Privacy Policy

The data controller for personal information collected via this website, our portal and our field team is OXY AESTHETIK LLC, operating under the brand OXY Aesthetics, registered at Shams Free Zone Business Center, Al Messaned, Sharjah Media City, Sharjah 515000, United Arab Emirates. Licence and tax details are in our Legal Notice.

You can reach us at info@oxy-aesthetik.com or +971 50 856 0590.

We process the following categories of personal data:

• Identity & contact: name, email, phone, country, medical licence number (where relevant for course eligibility).
• Professional profile: specialty, years of practice, clinic name, information you provide in enrolment forms.
• Transaction data: course registrations, invoices, payment references (we never store full card numbers — payment is handled by our PSP).
• Communication data: emails, WhatsApp messages, support requests.
• Technical data: IP address, browser, device type, pages visited, approximate location, consented cookie identifiers.

• Process course registrations and deliver training services.
• Verify professional eligibility (medical license).
• Issue certificates and handle verification requests.
• Communicate about cohort schedules, changes, and aftercare.
• Improve the website, our content, and course quality.
• Send marketing updates — only where you have opted in.
• Comply with tax, accounting, and other legal obligations.

Depending on your location, we rely on one or more of the following bases:

• Contract: registering you for a Masterclass and delivering it.
• Legitimate interest: running a safe, high-quality training academy and protecting it from fraud.
• Consent: marketing communications and non-essential cookies — you can withdraw consent at any time.
• Legal obligation: tax records, AML, record-keeping duties.

We do not sell personal data. Apart from the calendar entries and the Telegram chats described in section 11, we share it only with trusted processors who help us operate the business, under written agreements, including:

• Hosting and infrastructure providers.
• Payment service providers (for registration and refunds).
• Email and WhatsApp Business communication platforms.
• Analytics and cookie partners (only with consent).
• Professional advisors (legal, accounting, auditors).

We may disclose information when required by UAE law, court order, or to protect our legal rights.

We keep personal data only as long as necessary for the purposes listed above:

• Registration & certificate records: up to 10 years (supports verification).
• Financial records: as required by UAE tax law (currently 7 years).
• Marketing lists: until you unsubscribe or go inactive for 24 months.
• Website analytics: up to 14 months.
• Portal security records (sign-ins and account actions): IP address and browser details are deleted after 12 months.
• Records about doctors our field team visits or plans to visit: 24 months after our last contact, or after the record was created if there was no contact (section 11).
• Portal backups: up to 90 days (section 11).

Under UAE PDPL — and GDPR where it applies to you — you have the right to access, correct, delete, restrict, or object to our processing, and to data portability. You can also withdraw consent and lodge a complaint with the competent authority.

To exercise any right, email info@oxy-aesthetik.com. We respond within 30 days.

We use strictly necessary cookies to operate the website. Analytics and marketing cookies only load after you opt in via the consent banner. You can update your choice at any time via the cookie settings link in the footer.

We apply organisational and technical safeguards — encryption in transit (HTTPS), access controls, secrets management, least privilege for staff, regular reviews — to protect personal data. No system is absolutely secure; if a breach affects you, we notify you and the competent authority as required.

Some processors operate outside the UAE. Apart from the calendar entries and the Telegram chats described in section 11, we transfer personal data only to jurisdictions with an adequate level of protection, or under standard contractual clauses and equivalent safeguards.

Our portal

This Policy also covers our portal at portal.oxy-aesthetik.com, where doctors, trainers and our team sign in. For your account we process the data listed in section 2. If you upload a copy of your medical licence, we keep the document and store the licence number encrypted. If you buy products through the portal, we also keep your billing details, orders, invoices, payments and reward credit. Anyone who has the code on your certificate can see your name, the course, its place and date and the certificate number on our verification page.

To keep accounts safe, the portal records sign-ins and important account actions, such as password changes, bookings, orders and downloads, with the time, IP address and browser. You can see your recent sign-ins on your security page. After 12 months we delete the IP address and browser details from these records and keep the rest, such as which action took place and when. The registration form uses Cloudflare Turnstile to keep automated sign-ups out; for this check Cloudflare receives your IP address and technical details of your browser.

The portal, including the field records described below, runs on Hetzner servers in Germany, where our encrypted backups are also kept. Data we delete from the portal can stay in our backups for up to 90 days: copies of the database taken on the server before an update are deleted after 90 days, and our encrypted nightly backups are replaced on a rolling basis within about six weeks. Emails from the portal go out through Resend, an email service based in the USA.

Field visits

If you are a doctor our field team visits or plans to visit, we keep a record about you in our portal: your name and specialty, your practice and its address, your professional contact details, our appointments and visits, the product samples we leave with you, notes from our conversations, and your interest in our products, including any order you mention. We collect this information ourselves, in our appointments and conversations with you, and from publicly accessible sources such as your practice website, Google Maps and your professional Instagram profile. We use it to plan and follow up our visits and to offer you our courses and products, in person or when we get back to you after a visit. Newsletters and other marketing mailings go out only with your consent (section 3). The legal basis is our legitimate interest in maintaining business contacts (Art. 6(1)(f) GDPR).

Only the field representative responsible for you and our management can see this record. If you have an account on our portal, we may link the record to it; the representative then also sees your course bookings, your orders with any amount still open, and your reward credit.

If the representative subscribes to their field calendar, it shows appointments with your name, your practice and its address, and follow-up reminders with your name. These entries may be stored by Apple (iCloud), including on servers outside the UAE. Apple keeps them under its own terms; we have no data processing agreement with Apple.

Our representatives can also record a visit in a chat with our Telegram bot. When a representative checks in near your practice, the chat can show your name and the name of your practice, if needed its emirate, and at the end the interest in our products that the representative noted at the visit. Your phone number, email address, address, notes and orders never go into the chat. Telegram Messenger Inc., a company in the British Virgin Islands, stores these chats on its servers, which may be outside the UAE and the EU, until the representative deletes them. Telegram handles them under its own terms; we have no data processing agreement with Telegram. While a check-in is under way, the portal keeps the names typed into the chat for the next step. They can no longer be used after 15 minutes, and we delete them with the next step or in our nightly clean-up.

When a member of our team shares a live location with our Telegram bot and has agreed to it there, we process that location while it is shared, to show the latest position on the portal's field map to OXY's management. We keep only the latest position, with no history. It is no longer shown once the sharing ends, 24 hours after it began at the latest, and it is deleted when the sharing is stopped or the consent is withdrawn in the portal, otherwise in the following night.

We delete the record 24 months after our last contact with you or, if there was none, 24 months after we created it, unless the law requires us to keep it longer. After that, all we keep are anonymous totals, such as the number of visits and samples per day and representative. If you ask us for a copy of the record or to delete it, we keep a log entry of your request for three years, without your name or contact details.

Your right to object. You can object to this processing at any time, without any formality, for example by email to info@oxy-aesthetik.com. We then delete the record about you and keep only a note that our field team must not contact you again. If you have a portal account, marketing emails to it depend on the consent you gave there, which you can withdraw at any time through the link in every such email or by writing to us. If you object to direct marketing altogether, we stop those emails as well.

Our services are aimed at licensed medical professionals. We do not knowingly collect personal data from anyone under 18. If you believe a minor has submitted data, contact us and we will delete it.

We may update this Policy from time to time. Material changes will be highlighted on this page with a revised "Last updated" date.

For any privacy question or to exercise a right, contact us at info@oxy-aesthetik.com, +971 50 856 0590, Shams Free Zone Business Center, Al Messaned, Sharjah Media City, Sharjah 515000, United Arab Emirates.