Privacy Policy

1Scope

This policy applies to the website holissuite.com, the HolisSuite management application (served on each business's own domain) and the connections to third-party platforms that a business chooses to enable.

In this policy, a “business” is a company or household business that uses HolisSuite to run its operations; “users” are the owners and staff of a business; and “customers of a business” are people who book appointments with, buy services from, or send messages to that business.

↑ Back to contents

2Who we are and our role

HolisSuite is operated by HolisSuite (legal entity name being updated). Contact for data matters: support@holissuite.com.

• We decide how data is processed (controller) for: information you send through the Contact form on our website, and user account information.
• We process data on behalf of the business (processor) for: customer records, appointments, orders, treatment packages, staff records and messages that a business enters into or connects to the software. That data belongs to the business; we only store and process it on the business's instructions.

If you are a customer of a business and have a question about your data, please contact that business first — it is the party that decides. We will help the business fulfil your request.

↑ Back to contents

3Information we collect

Information you provide

• Website Contact form: your name and phone number; your email, business name and enquiry if you fill them in; and the time you ticked the consent box.
• User accounts: name, email, phone number, job title, branch. For staff, the business may also enter date of birth, gender, address and bank account number for payroll.
• Business data entered by a business: customer information (name, phone number, gender, date of birth, province/city, notes), appointments, orders, treatment packages, debts, inventory, attendance, payroll, and photos taken during customer care. Some of this may relate to a customer's health; the business is responsible for obtaining the customer's consent before entering it.
• Online bookings through a business's booking page: name, phone number, branch, service, time slot and any note the customer types.

Information recorded automatically

• Server access logs: IP address, browser type, time and requested path — to operate the service, prevent attacks and fix errors.
• Attendance check-in: when staff check in, the system records location (GPS coordinates and accuracy) and IP address to match against the branch. The browser asks for location permission first.
• Security logs: platform administrator sign-ins, administrative actions, and each time an AI application that has been granted access reads data (time, data type, IP address).

The website does not use Google Analytics, Meta Pixel, TikTok Pixel or any advertising tracking tool, and does not send conversion events to advertising platforms.

Information from platforms a business chooses to connect

When a business connects Facebook, Instagram, Zalo OA, TikTok, WhatsApp or Telegram, we receive the messages customers send to that Page or account, the sender's name and profile picture (phone number for WhatsApp), and comments on the business's Facebook Page posts. Details are in section 7.

What we do not collect

We do not collect biometric data, do not ask for photos of identity documents, and do not store payment card numbers — top-ups are handled by the PayOS payment gateway.

↑ Back to contents

4How we use information

• To contact you for a consultation when you submit the Contact form.
• To provide the software's features: appointments, sales, treatment packages, inventory, attendance, payroll, reports and the inbox.
• To display messages from connected channels and send staff replies back through the same channel.
• When a business turns on AI for the inbox: to send the conversation content and documents the business uploads to the AI provider the business has chosen, to draft replies.
• When a business uses our advertising service: to use the campaign information the business provides (objective, offer, images) and — only when the business chooses to target a customer group in the software — that group's phone numbers to create an audience on the advertising platform.
• For sign-in, permissions, preventing unauthorised access, backup and recovery.
• To provide technical support when a business asks for it.
• To comply with valid requests from competent state authorities.

↑ Back to contents

5Legal basis and governing law

We process personal data under Vietnamese law on personal data protection, on one of the following bases:

• Your consent — for the Contact form (consent box ticked before sending).
• Performance of a contract — for accounts and the data needed to provide the service to a business.
• The business's instructions — for data we process on behalf of a business.
• Legal obligation — for example, keeping accounting records for the statutory period.

↑ Back to contents

6Who we share it with

We do not sell personal data and do not use a business's data for advertising. Data only goes to the parties below, and only the part needed for each task:

The AI provider for the inbox is chosen by the business, which enters its own key: Google Gemini, Anthropic Claude, DeepSeek, Alibaba Qwen, Zhipu GLM, Moonshot Kimi, or another compatible service whose address the business provides. Apart from the parties above, we only disclose data upon a valid written request from a competent state authority.

↑ Back to contents

7Data from Meta platforms (Facebook, Instagram, WhatsApp)

We only access Meta data after a business clicks Connect and grants permissions on Facebook's official authorization screen. We only receive data for the Pages the business selects. The permissions the app requests are:

• Data received: messages customers send to the Page or Instagram account, the sender's name and profile picture, and comments on the Page's posts; for WhatsApp, the sender's phone number.
• Used for: displaying them so the business's staff can reply directly in HolisSuite. If the business turns on AI for the inbox, conversation content is sent to the AI provider the business chose (section 6).
• Not used for: advertising, user profiling, or selling or sharing with third parties other than those in section 6. Messages and sender information received through the permissions above are not used to run ads. The app does not read advertising metrics through Meta's APIs.
• Page access tokens issued by Meta are stored securely on our servers and used only for the purposes above.
• Meta data is processed in accordance with Meta Platform Terms. How to disconnect and request deletion: see Data Deletion Instructions.

↑ Back to contents

8Transfers outside Vietnam

Some providers in section 6 host servers outside Vietnam (for example Cloudflare, Cloudinary, Google, Meta, TikTok, Telegram and Anthropic in the United States or multiple countries; some AI providers such as DeepSeek, Qwen, GLM and Kimi in China). Data only goes to AI providers and messaging platforms when the business turns on the corresponding feature. Businesses should choose an AI provider that fits their own and their customers' requirements.

↑ Back to contents

9How long we keep data

• Contact form: up to 24 months from submission, after which the system deletes it automatically. You can ask us to delete it sooner.
• Business accounts and data: for as long as the business uses the service. When a business account is suspended, its data is kept for 30 days so the business can return; after 30 days, all of the business's data is permanently deleted.
• Backups: automatic daily backups, with older copies replaced on rotation. Deleted data may remain in a backup until that backup is replaced.
• Sign-in sessions: expire after at most 30 days of inactivity.
• Data that the law requires us to keep (for example accounting records) is kept for the statutory period.

↑ Back to contents

10Security

We apply appropriate technical and organisational measures to protect data, including:

• Encrypted connections to the website and application.
• Each business's data is kept separate; one business cannot see another's data.
• Passwords and access credentials for connected platforms are stored securely.
• Role-based and per-user permissions.
• Logging of important administrative actions.

No system is completely secure. If an incident affects personal data, we will notify the affected businesses and the competent authorities as required by law.

↑ Back to contents

11Your rights

Under Vietnamese law, you have the right to:

• Know how your data is being processed, access it and request a copy.
• Ask us to correct inaccurate data.
• Withdraw consent and request deletion of your data.
• Request restriction of, or object to, processing.
• Lodge a complaint with the competent state authority for personal data protection.

Users can view, edit and export data (customers, orders, reports) directly in the software according to their permissions. Send other requests to support@holissuite.com; how to request deletion is explained on the Data Deletion Instructions page. We may ask for additional information to verify that you are the data subject before acting on a request.

↑ Back to contents

12Children

HolisSuite is a business tool, not intended for anyone under 16, and the website does not knowingly collect children's data. If we find that a child's data was submitted through the Contact form, we will delete it. For customers who are children and whose data a business enters, the business is responsible for obtaining consent from a parent or guardian.

↑ Back to contents

13Marketing messages

We do not currently send automated marketing emails or messages. Contact form information is only used to call you back as you requested. If we introduce a newsletter in the future, we will only send it with your separate consent and always include a way to opt out.

↑ Back to contents

14Cookies

The public website does not set cookies. The management application uses strictly necessary cookies to keep you signed in and to remember some interface choices on your device. Full list: Cookie Policy (in Vietnamese).

↑ Back to contents

15Changes to this policy

When this policy changes materially, we will notify users in the application at least 30 days before the new version takes effect. The effective date, version number and last update date are always shown at the top of this page. This English version is a translation of the Vietnamese Chính sách bảo mật; if the two differ, the Vietnamese version prevails.

↑ Back to contents

16Contact

• Operator: HolisSuite (legal entity name being updated)
• Email: support@holissuite.com
• Website: holissuite.com

↑ Back to contents