsible for, and plain answers to the questions businesses ask us. These terms form part of your agreement to list on Aestheva, alongside the terms of use. How we handle clients' data is set out in our privacy notice.
Who is responsible for what
| Data | Responsible | Notes |
|---|---|---|
| Bookings made on Aestheva: client name, contact details, appointment, note, deposit | Aestheva and your business, each separately | Aestheva for running the booking. Your business for how it uses the details once it has them. |
| Consultation notes, treatment records, prescriptions, consent forms, clinical photos | Your business only | Keep these in your own records, never on Aestheva. Aestheva has no place for them and doesn't receive them. |
| Anything you copy outside Aestheva: phone contacts, WhatsApp chats, your own software, paper files | Your business only | |
| Your team's names, photos, qualifications and registration numbers on your page | Your business, which confirms each person has agreed. Aestheva publishes them | Tell us if someone leaves or withdraws permission and we'll remove them. |
| Who has a portal login at your business | Your business | Ask us to add or remove logins. One login per person. |
| Verification documents you upload | Aestheva | Used only to check your listing. Seen only by the Aestheva team, never by clients. |
| Deposits and refunds | Aestheva and Razorpay | Card, UPI and bank details never reach Aestheva. |
What Aestheva does
- Uses your clients' details only to run their bookings with you: confirmations, changes, cancellations, deposits and refunds.
- Never sells them, and never uses them to advertise other businesses to your clients.
- Shows each business only its own bookings and clients. Other businesses can never see yours.
- Protects data as described in our privacy notice: encrypted connections, scrambled links and passwords, private document storage and an audit log.
- Uses only these service providers for your data: Cloudflare (hosting, database, files and email) and Razorpay (payments).
- Tells you without undue delay, and normally within 72 hours of finding out, if a data breach affects your business or your clients. We also tell clients and the authorities as the law requires.
- If you leave Aestheva, on request sends you a copy of your bookings and client list within 30 days, closes your logins and removes your listing. We keep booking and payment records for 8 years, as the law requires. Verification documents are deleted 3 years after you leave, unless they're needed for a dispute.
What your business agrees to
- Use client details only for their care. Use what you receive through Aestheva only to provide and manage the client's appointment, keep the records your profession requires and contact them about their care. Don't use it for unrelated marketing unless the client agrees separately.
- Follow the law and your professional rules. You are responsible for your own compliance with data protection law, including the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules, with the confidentiality rules of your professional council, and with any record-keeping rules for your profession.
- Keep health information off Aestheva. Don't put diagnoses, treatment details or other health information in booking notes, block reasons or anything else on the portal.
- Photos need written consent. Never upload a photo of a client to Aestheva without their written consent.
- Your team agrees to their profile. Get each person's permission before adding their name, photo, qualifications or registration number to your page.
- Keep logins secure. One login per person. Never share passwords, and ask us to remove a login as soon as someone leaves.
- Tell us quickly. Tell us within 24 hours if you suspect a login has been misused or client data from Aestheva has been exposed.
- Answer requests about your own records. Respond to clients' requests about records you hold yourself, and pass on to us any request about their Aestheva data.
Responsibility and liability
- Your business is solely responsible for personal data once it has received it through Aestheva, for the records it creates and for what its team does with them.
- Aestheva is not responsible for how your business collects, stores, uses or shares personal data outside the Aestheva platform, or for clinical or treatment records in any form.
- Your business will indemnify Haswel Care Private Limited against claims, penalties, losses and reasonable costs that arise from its breach of these terms or of data protection law, or from the acts of its team.
- To the extent the law allows, Aestheva's total liability to your business for anything to do with personal data is limited to the commission your business paid Aestheva in the 12 months before the claim. Neither side is liable for indirect or consequential loss. Nothing here limits liability that the law does not allow to be limited, such as for fraud.
Questions businesses ask
Who owns the client list?
Personal data isn't owned like property: clients keep their rights over it. Your business may use the details of clients who booked you to look after them and keep your records. Aestheva uses them to run bookings. Neither of us may sell them.
Can Aestheva see our patient records or clinical notes?
No. Aestheva has no place for them and doesn't receive them. A small Aestheva team can see booking details (name, contact details, service, time and note) to support bookings, payments and refunds. Changes are recorded in an audit log, and the team can't sign in as your business.
Can other businesses on Aestheva see our clients?
No. Each business sees only its own bookings and clients.
Will Aestheva contact our clients, or market other businesses to them?
We send booking emails: confirmations, changes and cancellations. We never send your clients offers from other businesses. If we add optional newsletters, clients will have to choose to receive them.
Where is the data stored?
On Cloudflare's network. Our database is currently in Cloudflare's Asia-Pacific region, which may be outside India. Indian law allows this except to countries the Government restricts. Payment data is held by Razorpay in India.
Is Aestheva compliant with the DPDP Act?
Most duties under the Digital Personal Data Protection Act, 2023 apply from 13 May 2027, under the DPDP Rules, 2025. Until then, the Information Technology Act, 2000 and its 2011 rules on sensitive personal data apply. Aestheva already follows the main principles: a clear notice, using data only for its purpose, collecting as little as possible, security safeguards, a Grievance Officer and breach notices. We're preparing for the remaining duties by May 2027.
Is health information treated differently?
Yes. Medical records and health information are “sensitive personal data” under the 2011 rules. That's why they stay in your own records and off Aestheva.
What happens if there's a data breach?
If a breach on Aestheva affects your business or clients, we tell you without undue delay, normally within 72 hours of finding out. We tell clients and the authorities as the law requires, and explain what we're doing about it. If a breach happens in your own systems, it's your business's responsibility, and please tell us within 24 hours if it involves data from Aestheva.
A client asked us to delete their data. What do we do?
For records you keep yourself, follow the law and your professional rules: medical records often have to be kept for a set period. For their Aestheva data, forward the request to us and we'll erase what the law lets us.
Can we get a copy of our bookings and clients?
Yes. Email us and we'll send a copy within 30 days. A download button in the portal is planned.
What happens to our data if we leave Aestheva?
We send you a copy if you ask, close your logins within 30 days and remove your listing. We keep booking and payment records for 8 years, as the law requires, and delete your verification documents 3 years after you leave, unless they're needed for a dispute.
Do we need our own privacy notice?
If you keep records about clients, as nearly every business does, yes: your clients should know how you handle the records you keep. Our notice covers only what happens on Aestheva.
Can we have a signed copy of these terms?
Yes. Email us and we'll send a copy to sign.
Contact
Grievance Officer
Shaji Anandan, Haswel Care Private Limited
1st floor, Anjali Arcade, near Nippon Toyota, Technopark Phase 3 Service Road, Kazhakkoottam, Thiruvananthapuram, Kerala 695583
Email: hello@bookaestheva.com (write “Data protection” in the subject)
We acknowledge requests within 3 working days and answer within 30 days. If you're not satisfied with our answer, you can complain to the Data Protection Board of India.