Personal Data Protection Policy

BonBoz Aesthetic and Dermatology Clinic ("BonBoz", "we") is operated by 4B Trading Service Joint Stock Company, tax code 0317856632.

We are the Personal Data Controller for the data specified in this Policy.

The Policy applies to all personal data BonBoz processes when receiving and caring for customers, through the following channels:

Only the chat assistant on the website is automated software. When you message via Facebook Messenger or Zalo OA, or call the hotline, the person communicating with you is a real staff member of the clinic, not a machine.

This policy does not apply to medical records and medical examination and treatment information — such data is managed separately in accordance with the law on medical examination and treatment; and does not apply to third-party websites and applications that we link to.

3.1 — Data you actively provide:

3.2 — Data recorded automatically when you access the website: IP address, browser and device type, pages viewed, access time, source leading to the website, and interaction signals for anti-spam purposes.

3.3 — Clear notice on sensitive data: information about your health status, and data tracking service usage behavior in cyberspace, are both classified by Vietnamese law into the group of sensitive personal data.

You are not required to provide health information to contact us, and your non-consent to the collection of information is not a condition to be served. You can just leave your name and phone number, then discuss details directly with the doctor when coming for the examination.

We recommend not sending images of body areas or medical documents through online chat channels.

This section only refers to the assistant on the website. Messenger, Zalo OA, and the hotline are handled by real staff, this section does not apply.

4.1 — This is software, not a doctor. The content provided by the assistant is for reference only, not a diagnosis or treatment indication. All conclusions about your condition must be made by a doctor after a direct examination.

4.2 — Operating principle: the assistant is a language model. When you send a question, that content is transferred to the model provider to generate an answer, accompanied by public information about the clinic's services and doctors as context. The assistant does not decide anything on its own regarding your benefits, service prices, or treatment regimen — all such decisions are made by humans.

4.3 — We do not store the content of your chat. After the chat session ends, the content is not recorded in our system in any form — no verbatim storage, no summary storage.

We only record statistics in the form of fixed labels: which category the asked topic belongs to, which service is of interest, at which step you stopped, how many turns the conversation lasted, and whether a consultation request arose. We use them to know where customers usually get stuck and to improve the quality of responses. These statistics do not contain the words you entered.

4.4 — You have the right not to participate. If you do not want to interact with the automated assistant, you can close the chat window and contact real staff via hotline 0869 612 310 · 1900 5309, via Facebook Messenger, Zalo OA, or fill out the form for staff to call you back. You are served fully and equally across all channels.

4.5 — In case you leave your phone number: when you actively leave your phone number during the chat to receive consultation, we save your name, phone number, and the service you are interested in into the customer profile — necessary for staff to contact you back in accordance with your request.

We seek your consent separately for each purpose below:

We do not sell your personal data to anyone.

When you first visit, the website displays a notification for you to Agree or Decline. No options are pre-selected. If you do not choose anything, the system by default considers it as not yet agreed and does not activate any measurement tools.

• Necessary cookies — serving basic operations and remembering your choices. Always active.
• Measurement and advertising cookies — only activated after you click "Agree".

Rejecting cookies does not disable any features. You can still view all content, submit forms, and chat with the assistant. To change your choice, clear the website data in your browser — the notification will appear again.

We do not sell, exchange, or rent your personal data.

To operate the website and contact you, we use several technical service providers. They are infrastructure providers, only allowed to process data in strict accordance with our requests and within the scope necessary for the assigned work — they are not allowed to use your data for their own purposes.

We do not provide your data to other medical examination and treatment facilities or any insurance company, unless you make a written request. We may provide data to competent state authorities upon a lawful request.

If you want to know the specific name of each provider in the table above, please contact dvkh@bonboz.vn — we provide them in full.

Some providers mentioned in Section 7 locate their servers outside the territory of Vietnam. Therefore, your data may be stored and processed abroad.

With this activity, we:

• Only choose providers with clear confidentiality commitments;
• Only transfer the minimum amount of data necessary for the work;
• Do not transfer your conversation content for storage (see Section 4);
• Fulfill obligations under the regulations of Vietnamese law on transferring personal data abroad.

You have the following rights:

1. To be informed about the processing of your personal data;
2. To consent or not consent, and request to withdraw the consent given;
3. View, edit, or request correction of personal data;
4. Request the provision, deletion, or restriction of data processing; object to data processing;
5. Complain, denounce, file lawsuits, and claim damages in accordance with the law;
6. Request the application of measures to protect your personal data.

How to do so: send a request to dvkh@bonboz.vn or call 0869 612 310. To protect yourself, we need to verify the identity of the requester before processing.

Our committed timeframe:

In case many factors arise affecting the processing time, we may extend it a maximum of 01 time in accordance with the law and will notify you.

Note: some data we are required to keep under the law on medical examination and treatment and on accounting, even if you request deletion. In that case, we will clearly state the reason.

BonBoz only accepts and processes for children when accompanied by their father, mother or legal guardian, or with their consent. The legal representative, on behalf of the child, exercises the rights specified in Section 10.

If you are a child, please do not send personal information through the website on your own without the consent of your parents or guardian. If we detect that we have collected children's data without valid consent, we will stop processing and delete that data.

We apply: encryption of all connections to the website (HTTPS); a content security policy restricting unauthorized code from executing on the page; access control regulations limiting access to the administration system; operation logs for all data changes; and limiting administration accounts to internal personnel.

No system is absolutely secure. If an incident occurs affecting your data, we will notify the specialized personal data protection authority no later than 72 hours from detection, prepare a confirmation record, and coordinate the handling in accordance with regulations.

Before/after images posted on the website are all real cases and are only used when the customer has consented in writing. Each person's results vary depending on their physical constitution and are not to be considered a commitment to the results you will achieve.

If you are the customer in these images and wish to withdraw your consent, please contact dvkh@bonboz.vn — we will remove them within the time limit in Section 10.

When there are changes, we update the effective date at the top of the page and notify on the website.

If the changes relate to the purpose of processing your personal data, we will seek your consent again — your continued use of the website is not considered as your consent to those changes.