1. Data we collect. To book and provide services, Devota collects contact information (name, phone number, email), booking information, and, when applicable, health information relevant to the safety of the service (allergies, sensitivities).

2. Health Data. Health information shared by the client is treated as sensitive information and is used solely to provide services safely. Devota is not a healthcare provider, and this data is not subject to HIPAA, but it is handled confidentially.

3. Use of information. Data is used to manage bookings, provide services, communicate with the client, and—only with their consent—send promotions. The client can withdraw marketing consent at any time.

4. Third parties. The site and bookings operate on third-party platforms (e.g., Shopify and the booking app), which process certain data according to their own policies. Payments are processed through payment providers; Devota does not store full credit card details.

5. Cookies. The website may use cookies and similar technologies for its operation and analysis. The client can manage cookies from their browser settings.

6. Client rights. The client can request access, correction, or deletion of their data by writing to hello@devotabeauty.com.

7. Minors. Devota does not knowingly collect data from children under 13. Data from a minor client is managed with the authorization of their legal representative.

8. Retention and security. Devota retains data for as long as necessary to provide services and fulfill its obligations, and applies reasonable measures to protect it. Consents and appointment records may be retained as operational backup.