AVIRA

    PRIVACY POLICY

    Last updated April 20, 2026

    This Privacy Policy explains how Avira collects, uses, shares, stores, and deletes personal data when you use the Avira website, upload photos, request an AI preview, ask for clinic introductions, or communicate with us about concierge support.

    This policy does not replace the privacy terms of any clinic, hotel, airline, payment provider, or other third party. Those parties are responsible for their own processing once you deal with them directly.

    1. Controller and Contact

    For the processing described in this policy, the controller is Avira Aesthetics ("Avira", "we", "us", or "our"), an online introduction and concierge service based in Valencia, Spain.

    You can contact us at privacy@avira-aesthetics.com for privacy requests, legal@avira-aesthetics.com for legal questions, or info@avira-aesthetics.com for general support.

    2. Personal Data We Collect

    Depending on how you use Avira, we may collect:

    • Identity and contact data: such as your name, email address, phone number, country, and preferred language.
    • Submission data: such as photos, aesthetic goals, treatment interests, extra notes, time of submission, and case records.
    • Communications data: such as emails, messages, support requests, and records of conversations with you or with clinics about your request.
    • Technical and usage data: such as IP address, browser type, device information, approximate geolocation, referrer, pages viewed, timestamps, security logs, and diagnostics.
    • Browser-side preference data: such as your language choice and the last preview link stored in your browser on the same device.

    3. Sensitive Data and Photos

    Photos and treatment requests submitted in the context of aesthetic or medical-aesthetic services may reveal or relate to sensitive information, including health-related information, depending on the content and context. Where required by law, Avira treats this as special-category data and relies on your explicit consent.

    Please do not upload a third party's photo unless you are authorised to do so and have their valid permission. Avira is not responsible for images uploaded without proper authority.

    4. How We Use Your Data

    We may use your data to:

    • operate the website and respond to your enquiry;
    • generate AI-based preview images from the material you submit;
    • identify and contact clinics that may be relevant to your request;
    • share your request details, photos, and goals with clinics so they can assess interest and respond;
    • provide concierge support, including translation and practical travel or accommodation guidance;
    • send you service emails, updates, and follow-up communications;
    • keep internal records, defend legal claims, prevent misuse, and comply with law; and
    • understand site usage through privacy-friendly analytics and improve the Service.

    We rely on one or more of the following legal bases, depending on the processing activity:

    • Contract or pre-contract steps: to handle your request, provide the Avira concierge service, and communicate with you about that service.
    • Explicit consent: for photos and request details that amount to sensitive or health-related data, and for related sharing with clinics or image-processing providers where consent is required.
    • Legitimate interests: for basic service administration, site security, abuse prevention, record keeping, and responding to non-sensitive enquiries.
    • Legal obligations: where we must keep records, respond to lawful requests, or establish, exercise, or defend legal claims.

    You can withdraw consent at any time by contacting us. Withdrawal does not affect processing already carried out lawfully before withdrawal, but it may mean we cannot continue your request.

    6. Who We Share Data With

    We may share personal data with:

    • Clinics and practitioners that you ask us to approach or that we shortlist for your case.
    • Technology and communications providers that help us host, store, process, analyse, or transmit data, including providers used for hosting, storage, analytics, AI image generation, and email delivery.
    • Professional advisers and authorities where necessary for legal compliance, fraud prevention, insurance, or dispute handling.

    At the time of writing, Avira's stack includes providers such as Vercel for hosting and analytics, Supabase for storage and case management, Google/Gemini for AI image processing, and Resend for email delivery. Those providers may change over time.

    We do not sell your personal data. We do not use your uploaded images for marketing, case studies, testimonials, or any other commercial reuse without your prior consent.

    7. International Processing and Transfers

    Avira is offered online and may involve technology providers or clinic contacts outside Spain and outside the European Economic Area or United Kingdom. As a result, your data may be accessed, stored, or processed internationally.

    Where an appropriate lawful transfer mechanism is available, we may rely on it. Where the service you request requires international processing and consent is the relevant basis we rely on, your submission and request for the Service will be treated as your explicit instruction and consent to that processing to the extent permitted by law.

    If you ask us to approach a clinic in another country, or a clinic reviews your case from another country, that sharing may also involve cross-border processing.

    8. Retention

    We keep your data for as long as the Avira relationship continues, which may be indefinitely unless you ask us to delete your records or we decide the case is closed. We may retain limited records for longer if necessary for accounting, legal claims, regulatory compliance, fraud prevention, or security.

    You can request immediate deletion of uploaded photos and previews. Once the deletion request has been completed, Avira will confirm deletion to you.

    9. Security

    We use reasonable technical and organisational measures designed to protect personal data, including access controls, private cloud storage, and restricted or signed access to stored images where relevant. No website, email system, or online storage environment can guarantee absolute security.

    10. Your Rights

    Subject to applicable law, you may have the right to request access, rectification, erasure, restriction, objection, portability, and withdrawal of consent. You may also ask us to stop sharing your data with clinics where that sharing has not yet taken place.

    To exercise your rights, email privacy@avira-aesthetics.com. You may also lodge a complaint with the Spanish data protection authority, the AEPD, if you believe your data has been handled unlawfully.

    11. AI and Automated Processing

    Avira uses AI tools to generate illustrative preview images from the photos and descriptions you submit. Those previews are not medical advice and do not replace professional clinical assessment.

    Avira does not use solely automated decision-making that produces legal effects or similarly significant effects about you. Decisions about whether to proceed with a clinic remain for you and the clinic.

    12. Children

    The Service is not intended for children or persons under 18 using the Service on their own behalf. If Avira becomes aware that a child has submitted personal data without proper authority, Avira will delete that data as soon as reasonably practicable.

    13. Updates to This Policy

    We may update this Privacy Policy from time to time. The version published on the Site is the current version. Material changes take effect when posted unless a later date is stated.