Private Policy

VIRENA PTY LTD

Date: [31/10/2025]
Version: 1.0

1. Introduction

Virena (referred to as “we”, “us”, “our”) is committed to protecting the privacy and personal information of our clients, staff, suppliers and other natural persons (collectively, “you” or “data subject”).
This Privacy Policy sets out how we collect, use, store, share and protect your personal information in accordance with the requirements of Protection of Personal Information Act 4 of 2013 and other applicable laws in South Africa.

2. Definitions

For the purposes of this Policy:

  •  “Personal Information” means any information relating to an identifiable, living natural person, and where applicable, an identifiable existing juristic person.
  • “Processing” means any operation or activity (automated or not) in respect of personal information, including collection, receipt, recording, organisation, storage, updating, retrieval, dissemination or erasure (POPIA Act).
  • “Responsible Party” means the entity (in this case, our business) that determines the purpose for and means of processing personal information.
  • “Data Subject” means the person to whom the personal information relates.
  • “Information Officer” means the person appointed to ensure our compliance with POPIA, including registration with the Information Regulator (mondaq.com).

3. Scope

This Policy applies to all personal information provided to us (whether in person, by phone, by email, via our website, or otherwise) in connection with our facial treatment services, and to all processing of personal information by us, including by our employees, contractors and service providers.

4. What personal information we collect and why

We may collect the following types of personal information from you:

  • Contact information (name, surname, email address, telephone number, physical address)
  • Identification information (e.g., identity number, date of birth) if required for legal or regulatory purposes
  • Medical / health information relevant to facial treatments (skin conditions, allergies, medications, previous treatments)
  • Appointment and payment information (appointment dates/times, service details, payment method, invoice details)
  • Marketing preferences (whether you agree to receive marketing communications)
  • Other information reasonably required to provide our services securely and effectively

 

Purposes for collection may include:

  • Scheduling, providing and billing for facial treatments
  • Assessing suitability of treatments (including health/skin-condition screening)
  • Communicating with you (confirming appointments, follow-up, reminders)
  • Complying with legal/regulatory obligations (e.g., health & safety, consumer protection)
  • Improving our services, maintaining client records, ensuring continuity of care
  • (If applicable) Marketing our offerings to you (with your consent)

5. Lawful basis for processing (POPIA conditions)

We will ensure that personal information is processed lawfully, in a reasonable manner, and in a transparent way that respects your privacy rights.


Specifically, we rely on one or more of the following conditions:

  • You have given consent for us to process your personal information for a specific purpose (e.g., health screening for treatment suitability)
  • The processing is necessary for the performance of a contract to which you are a party (e.g., treatment agreement)
  • We have a legitimate interest that does not override your interests, rights and freedoms (e.g., improving service quality)
  • We are required by law or a regulatory obligation to process your information

6. How we collect personal information

We collect personal information in a number of ways, including:

  • Directly from you when you complete registration, consultation or treatment forms
  • By telephone, email, or via our website when you make enquiries or bookings
  • From third parties only if you have authorised such information sharing or it is permitted by law (for example, your general practitioner may share relevant skin/health information with your consent) We endeavour to collect only the information that is adequate, relevant and not excessive in relation to the purpose for which it is collected (POPI Academy). 

7. Retention and destruction

We will keep your personal information only for as long as is necessary for the purposes for which it was collected, or as required by contract or law, whichever is longer. When it is no longer needed, we will securely destroy or de-identify it (POPI Academy).

8. Security and data protection

We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, damage, alteration or destruction. These measures include (but are not limited to):

  • Physical security of paper records (locked cabinets, access control)
  • Secure electronic storage (password protection, encryption where possible)
  • Limiting access to personal information to only those employees, contractors or service providers who need access for their job
  • Training our staff on confidentiality and privacy obligations
  • Ensuring any third-party service provider we use also implements appropriate safeguards

9. Sharing personal information with third-parties

We may share your personal information with third parties only for the purposes described, and subject to appropriate safeguards. Examples include:

  • Service providers who assist with booking management, payment processing, IT / cloud
    services
  • Healthcare professionals (if you consent) for referral or treatment purposes
  • Regulatory, law enforcement or legal bodies where required by law. We will ensure that any third-party to whom we supply personal information is bound contractually or by law to keep it confidential and use it only for the purpose for which we disclosed it

10. Transfer of information across borders

If your personal information is transferred to or processed in a country outside South Africa, we
will ensure that the transfer is done in compliance with POPIA’s requirements for cross-border
transfer of personal information (Public Interest SA).

11. Your rights as a data subject

Under POPIA you have the following rights (subject to certain exceptions):

  • The right to request confirmation whether we hold your personal information
  • The right to request a copy of the personal information we hold about you
  • The right to request correction or deletion (erasure) of your personal information if it is inaccurate, irrelevant, outdated or excessive
  • The right to object to the processing of your personal information (in certain circumstances)
  • The right to withdraw your consent at any time (where processing is based on consent)
  • The right to request that your personal information be made available in a structured, usable format (where technically feasible)
  • The right to lodge a complaint with us, and ultimately with the Information Regulator if you believe your rights have been infringed

 

To exercise any of these rights, please contact our Information Officer (see section 12 below).

12. Information Officer and contact details

We have appointed the following person as our Information Officer:


Name: Andreal Chioma Hamilton
Email: chioma@virena.co.za
Cell phone: +27838728020
Office Address: 10 Transvaal Street, Ravensklip, Boksburg

If you have any questions about this Policy or how we handle your personal information, or you wish to exercise your rights, please contact our Information Officer.

13. Changes to this Policy

We reserve the right to amend this Privacy Policy from time to time. When we do so, we will notify you of changes by [e.g., posting the amended policy on our website / placing a notice in our premises] and indicate the date of last update.

14. Consent and acknowledgement

By providing your personal information to us (in person or via our website / forms) you
acknowledge that you have read, understood and accepted this Privacy Policy. If we intend to use
your information for a new purpose, or share it with a third party in a way not covered in this
Policy, we will seek your consent (where required) before doing so.

End of Policy