Personal Data Protection Policy

BonBoz Aesthetic and Dermatology Clinic ("BonBoz", "we") is operated by 4B Trading Service Joint Stock Company, tax code 0317856632.

We are the Personal Data Controller for the data specified in this Policy.

The Policy applies to all personal data BonBoz processes when receiving and providing customer care, through the following channels:

Only the chat assistant on the website is automated software. When you message via Facebook Messenger or Zalo OA, or call the hotline, the person communicating with you is a real staff member of the clinic, not a machine.

This policy does not apply to medical records and medical examination and treatment information — such data are managed separately under the law on medical examination and treatment; and does not apply to third-party websites and applications that we link to.

3.1 — Data you actively provide:

3.2 — Data automatically recorded when you access the website: IP address, browser and device type, pages viewed, access time, source leading to the website, and interaction signals for anti-spam purposes.

3.3 — Clear notice regarding sensitive data: information about your health status, and data tracking service usage behavior in cyberspace, are both classified by Vietnamese law as sensitive personal data.

You are not required to provide health information to contact us, and your disagreement to allow the collection of information is not a condition to be served. You can just leave your name and phone number, then discuss details directly with the doctor when coming for your examination.

We recommend not sending images of body areas or medical documents through online chat channels.

This section only refers to the assistant on the website. Messenger, Zalo OA, and the hotline are handled by real staff; this section does not apply.

4.1 — This is software, not a doctor. The content provided by the assistant is for reference only, not a diagnosis or treatment prescription. All conclusions about your condition must be made by a doctor after a direct examination.

4.2 — Operating principle: the assistant is a language model. When you send a question, that content is transferred to the model provider to generate an answer, accompanied by public information about the clinic's services and doctors as context. The assistant does not decide anything on its own regarding your benefits, service prices, or treatment regimen — all such decisions are made by humans.

4.3 — We do not store the content of your chat. After the chat session ends, the content is not recorded in our system in any form — no verbatim storage, no summary storage.

We only record statistics in the form of fixed labels: which group the asked topic belongs to, which service is of interest, at which step you stopped, how many turns the conversation lasted, and whether a consultation request arose. We use them to know where customers usually get stuck and to improve the quality of responses. These statistics do not contain the words you entered.

4.4 — You have the right not to participate. If you do not want to interact with the automated assistant, you can close the chat window and contact real staff via hotline 0869 612 310 · 1900 5309, via Facebook Messenger, Zalo OA, or fill out the form for staff to call you back. You are fully served equally across all channels.

4.5 — In case you leave your phone number: when you actively leave your phone number during the chat to receive consultation, we save your name, phone number, and the service you are interested in into the customer profile — necessary for staff to contact you back according to your request.

We ask for your consent separately for each purpose below:

We do not sell your personal data to anyone.

When you first visit, the website displays a notification for you to Agree or Decline. No options are pre-selected. If you do not select anything, the system by default considers it as not agreed and does not activate any measurement tools.

• Necessary cookies — serving basic operations and remembering your choices. Always active.
• Measurement and advertising cookies — only activated after you click "Agree".

Rejecting cookies does not cause the loss of any features. You can still view the entire content, still submit forms, and still chat with the assistant. To change your choice, delete website data in your browser — the notification will appear again.

We do not sell, trade, or rent your personal data.

To operate the website and contact you, we use some technical service providers. They are infrastructure providers, only allowed to process data in accordance with our requirements and within the scope necessary for the assigned work — they are not allowed to use your data for their own purposes.

We do not provide your data to other medical examination and treatment facilities or insurance companies, unless you have a written request. We may provide data to competent state authorities upon a lawful request.

If you want to know the specific name of each provider in the table above, please contact dvkh@bonboz.vn — we provide them in full.

Some providers mentioned in Section 7 have their servers located outside the territory of Vietnam. Therefore, your data may be stored and processed abroad. Particularly, the message management platform and call center system are provided by Vietnamese enterprises.

With this activity, we:

• Only select providers with clear confidentiality commitments;
• Only transfer the minimum amount of data necessary for the work;
• Do not transfer your conversation content for storage (see Section 4);
• Fulfill obligations in accordance with the provisions of Vietnamese law on the transfer of personal data abroad.

You have the following rights:

1. To be informed about the processing of your personal data;
2. To consent or not consent, and to request the withdrawal of consent already given;
3. To view, edit, or request the correction of personal data;
4. To request the provision, deletion, or restriction of data processing; to object to data processing;
5. To complain, denounce, file a lawsuit, or claim damages in accordance with the law;
6. To request the application of measures to protect your personal data.

How to exercise: send a request to dvkh@bonboz.vn or call 0869 612 310. To protect yourself, we need to verify the identity of the requester before processing.

Our committed timeframe:

In case many factors arise affecting the processing time, we may extend it a maximum of 01 time in accordance with the law and will notify you.

Note: we are required to retain certain data in accordance with the law on medical examination and treatment and on accounting, even if you request deletion. In that case, we will clearly state the reason.

BonBoz only accepts and treats children when accompanied by a father, mother, or legal guardian, or with their consent. The legal representative shall, on behalf of the child, exercise the rights specified in Section 10.

If you are a child, please do not submit personal information through the website on your own without the consent of your parents or guardian. If we detect that we have collected a child's data without valid consent, we will stop processing and delete that data.

We apply: encryption of all connections to the website (HTTPS); a content security policy restricting unauthorized code from executing on the page; access control regulations limiting access to the administration system; operation logs for all data changes; and limiting administrator accounts to internal personnel.

No system is absolutely secure. If an incident occurs that affects your data, we will notify the authority in charge of personal data protection no later than 72 hours from detection, draw up a confirmation record, and cooperate in handling it in accordance with regulations.

Before/after images posted on the website are all real cases and are only used when the customer has given written consent. Each person's results vary depending on their physical constitution and are not to be considered a guarantee of the results you will achieve.

If you are the customer in these images and wish to withdraw your consent, please contact dvkh@bonboz.vn — we will remove them within the time limit specified in Section 10.

When there are changes, we will update the effective date at the top of the page and post a notice on the website.

If the changes relate to the purpose of processing your personal data, we will obtain your consent again — your continued use of the website shall not be deemed as your consent to such changes.