Privacy Notice

OShun Cosmetics ("we", "our", or "the Practice"), is committed to safeguarding the privacy of our patients, clients, and visitors. This Privacy Notice explains how we collect, use, disclose, and protect your personal information in connection with the services we provide and through our website, oshunja.com. By accessing our services or website, you agree to the terms of this Privacy Notice. We encourage you to review this Notice periodically, as we may update it from time to time.

As a provider of cosmetic and aesthetic services, we take your privacy seriously. All personal and health-related information collected in connection with our services is handled in strict confidence in accordance with Jamaican data protection legislation, including the Data Protection Act, 2020.

1. Data Covered by This Privacy Notice

This Privacy Notice applies to personal data we collect:

• Through our website and online booking platforms;
• Through in-person consultations, intake forms, and patient/client registration;
• Through our social media pages and digital communications;
• Through email, telephone, or other correspondence with our team;
• From third parties, including referring physicians, laboratories, or authorised partners; and
• When you participate in promotions, loyalty programmes, or complete satisfaction surveys.

2. Personal Data We Collect

We collect and process the following categories of personal data:

General Identifying Information: Including full name, postal address, email address, telephone number, date of birth, and other identifying details provided at registration or through our website.

Demographic Information: Including gender, nationality, language preferences, and relevant personal history where required for service delivery.

Government-Issued Identification: Including national identification, passport, or other government-issued documents where required for verification purposes.

Financial Information: Including payment card details, billing address, and transaction records. Payment information is processed through secure, PCI-compliant channels.

Health and Aesthetic Information: Including relevant medical history, treatment history, aesthetic goals, contraindications, consent forms, and before/after documentation collected to deliver safe cosmetic and aesthetic services.

IP Address and Technical Data: When you access our website, we automatically collect your IP address, browser type, pages visited, and time of access for security and analytics purposes.

Communications: Records of your communications with us, including emails, messages, and appointment correspondence.

3. How We Use Your Personal Data

We use your personal data for the following purposes:

• To provide, manage, and improve the medical/aesthetic services you request;
• To schedule and manage appointments and follow-up care;
• To process payments and maintain billing records;
• To communicate with you about your care, appointments, and service updates;
• To comply with our legal and regulatory obligations under Jamaican law;
• To maintain accurate and complete records as required by professional standards;
• To conduct quality improvement activities and patient/client satisfaction assessments;
• To send you relevant health information, service updates, or promotional communications (where you have consented); and
• To protect the safety and security of our patients, staff, and premises.

4. Cookies and Website Tracking

Our website, oshunja.com, uses cookies and similar tracking technologies to enhance your browsing experience, analyse website usage, and support our marketing activities. Cookies are small files placed on your device when you visit our website.

We use cookies for the following purposes:

• To remember your preferences and personalise your experience;
• To analyse how visitors use our website (analytics);
• To support the delivery of relevant content and service information; and
• To measure the performance of our online communications.

You may disable cookies through your browser settings; however, doing so may affect the functionality of certain features on our website.

5. Sharing of Personal Data

We do not sell your personal data. We may share your information in the following limited circumstances:

Healthcare and Service Partners: We may share relevant information with healthcare providers, referral partners, or specialist practitioners involved in supporting your treatment or follow-up care.

Service Providers: We engage trusted third-party service providers (including IT systems, payment processors, and communication platforms) who process data on our behalf under strict confidentiality agreements.

Legal and Regulatory Requirements: We may disclose information where required to do so by law, court order, or regulatory authority, or where necessary to protect the rights, safety, or property of our patients, staff, or the public.

Business Transfers: In the event of a merger, acquisition, or transfer of business assets, patient and client records may be transferred to the successor entity, subject to equivalent data protection obligations.

Insurance and Billing: Where applicable, we may share relevant information with health insurers or third-party payors to process claims or obtain preauthorisation for procedures.

6. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Secure storage of physical and electronic records;
• Access controls limiting data access to authorised personnel only;
• SSL encryption for data transmitted through our website; and
• Regular review of our data security practices.

Please note that no method of transmission over the internet is entirely secure. We will never request your password, credit card details, or sensitive personal information by email. If you receive a suspicious communication purporting to be from us, do not respond and contact us immediately.

7. Retention of Personal Data

We retain client records for as long as necessary to provide our services and comply with our legal obligations. Records are generally retained for a minimum of seven (7) years. Records relating to minors are retained until the client reaches the age of 25, or for seven years from the last date of service, whichever is longer.

Where retention is no longer necessary, records are securely disposed of in accordance with applicable legal requirements.

8. Children's Privacy

We are committed to protecting the privacy of minors. We do not knowingly collect personal data from persons under the age of 18 without the consent of a parent or legal guardian. Where services are provided to a minor, a parent or guardian must be present and provide consent. If you believe a minor's information has been collected without appropriate consent, please contact us immediately at info@oshunja.com.

9. Your Rights Under the Data Protection Act, 2020

As a data subject under the Data Protection Act, 2020 (Jamaica), you have the following rights with respect to your personal data:

1. The right to access — you may request a copy of the personal data we hold about you;
2. The right to rectification — you may request correction of inaccurate or incomplete data;
3. The right to erasure — in certain circumstances, you may request deletion of your personal data;
4. The right to data portability — you may request that your data be transferred to you or another organisation in a structured format;
5. The right to restrict processing — you may request that we limit the way we use your data; and
6. The right to object — you may object to processing of your data based on legitimate interests or for direct marketing purposes.

To exercise any of these rights, please submit a written request to: dpo@oshunja.com. We will respond within thirty (30) days of receipt of your request.

10. Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Notice or the handling of your personal data, please contact us:

You also have the right to lodge a complaint with the Office of the Information Commissioner (OIC):