Privacy Notice

AGATA CRM is a cloud management system (CRM) for aesthetic clinics and beauty salons, provided by ФОП Димо Анна Ігорівна, м. Миколаїв, вул. Галини Петрової, 5, Ukraine. This notice explains which personal data are processed in the service and on our agatacrm.com website, where they come from, on what legal basis, with whom they are shared, for how long they are kept and what rights you have.

1. Who is responsible for what

• The clinic you visit is the controller of your personal data. It decides which data to record, for what purpose and for how long, and which of its staff may see them. It is the clinic that informs you about the processing and that answers your requests.
• ФОП Димо Анна Ігорівна is the processor: we provide the software and process the clinic's data only on its instructions, under a Data Processing Agreement. We do not use these data for our own purposes, we do not sell them and we do not share them with other clinics.
• For the accounts of clinic staff (registration, sign-in, subscription, support requests) and for visitors to our agatacrm.com website (requests and web analytics) ФОП Димо Анна Ігорівна is the controller.

2. Where the data come from

• From you — when you book online, sign a consent through a link sent by SMS, or write to the clinic in a connected messenger.
• From the clinic — its staff create your record, book visits and add notes.
• From another system — when the clinic moves its existing client base to AGATA.
• From connected messengers — Telegram and Instagram Direct, if the clinic connected them.
• From Meta lead forms — requests you left in the clinic's advertisement.
• From our agatacrm.com website — when you leave a request there, and through the website's analytics (section 14).

3. Which data are processed

• identification and contact data: name, phone, email, date of birth where the clinic records it;
• visit history, services received, appointment reminders sent;
• payments recorded by the clinic: amount, method and date — never card numbers;
• consents you signed and the SMS code used to sign them;
• messages exchanged with the clinic in connected messengers and leads from Meta forms;
• health data the clinic records in your medical record: health questionnaire, notes on procedures, before/after photographs (section 6).
• support requests — the text clinic staff send us through “Found a bug?”, any screenshots attached (they may show client data — the clinic confirms this separately) and technical details of the page and browser; screenshots are kept in private storage and seen only by the AGATA team.
• requests from the agatacrm.com website (demo booking, “call me back” and other website forms): name, phone, clinic name, preferred way of contact, the page the request was sent from (including UTM tags in its address) and the IP address, used to limit how often requests can be sent;
• visitors to the agatacrm.com website, where web analytics is on (section 14): the identifier in the Google Analytics cookie, pages viewed and how you reached them, actions on the site (for example, that a request was sent), device and browser type, and approximate location that Google derives from the IP address.

4. Legal bases

The clinic, as controller, relies on the following bases; we process on its behalf.

• Performance of a contract (Article 6(1)(b) GDPR): booking and providing the services you asked for, reminders about your visit.
• Legitimate interest (Article 6(1)(f)): keeping records of visits and payments, preventing double bookings, protecting the service against abuse.
• Consent (Article 6(1)(a)): marketing messages and the use of your photographs; you may withdraw consent at any time by contacting the clinic.
• Health data (Article 9(2)): the clinic relies on your explicit consent (Article 9(2)(a)) or, where it provides medical care under the responsibility of a professional bound by secrecy, on Article 9(2)(h). Which of the two applies is the clinic's decision and is stated in the consent you sign.
• Legal obligation (Article 6(1)(c)): accounting and, where applicable, medical record-keeping rules of the clinic's country.

Visitors to the agatacrm.com website (we are the controller): a request you leave is handled as steps taken at your request before entering into a contract (Article 6(1)(b)). Website analytics (section 14) relies on your consent where the site asks for it — in Europe (Article 6(1)(a)); in Ukraine and the rest of the world it relies on our legitimate interest in knowing how visitors use the site (Article 6(1)(f)). You can object at any time by switching analytics off in the site's cookie settings. The marketing option (section 14) relies only on your consent (Article 6(1)(a)), wherever you are: it is never switched on unless you choose it.

5. Online booking, consents and messages

When you book through the clinic's public page, we store the name, phone number and appointment you entered and pass them to the clinic. When you sign a consent through a link, we record the time of signature and the phone number to which the code was sent. Messages you send to the clinic through Telegram or Instagram are stored so that the clinic's staff can answer them; the messaging platform processes them under its own terms.

6. Health data

The clinic decides whether to keep a medical record in AGATA. If it does, the free-text fields of that record, together with your phone and email, are encrypted in the database with a key specific to the clinic: a copy of the database without the key does not reveal them. Photographs are kept in private storage and opened only through short-lived signed links. Only the roles the clinic authorises can open the record.

7. Artificial intelligence

Where the clinic switches on AI features (for example an assistant that answers client messages or summarises figures for the owner), the text needed for the task is sent to our AI provider, Anthropic (USA), which under its commercial terms does not use it to train its models. The clinic can turn these features off at any time. No automated decision with legal or similarly significant effect on you is taken.

8. Recipients and sub-processors

We use technical providers without which the service does not work. Each of them processes data only on our instructions:

• Vercel (USA) — application hosting;
• Neon (USA) — database;
• Clerk (USA) — authentication of clinic staff, session cookies;
• Cloudflare R2 (USA) — file and photo storage;
• Anthropic (USA) — AI features (section 7);
• Meta Platforms — Instagram Direct messages and lead forms;
• Telegram — message delivery in Telegram;
• TurboSMS or AlphaSMS (Ukraine) — SMS sending, where the clinic uses them: reminders, confirmation codes, consent links;
• WayForPay, LiqPay or monobank (Ukraine) — online prepayments for bookings, where the clinic enables them; card data are entered on the payment provider's side and never reach us.

We inform clinics of any replacement or addition of a provider.

The agatacrm.com website is not part of this list: it is not connected to the CRM application and has no access to the data of clinics or their clients. Its providers are:

• Google (USA) — web analytics of the website (Google Analytics 4) under section 14;
• Hosting Ukraine (“Хостинг Україна”, Ukraine) — website hosting; requests sent through the website's forms are also stored there.

A request from the website also reaches the AGATA platform back office. Where this is set up, the AGATA team is also notified of a new request in Telegram or by email, and TurboSMS sends you an SMS confirming the request.

We disclose data to public authorities only where the law requires it. Nobody else receives the data.

9. International transfers

ФОП Димо Анна Ігорівна is established in Ukraine, and several providers above are in the USA. Ukraine is not covered by an EU adequacy decision; the EU adequacy decision for the USA (EU-US Data Privacy Framework, 2023) covers only US organisations certified under it. For clinics in the EU/EEA the transfer to us is governed by the Standard Contractual Clauses (Commission Decision (EU) 2021/914, Module Two) incorporated in the Data Processing Agreement; onward transfers to our providers rely on their own data processing terms and transfer mechanisms. You may ask the clinic or us for a copy of the safeguards.

Website analytics for agatacrm.com is separate: it transfers data about website visitors to Google in the USA and is not needed for the CRM. For visitors in Europe it runs only with consent; elsewhere it relies on our legitimate interest and can be switched off at any time (sections 4 and 14). Google processes these data under its own data processing terms and transfer mechanisms.

10. Retention

• the clinic's data and its clients' data are kept for as long as the clinic uses the service and until the clinic deletes them;
• a record deleted in the application disappears from the interface immediately; a technical trace remains in the database so that linked records (visits, payments) stay consistent, until final erasure;
• final erasure is performed on a written request from the clinic or from you within 30 days — see Data deletion; there is no automatic erasure on a schedule;
• after a subscription ends we keep the clinic's data for at least 90 days so that it can export them, and delete them at its request;
• backup copies are overwritten on schedule; deleted data disappear from them as they are overwritten;
• requests from the agatacrm.com website are kept on the website's server and in the AGATA platform back office with no automatic erasure; we delete them at your request;
• Google Analytics keeps data about an individual website visitor for no longer than 14 months, the longest period it allows for a standard property. Analytics cookies last up to 2 years from your last visit to the site, and your cookie choice lasts 180 days (section 14).

11. Security

• encryption in transit (HTTPS);
• field-level encryption in the database of phone, email and medical free-text fields, with a separate key per clinic; contact data in unprocessed leads and in the waiting list are not yet covered, and encryption is being extended to them in stages;
• technical isolation of clinics at database level — one clinic cannot see another clinic's data;
• role-based access: owner, manager, administrator and specialist see different scopes of data;
• an audit log of sensitive operations — adding and removing staff, changing roles and permissions, deleting a client record, editing a financial transaction — with who did it and when;
• files in private storage, opened only through short-lived signed links;
• our staff access a clinic's data only for technical support at its request or to fix a fault.

12. Personal data breaches

On becoming aware of a breach we notify the affected clinic without undue delay and in any event within 72 hours, describing what happened, which data were affected and what we are doing. The clinic, as controller, decides on notifying its supervisory authority and the people concerned. Where the breach concerns data for which we are the controller (staff accounts), we notify the person directly.

13. Your rights

Under the GDPR you have the right to:

• access your data and receive a copy (Article 15);
• have inaccurate data corrected (Article 16);
• have your data erased where there is no longer a lawful reason to keep them (Article 17);
• restrict processing (Article 18) and receive your data in a portable format (Article 20);
• object to processing based on legitimate interest, including direct marketing (Article 21);
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
• lodge a complaint with a supervisory authority — in Hungary the National Authority for Data Protection and Freedom of Information (NAIH), or the authority of your place of residence.

Because the clinic is the controller, please address requests to the clinic first; it can act on your record directly. You may also write to us at crmagata@gmail.com: we answer within 30 days and, where the data belong to a clinic, we forward the request to it and help it respond. If you left a request on the agatacrm.com website, write to us directly.

14. Cookies

The CRM application (app.agatacrm.com and clinic subdomains) uses only cookies necessary for it to work. The sign-in session of clinic staff is kept by cookies set by our authentication provider, Clerk. Our own cookies remember on your device the chosen colour theme and interface language, the clinic from which you last signed in on that device and when (so that the sign-in page can show the clinic's name), and that you hid the subscription payment reminder for the rest of the day. While you connect Instagram, the application sets for a few minutes a one-time Instagram connection code (so that the same person who started the connection completes it) and the result of the Instagram connection, which is removed as soon as the settings page has shown it. The application neither sets nor reads advertising, analytics or tracking cookies, and therefore has no consent banner.

The website and the application share the agatacrm.com domain. The website's analytics cookies (Google Analytics) and the cookie that stores your cookie choice are set for agatacrm.com itself only, so your browser does not send them to the application. Some of the application's cookies (the interface language, for example) apply to the whole domain, so the browser also sends them to the website, which does not read them. The only cookie the two share is the colour theme (agata_theme): a theme chosen on the website also applies in the application, and the other way round.

The agatacrm.com website. Its necessary cookies store your cookie choice and colour theme and are always on. Analytics cookies (Google Analytics 4) help us understand which pages of the site are useful to visitors. When they are switched on depends on where you open the site from:

• Europe — EU and EEA countries, the United Kingdom, Switzerland and other European countries except Ukraine: only after you consent in the cookie banner. Until then the analytics script is not loaded.
• Ukraine and the rest of the world: straight away, without a banner. You can switch analytics off at any time through the “Налаштування cookie” (Cookie settings) link at the bottom of the site's pages. The marketing option stays off (see below).

The site may also show the banner outside Europe; analytics is then likewise switched on only after you consent.

The site works out your region inside your browser, from your device's time zone. We do not use your IP address for this, and the time zone is not sent anywhere. If the time zone cannot be determined, the site asks for consent, as it does in Europe.

Marketing cookies. There are no separate advertising tags on the site. The “Маркетингові” (Marketing) option in the banner gives Google permission (Google Consent Mode) for advertising cookies and for using data about visits to the site for advertising. It is never switched on by default: in Europe only with your consent in the banner, in Ukraine and the rest of the world only if you switch it on yourself in the cookie settings. In addition, Google signals and ad personalisation are turned off in the site's analytics: data about your visits are not linked to your Google account and are not used for personalised advertising, even when the marketing option is on.

How long your choice lasts. The site stores your consent or refusal in a cookie in that browser for 180 days. When that period ends, when you delete the site's cookies or when we change the list of cookie categories, you will need to choose again: in Europe the banner appears again; outside Europe analytics is switched back on until you switch it off, while the marketing option stays off until you switch it on yourself. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

15. Children

The service is intended for use by clinics and their adult clients. A clinic that records data of a minor is responsible for having the required consent of a parent or guardian.

16. Changes

We may update this notice when the service changes. The date of the current version is shown at the top; clinics are informed of material changes in the application or by email.

17. Contact

ФОП Димо Анна Ігорівна, м. Миколаїв, вул. Галини Петрової, 5, Ukraine. Data protection requests: crmagata@gmail.com. Support: crmagata@gmail.com.