Privacy Policy

The data controller is Carisma Aesthetics Ltd. (company number C 106006, VAT MT30347620, registered address 35/16B Hever Court, Triq Moletta, Swieqi SWQ 3532, Malta), operating as Carisma Medical (carismamedical.com), part of Carisma Wellness Group, Floriana, Malta. For anything in this policy, including exercising your rights, contact us at hello@carismamedical.com. Our designated data protection contact can be reached at the same address; mark your message for their attention.

• Identity and contact details: your name, email address and phone number.
• Your assessment answers, which include health information about you.
• Photos you send us for clinical assessment.
• Messages you exchange with our team, including over WhatsApp.
• Technical data: device information, analytics events and cookies.

Your assessment answers and clinical photos are health data, a special category of personal data under Article 9 of the GDPR. We process them on the basis of your explicit consent (Article 9(2)(a)) and for the provision of health care by professionals bound by professional secrecy (Article 9(2)(h)).

You can withdraw your consent at any time by emailing hello@carismamedical.com. Withdrawal stops future processing. It cannot undo a medical review that has already been completed, which remains part of your medical record as the law requires.

• To carry out your medical assessment and provide your care (performance of a contract, Article 6(1)(b)).
• To meet our legal and clinical record-keeping duties (legal obligation, Article 6(1)(c)).
• To contact you about your assessment and your care, with your consent.
• To improve the service, on the basis of our legitimate interests. Service improvement never uses your health answers.

We use a small number of processors to run the service, each bound by a data processing agreement:

• HighLevel Inc. (GoHighLevel), our CRM and messaging platform, with safeguards for transfers outside the EEA (Standard Contractual Clauses).
• Our hosting provider, which serves this website.
• WhatsApp (Meta), for the messages you choose to exchange with us there.
• Our payment provider, for the payment links we send you.

Your health answers are never sent to advertising platforms.

• Sell your data.
• Share it with advertisers.
• Post anything to you that reveals the service.
• Discuss your care with anyone but you, unless the law requires it or you ask us to, for example a letter to your GP at your request.

Medical records are retained in line with Maltese clinical record-keeping obligations (10 years from your last clinical encounter, in line with the Maltese public health record retention benchmark). Waitlist and marketing contacts are kept until you unsubscribe, or are deleted after prolonged inactivity. Partial, unsubmitted assessments are deleted on a defined schedule.

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data rectified.
• Request erasure. For medical records, erasure is limited by our legal duty to keep them for the required period; we will explain plainly what can and cannot be deleted.
• Restrict or object to processing.
• Receive your data in a portable format.
• Withdraw your consent at any time.
• Complain to the Information and Data Protection Commissioner (IDPC), Malta.

To exercise any of these, email hello@carismamedical.com. We respond within the timescales the law sets.

Your data is encrypted in transit. Access to health data is limited to the clinical team who need it for your care. No health data is placed in analytics tools or advertising pixels.

We use a few cookies to keep the site working and understand what helps people. Your assessment answers are never stored in cookies or shared with advertisers. Essential cookies keep the site functioning; analytics cookies help us understand how the site is used and are only set with your consent. You can change your choice at any time through the cookie settings.

The service is for adults 18 and over. We do not knowingly process children's data, and our assessment screens for age before anything else.

When this policy changes, we update the date at the top and keep prior versions available on request. If a change meaningfully affects how your health data is handled, we tell you directly before it takes effect.