Flexa
Privacy Policy — Flexa
Last updated: 4 October 2026
Applies to: the Flexa app for iOS and Android (beauty.flexa.client / com.flexa.client) and the booking pages at book.flexa.beauty.
If you are a clinic owner or a member of clinic staff, the policy that applies to you is the one for Flexa Business.
1. Who we are
Flexa operates the Flexa and Flexa Business apps and the booking pages at book.flexa.beauty, from Lebanon. In this policy "we", "us" and "Flexa" mean the operator of that service.
For anything about this policy or your data — including any request under §11 — write to flexabeautylb@gmail.com. It reaches the people responsible for it, and it is the address to use for every right this policy gives you.
2. The short version
- We ask for your phone number and name so you can have an account and a clinic knows who is coming. Everything else you tell us is optional.
- We do not sell your data, we do not share it for advertising, and there is no advertising SDK, no analytics SDK and no tracking code in the app.
- We do not know where you are. The app does not read your device's location.
- We never see or hold your card details. Flexa takes no payment. A clinic charges you in person and records what it took.
- The clinic you book with sees the bookings you made with it. It never sees your bookings anywhere else.
- You can delete your account in the app. §9 explains exactly what that erases and what stays.
3. Who controls what — us, or the clinic
This split matters, because different data has a different owner.
- Your Flexa account — your name, phone number, language, and the bookings you make across clinics — is controlled by us.
- Your records at a clinic — treatment notes, physiotherapy intake, body charts, rehab programmes, documents the clinic uploads, and the clinic's own notes and tags about you — are controlled by that clinic. We store and secure them on the clinic's behalf and under contract with it. The clinic decides what to record, who on its team may see it, and how long to keep it.
To have a clinical record corrected or erased, ask the clinic. To delete your Flexa account, see §9 — you can do it yourself in the app.
4. What we collect
4.1 What you give us
| Data | When | Required? |
|---|---|---|
| Phone number | At sign-in. It is your account identifier | Yes |
| Name | At sign-up | Yes |
| Language (English, Arabic, French) | When you choose one | Yes |
| Email address | Only if you ask for receipts by email | No |
| Birthday — day and month only, never the year | Only if you give it | No |
| Marketing consent, and whether you want appointment reminders | When you answer, or decline to | No |
| Family members you book for — their name and their relationship to you | Only if you add them | No |
4.2 What using the service creates
- Bookings — the clinic, the services and any variant, the practitioner, the date and time, the status, and any reason recorded for a cancellation.
- Booking requests — where a clinic asks to confirm before holding a slot, the request, its proposed times and whether it expired.
- Payments recorded at the clinic — the amount, any discount, any tip, the method (cash, card or a prepaid pack) and the currency. Flexa processes no payments and never holds card numbers. The clinic takes the money in person and records the result.
- Prepaid packs you buy from a clinic — how many sessions are left, when they expire, and when each one was used.
- Products a clinic sells you over the counter, and any item it holds aside for you.
- Rehabilitation programmes prescribed to you — the exercises, sets, repetitions and your progress through them. This is health information; see §5.
- Which gallery posts get opened and which "Book this look" buttons get tapped. These are counted as totals per post for the clinic — how many people opened it, how many started a booking. They are not linked to your account and the clinic cannot tell that it was you.
4.3 What the app collects on its own
- A push notification token, if you allow notifications. We store the token, whether it came from the Flexa app or Flexa Business, the platform (iOS or Android), your app language, and when the app last checked in. It is how a reminder reaches your device and nothing else. Turn notifications off and it stops being used; the token is removed when it goes stale or when the messaging service tells us the app is gone.
- Sign-in codes. When you sign in we generate a one-time code and store only a cryptographic hash of it, deleted once it is used or expires.
- Session tokens. Held on your device in the operating system's secure storage, and kept on our servers only as a hash, so a stolen session can be revoked.
- Ordinary server logs — the request, the time, the IP address — kept for troubleshooting and security.
4.4 What we do not collect
- Your location. The Flexa app does not read your device's position. Distances and "near you" ordering shown in the app today come from information the clinic itself provides, not from where you are.
- Your contacts. Only Flexa Business can read a contact, and only one that a clinic's staff member picks. The Flexa app never asks.
- Advertising identifiers, analytics, or any third-party tracking. There is no such code in the app.
5. Health information
Flexa covers physiotherapy and rehabilitation as well as beauty and wellness, so some of what a clinic records about you is health information. Under the GDPR this is special category data and we treat it as such.
In the Flexa app you can see your own rehabilitation programme — the exercises a clinic prescribed and how far through them you are.
Everything else clinical — treatment notes, physiotherapy intake including injury history and medications, pain scores, range-of-motion measurements, marked points on a body chart, documents a clinic uploads about you, and the answers on a clinic's own client form (which can include health questions such as pregnancy, allergies or medications) — is held by the clinic, visible only to that clinic, and never to any other clinic. We do not use it for anything except operating and securing the service on that clinic's behalf.
Inside a clinic, access follows role: treating practitioners see clinical records; front-desk staff see the calendar and contact details, not the clinical notes. A clinic's own client form is the exception: everyone working at that clinic can see it.
6. Why we use your data, and our legal basis
| What for | Legal basis |
|---|---|
| Creating your account and signing you in | Performance of a contract with you |
| Taking, changing and cancelling bookings; showing a clinic its schedule | Performance of a contract |
| Sending you a sign-in code | Performance of a contract |
| Sending appointment confirmations and reminders | Performance of a contract; you can turn reminders off |
| Letting a clinic keep the clinical records its practice requires | Ours: processing on the clinic's behalf. The clinic's: Article 9(2)(h) — healthcare provided by professionals under an obligation of secrecy |
| Keeping the service secure — rate-limiting sign-ins, detecting reused sessions | Legitimate interests: preventing abuse of accounts |
| Counting how often a clinic's gallery posts are opened | Legitimate interests: giving a clinic aggregate figures about its own posts, not linked to you |
| Meeting legal and accounting obligations | Legal obligation |
| Sending you marketing | Consent, given separately, withdrawable at any time in the app, and never a condition of booking |
We do not sell personal data and we do not share it for advertising.
7. Who else sees it
The clinic you book with. That is the point of the service. It sees the bookings you made with it and the details attached to them. It does not see your bookings at other clinics.
Service providers, under contract, only to run Flexa:
| Provider | What it handles | Where |
|---|---|---|
| Amazon Web Services | Our servers and database — accounts, bookings, and the clinical records we hold for clinics | Ireland (eu-west-1) |
| Cloudflare (R2) | Every uploaded photo, video and document — clinic galleries, logos, and clinical documents | Cloudflare's global network |
| Google (Firebase Cloud Messaging) | Delivers push notifications. Receives your device's push token and the notification content | Google's global infrastructure |
| WhatsApp / Meta | Delivers your sign-in code to your phone number on WhatsApp. Receives your phone number and the message | Meta's global infrastructure |
| Resend | Delivers a sign-in code by email if WhatsApp delivery is unavailable | United States / EU |
We may disclose data where the law requires it, or to protect the rights and safety of people using Flexa.
8. Where your data is stored, and transfers
Flexa serves Lebanon, and our infrastructure is not in Lebanon: the database and application run on Amazon Web Services in Ireland, uploaded media is stored with Cloudflare, and push notifications and sign-in messages pass through Google and Meta respectively. Using Flexa therefore means your data is transferred outside Lebanon and processed abroad.
Where personal data is transferred out of the European Economic Area, we rely on the European Commission's Standard Contractual Clauses with each provider, together with the additional safeguards those clauses require.
9. How long we keep it
| Data | Kept |
|---|---|
| Your account | Until you delete it (§10) |
| Bookings, payments and pack balances | Retained by the clinic after you leave, without your name on them — see §10 |
| Clinical records | Set by the clinic, subject to the record-keeping rules its profession imposes |
| Sign-in codes | Minutes — deleted once used or expired |
| Session tokens | Until they expire or you sign out |
| Push notification tokens | Until the token goes stale, the messaging service reports the app removed, or you delete your account |
| Server logs | A short operational period, then discarded |
10. Deleting your account — and what survives
You can delete your Flexa account from the app at any time. Please read what it does, because it is not a complete erasure.
When you delete your account:
- Your identity is erased. Your name, email address and birthday are removed, your phone number is replaced with a placeholder, and your marketing and reminder preferences are reset.
- Your phone number is released. You can sign up again later with the same number, and you will get a new, empty account — not this one back.
- Family members you added are deleted outright.
- Future confirmed bookings are cancelled, so no clinic is left holding an appointment for someone who has gone.
- Anything a clinic is holding aside for you is released.
- Your past visits stay with the clinic, without your name on them. Completed bookings, payments, pack balances and the clinic's clinical records remain, attached to the anonymised record. Clinics need this: their accounts have to balance, and their clinical records are subject to retention rules they cannot set aside because a client has left.
- You cannot sign in to that account again, and any active session stops working.
To have a clinic erase the clinical records it holds about you, contact the clinic — those are the clinic's to erase, within the limits its profession sets.
11. Your rights
You can ask us to:
- give you a copy of the personal data we hold about you, in a portable form;
- correct anything wrong;
- delete your account and your data (§10 explains the limits);
- restrict or object to processing we base on legitimate interests;
- withdraw consent to marketing at any time, without affecting anything you booked.
Write to flexabeautylb@gmail.com. We answer within one month.
You also have the right to complain to a data protection supervisory authority in the country where you live or work.
12. Children
A Flexa account is for adults. You must be 18 or over to create one.
Children can still be treated. A parent or guardian can add a child as a family member and book appointments for them — physiotherapy, a manicure, anything a clinic offers. When you do that:
- you confirm you are that child's parent or guardian and that you consent on their behalf;
- we store the child's name and their relationship to you, and the bookings made for them;
- the clinic treating them keeps its own records, including clinical notes where the treatment is clinical. Those belong to the clinic (§3);
- you can remove a family member at any time in the app. Removing them stops future bookings; the clinic's record of past treatment stays, for the reasons in §10.
If you believe a child's data is in Flexa without a parent's or guardian's agreement, write to flexabeautylb@gmail.com and we will remove it.
13. Security
Data is encrypted in transit. Sign-in codes are stored only as salted hashes and session tokens only as hashes. Uploaded files sit in private storage reachable only through our authenticated API — never on a public URL. Access inside a clinic is limited by role.
If a breach occurs that is likely to put your rights at risk, we will notify the relevant supervisory authority within 72 hours and tell you where the law requires it.
14. Changes
We post changes here and update the date at the top. If a change is significant we will tell you in the app.
15. Contact
flexabeautylb@gmail.com — for any question about this policy, and for every request under §11. Flexa operates from Lebanon.