Privacy notice

ANICA Wellness Spa, at 106 Visayas Avenue, Barangay Culiat, Quezon City, Metro Manila, is responsible for the personal information described here. In the language of the Data Privacy Act of 2012 (Republic Act 10173) we are the personal information controller, which means the obligations below are ours and not something we can pass to a supplier.

For anything about your own information — to see it, correct it, or have it erased — write to the owner of ANICA Wellness Spa at hello@anicawellnessspa.info, or speak to whoever is at the desk and ask them to pass it on. You will not be charged for asking.

We ask for two different kinds of thing, and it is worth being clear about which is which.

The first is how to reach you and who you are: your name, mobile number, email address, birthday, and the city and barangay you live in. We use it to hold your booking, to send your confirmation and reminders, and so the desk knows who is arriving. Your birthday is used for the birthday greeting and any birthday perk your membership carries; if you would rather not receive those, say so and we will stop.

The second is your health information, which is treated separately below.

We also record what you booked and what you paid, because we are required to. If you claim a PWD or Senior Citizen discount we record the ID number you present, because the Bureau of Internal Revenue requires it to appear on the receipt as the evidence for that discount. If you pay a reservation fee by bank transfer or GCash and send us a screenshot, we hold that image only until we have checked the payment against it.

The intake form asks about conditions such as high blood pressure, heart conditions, diabetes, pregnancy, recent surgery, skin conditions, allergies and medication. Under the Data Privacy Act this is sensitive personal information, and it is handled more carefully than the rest.

We ask for one reason: some treatments are unsafe for some conditions, and a therapist who has not been told cannot work around what they do not know. It is not used for marketing, it is never sold, and it is not shared with anyone outside the spa.

Inside the spa it is available to the staff caring for you — including the receptionist taking your booking, because that is the moment an allergy or a pregnancy has to change what is booked and with whom. Every time a member of staff opens your health record, the system records who opened it and when, and that record cannot be edited or deleted by anyone, including the owner.

You may decline to answer. We will still treat you, but a therapist may decline a specific treatment if they cannot establish that it is safe, and that is a judgement we would rather make out loud than by guessing.

We do not sell your information and we do not share it for anyone else's marketing. A small number of suppliers process parts of it on our behalf, only as far as the job requires:

Our systems are hosted in Singapore. That means your information is processed outside the Philippines, which the Data Privacy Act permits — but it does not reduce what we owe you. We remain answerable for it wherever it sits, and we choose suppliers who are contractually bound to protect it to the same standard.

Different things have different reasons to exist, so they have different lifespans.

The Data Privacy Act gives you rights over your own information, and we have built the system so that we can actually honour them rather than merely list them here.

Staff sign in with their own accounts and see only what their role requires. Passwords are stored hashed, never in readable form. Repeated failed sign-ins are locked out. Changes to records are written to a log that cannot be edited or deleted, and opening a health record is one of the things written there.

Backups are encrypted, so a copied file is not a readable copy of your health record. Reports that staff export for everyday work — client lists, sales summaries — deliberately exclude health information entirely.

None of this makes a system impossible to breach, and we would rather say so than imply otherwise. If a breach ever puts your information at real risk, we will tell you and the National Privacy Commission, as the law requires.

Where a client is under 18, we ask that a parent or guardian gives consent and completes the health questions with them. We do not knowingly collect information from a child without it.

If we change how we handle your information we will update this page and the date at the top of it. Where a change is significant, we will ask for your consent again rather than assume the old one still covers it.