Privacy Policy
Last updated 10 October 2026
This policy explains what personal information trisha.app collects, why, who sees it, and the choices you have. It applies to trisha.app and to every clinic, salon and spa website on it (<clinic>.trisha.app).
1. Who we are
trisha.app is an online platform for clinics, salons and spas in the Philippines. It gives each of them a website with online appointments, a scheduler, intake forms, client charts and online payments. It is operated by trisha.app, Philippines ("trisha.app", "we", "us").
We follow the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).
2. Clinics and trisha.app
Who is responsible for your information depends on whose information it is:
- If you book with a clinic, that clinic decides what it asks you and what it does with your answers. The clinic is the personal information controller for your appointments, intake answers and treatment records. trisha.app is its personal information processor: we store and handle that information for the clinic, only to run its services, under its instructions and this policy.
- If you sign up or run a clinic on trisha.app, or simply visit trisha.app, we are the controller of your account information.
Questions about how a clinic uses your records are best sent to the clinic first. You can also write to us, and we will help you reach them.
3. What we collect
Your account
- Your name, email address and profile picture from Google when you sign in with Google. We never see your Google password.
- Your role (client, clinic owner, clinic admin, staff or practitioner) and the clinic you work at.
- When you last signed in.
Appointments
- Your name and mobile number, the service, practitioner, date and time, and any notes you add. You can book without an account.
- Check-in, completion, cancellation and no-show times, and the practitioner's sign-off.
Intake forms and treatment records
- Your answers to the clinic's intake form, which may include health details, and when you agreed to the clinic keeping them.
- Chart notes written by your practitioner, and files they add, such as photos, scans and results.
Payments
- Amounts, the payment method (GCash, Maya, card or QR Ph), its status, refunds and invoices. Card and e-wallet details are entered on PayMongo's checkout, never on trisha.app, and we never see or keep them.
Clinics
- The clinic's name, address and location, contact numbers, emails and social links, opening hours, services, prices, photos and logo.
- Practitioners' names, photos, specialties, schedules and work emails.
- The clinic's own payment QRs (cropped to the QR, with the account name and number read from it), and the payment agreement its owner signed.
Technical information
- A session cookie that keeps you signed in, and your light or dark mode choice.
- Pages visited and similar usage counts through Google Analytics (see Cookies and analytics).
- Server logs (IP address, browser, time of request), kept briefly to keep the service running and secure.
4. How we use it
- To sign you in and show you what your role allows.
- To take, confirm, reschedule and cancel appointments, and to let the clinic and its practitioners care for you.
- To text and email you about your appointments, payments and refunds. These texts never contain links.
- To take payments through PayMongo, refund them, and pay clinics what they have earned.
- To support clinics: our staff may open a clinic's admin, or sign in as a user, to help fix a problem. Each time a superadmin signs in as someone else, it is recorded.
- To keep trisha.app secure, find and fix errors, and prevent fraud and misuse.
- To understand, in aggregate, how trisha.app is used so we can improve it.
- To meet legal duties, such as tax and accounting records, and to answer lawful requests from authorities.
We process your information because you consented, because we need it to provide the service you asked for (a contract), because the law requires it, or for our legitimate interests in running a safe and working service, as Sections 12 and 13 of the Data Privacy Act allow. We do not sell your personal information and do not use it for advertising.
5. Health information
Intake answers, chart notes and chart files can hold health details. These are sensitive personal information under the Data Privacy Act, so:
- The clinic asks for your express consent before you send intake answers, every time you book.
- Only the clinic's own team can see them. Chart notes and files are shown only to the clinic's practitioners.
- Chart files are kept in private storage and opened only through short-lived links.
- They are never sent to Google Analytics or any other analytics or advertising service.
7. Storage and transfers abroad
Some of our providers, including Google, Supabase and Cloudflare, store or process information on servers outside the Philippines. When they do, we stay responsible for it under the Data Privacy Act and use providers whose protections are comparable.
8. How long we keep it
- Accounts: while the account is in use. Delete it any time from My account; appointments made with it stay with each clinic, no longer linked to you.
- Appointments, intake answers and treatment records: as long as the clinic keeps them for your care, and as long as the law requires clinics to keep medical records. A clinic that leaves trisha.app can ask us for a copy before we delete them.
- Payments and invoices, with each payment's reference number: as long as tax and accounting laws require.
- Server logs: a short time, unless needed to look into a security problem.
When we no longer need information, we delete it or make it anonymous.
9. How we protect it
- Every page and file is sent over encrypted connections (HTTPS).
- Each clinic sees only its own information, and each person sees only what their role allows.
- Uploaded files are kept in private storage, never at public addresses.
- Sign-in is through Google, so we keep no passwords.
- Access by our own staff is limited to what their job needs, and their impersonations are logged.
No system is perfectly secure. If a breach puts your information at real risk, we will tell you and the National Privacy Commission within 72 hours of learning of it, as the law requires.
11. Your rights
Under the Data Privacy Act you have the right to:
- Be informed of how your information is collected and used.
- Access your information and get a copy of it.
- Correct information that is wrong or out of date.
- Object to processing, and withdraw consent you have given.
- Erasure or blocking of information that is no longer needed, or was unlawfully obtained.
- Data portability: get your information in a format you can take elsewhere.
- Damages for harm caused by inaccurate, unlawfully obtained or misused information.
- File a complaint with the National Privacy Commission (privacy.gov.ph).
Signed in, you can download a copy of your data or delete your account yourself, from My account in the account menu. For your appointments and records with a clinic, ask the clinic: it can give you a copy, correct them or remove your details. For anything else, or if a clinic doesn't answer, write to [email protected]. We may ask you to confirm who you are, and we answer within 30 days. Withdrawing consent doesn't undo what was done before, and the clinic may still need to keep treatment records the law requires.
12. Children
You must be at least 18 to create an account. A parent or guardian books for a child under 18 and gives consent for the child's information, including their intake answers.
13. Changes to this policy
We will update this policy when what we do changes, and change the date at the top. If a change is significant, we will tell signed-in users before it takes effect.
14. Contact us
Our Data Protection Officer answers privacy questions and requests at [email protected]. See also our Terms of Service.