Skip to content
Beauty Brows by Lan Vu

Privacy policy

Last updated October 5, 2026.

DRAFT: This text is under review and has not been finally approved.

Data controller

Beauty Brows ApS is the data controller for the processing of your personal data. You will find our contact details under "Company" on this page.

What data we process

  • When you write to us: name, email, phone number (optional), your message and any selected treatment. We also record IP address and browser information to protect the form against spam and abuse.
  • When you book and are treated: contact details, booking history, consultation form and consent form. The consultation form may contain health information. We also note whether the booking came via the website, the treatment finder, an invitation from us or the chat, so we can see what works.
  • When you write to us by email, SMS, WhatsApp, Messenger or Instagram: your messages and our replies, plus your name and your email, phone number or Meta user ID. Attachments are not stored in our system. [Confirm]
  • When you chat with our AI assistant: your messages and the assistant's answers. Please do not write health information in the chat; the assistant passes health questions on to us if you wish (with your name and email).
  • When you use the treatment finder: your answers (including whether there are health factors you should talk to us about – only yes, no or do not know) and the photos you choose to send. The photos are stripped of metadata such as GPS location before they are stored, and only the clinic can see them. The clinic may use an AI tool (Anthropic) to describe the photos in support of its own assessment; only the clinic sees the result and it is never sent to you automatically. [Confirm]

Purposes and legal basis

  • To answer your enquiry and manage your booking (GDPR Article 6(1)(b) and (f)).
  • To assess whether the treatment can be performed safely. Health information is only processed with your explicit consent (Article 9(2)(a)).
  • To give you a suggestion in the treatment finder and, if you send it to us, to assess your treatment based on your answers and photos. Photos are only processed with the consent you give in the finder (Article 6(1)(a)). [Confirm: legal basis for health answers]
  • To comply with the Danish Bookkeeping Act (Article 6(1)(c)).
  • We only send marketing, such as refresh reminders, if you have given your consent. You can always unsubscribe.

Retention

  • Enquiries are deleted when they are no longer relevant. [Confirm: at the latest after 12 months]
  • Conversations with the AI assistant are deleted 90 days after the last message.
  • Messages by email, SMS, WhatsApp, Messenger and Instagram are deleted 24 months after the last message. [Confirm: retention period]
  • Treatment finder answers that you do not send to us are deleted after 90 days. Photos are deleted after 24 hours if you do not send them, and after 90 days if you do not book.
  • Accounting records are kept for 5 years under the Danish Bookkeeping Act.
  • Consultation and consent forms are kept for as long as necessary for your safety and any complaints. [Confirm: retention period]

Recipients

We do not share your data with anyone other than the suppliers (data processors) who help us run the website and booking system, such as hosting and sending email and SMS. The chat uses Anthropic (Claude) as a data processor to write the answers. [Confirm: data processing agreement and where data is processed] Messages on WhatsApp, Messenger and Instagram pass through Meta, and emails to us are received via Mailgun. [Confirm: data processing agreements and transfers outside the EU/EEA] The data is stored within the EU/EEA. [Confirm: suppliers]

Cookies and statistics

The website does not use cookies for tracking or marketing. Our visitor statistics are anonymous and cookie-free. To protect against spam, the form may use Cloudflare Turnstile, which processes technical information about your browser.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to object. If you have given consent, you can withdraw it at any time. Write to us to exercise your rights.

Complaints

You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk.