Privacy Policy

The data controller is Advance Cosmo & Plastic Surgical Art, the clinic of Dr. Mirza Arif Baig, Alam Sher Centre, Nishtar Road, Multan, Pakistan.

• Email: info@advancecosmo.com
• WhatsApp: +92 303 0671116
• Phone: +92 303 0671116

Contact us at any of these for any privacy question or request.

• Booking form: your name, phone number, the treatment you are interested in, your preferred day and time, any message you write, the page language, and the date and time you agreed to this policy.
• How you found us: if you arrived from an ad, search engine or social network, the campaign tags (UTM source, medium and campaign) and ad click IDs (Google gclid, Meta fbclid) from the link, sent with your booking. They are only kept in your browser between pages if you choose "Accept all".
• WhatsApp messages: messages you send to our WhatsApp Business number and our replies, including automatic replies from our assistant, linked to your booking by its reference (for example AC-7H2XJ) or your phone number.
• Patient records: if you contact us or become our patient, we may keep a private record in our practice-management system: your name, the condition or treatment you are interested in, appointment and follow-up dates, and clinical notes the doctor adds. Only the doctor and clinic staff can see it.
• Contact matching on the doctor's phone: to recognise existing patients, the doctor's admin app may compare names in the doctor's own phone contacts with patient names in our system. This happens only inside the browser on the doctor's device: the doctor's contacts and their phone numbers are never uploaded or stored by us, and a match shows only your name and condition or treatment interest. Showing anything more requires your consent, which we ask for separately (for example over WhatsApp).
• Appointment calendar: appointment and follow-up times may be synced to the doctor's personal calendar through a private calendar feed that contains only a first name or initials and the booking reference, never a diagnosis.
• Technical data: your IP address is used briefly to limit repeated requests and to check for abuse (including by Cloudflare Turnstile, our bot check). We do not store it with your booking.
• Cookies and similar storage: see Cookies.

We only ask for what we need to arrange your care. Please don't send more medical detail through the form than you're comfortable with; you can always tell the doctor in person.

The treatment you are interested in, what you write to us and the doctor's notes are health information, a special category of data. We process it only with your explicit consent, which you give by ticking the box on the booking form or by messaging us, and, once you are our patient, to provide medical care under the doctor's professional duty of confidentiality.

You can withdraw your consent at any time (see Your rights). That doesn't affect anything we did before, and we may still need to keep records of patients we treated where the law requires it.

• To arrange and confirm your appointment and reply on WhatsApp or by phone: your consent, and steps you ask us to take before treatment.
• To provide care, schedule follow-ups and keep continuity (patient records, appointment calendar, recognising existing patients when they call): your explicit consent and the provision of health care.
• To keep the website and our systems secure (rate limiting, bot checks, abuse prevention): our legitimate interest in protecting patients and the clinic.
• To understand which ads and channels bring patients (campaign tags, Meta Pixel and Conversions API, Google Analytics and Ads): only if you choose "Accept all" in the cookie banner, i.e. your consent.
• To meet legal obligations, such as keeping medical records where the law requires it.

We never sell your data and never use your health information for advertising.

If you tick the consent box on the booking form, reply YES when we ask in a WhatsApp chat, or choose to get updates on Messenger or Instagram, we may send you occasional follow-up messages about your request: a check-in, what to expect at a consultation, or a reminder that the doctor is available. Our AI assistant may write them from your request and recent messages; they never contain a diagnosis or prices.

• How often: at most one automated message a day, only between 9am and 9pm Pakistan time. They stop once you book or your request is closed.
• How to stop: reply STOP or بند (or "band karo") at any time. We confirm once and send no more automated messages. Reply START (شروع) to get them again; booking again with the consent box ticked also turns them back on.
• What we keep: your WhatsApp number or Messenger / Instagram ID, your name, the ad or link that started the chat, the messages sent, and when you agreed or stopped. We keep this for as long as booking requests (see How long we keep it), including your STOP, so we don't message you again.

Only the doctor and clinic staff can see your information. We use these service providers (processors), who act on our instructions:

• Cloudflare, Inc.: hosts the website and admin panel, stores bookings, messages and patient records in its D1 database and photos in R2 storage, runs Turnstile (bot check) and Web Analytics, and runs the AI models (Workers AI) that write WhatsApp assistant replies, translate our articles and check uploaded images.
• Meta Platforms: delivers WhatsApp messages (WhatsApp Business). Only if you accept marketing cookies, the Meta Pixel and the Conversions API tell Meta that a booking happened, with your phone number in hashed (scrambled) form, your IP address and browser type, so we can measure our ads.
• Google: Google Analytics and Google Ads measurement, only if you accept marketing cookies. Videos are played from YouTube (youtube-nocookie.com) only when you press play. The clinic map comes from Google Maps only when you tap “Show map” (or automatically if you accepted marketing cookies).
• Calendar apps: the doctor's personal calendar app only receives the minimal appointment feed described above (first name or initials, reference and time).

The patient records, contact matching and calendar features don't add any other third party. We may disclose information if the law requires it, or to protect someone's vital interests in an emergency.

Cloudflare, Meta and Google process data on servers around the world, including the United States and the European Union. Where data leaves your country, we rely on these providers' contractual safeguards, such as the EU Standard Contractual Clauses and their data processing terms.

• Booking requests and WhatsApp messages: deleted automatically 24 months after they were created. A daily job removes them.
• Patient records: kept as long as booking requests, unless an ongoing treatment relationship requires longer. Records of patients we actually treated may be kept for as long as applicable medical-records law requires.
• Your browser: what's stored on your device stays until you clear it (see Cookies).

If you ask us to delete your data, we do it sooner (see below).

We publish before-and-after photos or videos only with the patient's written consent. We avoid showing faces unless the patient agreed to it, blur or crop identifying features, and mark graphic medical images so they stay hidden until you choose to view them. If you appear in something we published and want it removed, contact us and we'll take it down.

You can ask us to:

• access your data and get a copy, including your booking, messages and patient record;
• correct anything that is wrong or incomplete;
• delete your data (we remove your booking and WhatsApp messages; treatment records the law requires us to keep are the exception);
• restrict how we use it, or object to use based on our legitimate interests;
• receive your data in a portable format (we export it as a JSON file);
• withdraw consent at any time: for contact and storage by messaging us, and for marketing cookies with "Cookie settings" at the bottom of every page;
• stop showing your details to the doctor through contact matching beyond your name and treatment interest, or refuse the separate request to show more;
• not appear in the doctor's calendar under your first name or initials.

Email info@advancecosmo.com or message us on WhatsApp at +92 303 0671116. We may ask you to confirm your identity (for example, by writing from the phone number you booked with). We reply within 30 days and there is no charge.

You also have the right to complain to a data protection supervisory authority, for example the one where you live or work. We'd appreciate the chance to resolve your concern first.

This website is meant for adults. If you are under 18, please ask a parent or guardian to book for you. If we learn that a child has sent us information without a guardian, we will delete it unless it is needed for their care.

• All traffic is encrypted (HTTPS with HSTS), and the site uses a strict content security policy.
• The admin panel requires a password and an authenticator app (two-factor sign-in); only the doctor and authorised staff have accounts.
• We keep a security log of administrative actions (who changed what and when, without medical details) for 3 years.
• Data is stored with Cloudflare, encrypted at rest; your phone number is hashed before anything is sent to Meta.
• The booking form is protected by a bot check and rate limits, and we collect as little as possible.

No system is perfectly secure. If a breach affects you, we will tell you and the relevant authority as the law requires.

Here is everything this website stores on your device:

• Your cookie choice (ac_consent, browser local storage): remembers whether you chose "Accept all" or "Only necessary", and when. Necessary.
• How you found us (ac_attr, browser local storage): the campaign tags and ad click IDs from the link you arrived with (or, if none, the search engine or website), sent with your booking. Stored only after you choose "Accept all" and deleted if you later choose "Only necessary". Without it, we only read these tags from the page you book on; nothing is stored.
• Language (lang cookie, 1 year): set only if you switch between English and Urdu, so the home page opens in your language. Necessary.
• Cloudflare security cookies (such as __cf_bm or those set by Turnstile): help tell people from bots. Necessary.
• Meta Pixel (_fbp, _fbc) and Google Analytics / Ads (_ga, _ga_*, _gcl_*): only after you choose "Accept all". Before that, these scripts are not even loaded. Choosing "Only necessary" later switches them off and removes their cookies.

We also use Cloudflare Web Analytics, which counts visits without cookies and without building a profile of you. Videos come from youtube-nocookie.com and load only when you press play; YouTube may then store its own data. The same applies to the Google Maps map on the contact page.

You can change your choice at any time with "Cookie settings" at the bottom of every page.

If we change how we use your information, we'll update this page and the date below the title. If the cookie section changes, we'll ask for your choice again.