Privacy Policy
Privacy Policy — Gestalt Wellness Institute Southeast Asia, Inc.
Effective Date: February 25, 2026
Last Updated: October 10, 2026
This Privacy Policy explains how Gestalt Wellness Institute Southeast Asia, Inc. (“GWI,” “we,” “us,” “our”) collects, uses, shares, and protects personal information when you visit or use our website and related online services (collectively, the “Services”).
Because this is a clinic website, information submitted through inquiries, appointment requests, or messages may incidentally reveal sensitive or health-related details. We handle such information with heightened care consistent with clinical confidentiality expectations and applicable privacy laws.
This Policy is designed to align with the Philippines Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules and regulations (IRR). It also includes disclosures commonly required or expected under the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), CalOPPA, and COPPA—where these laws apply to a particular user, location, or interaction.
1) Who We Are (Controller/Business/Operator)
Controller/Business/Operator: Gestalt Wellness Institute Southeast Asia, Inc.
Address: 2928 VH Garces Street, Laray, San Roque, Talisay City, Cebu 6045
Website: gestaltwellness.com
Data Protection Officer (DPO): Kirk Patrick S. Castro
Email: privacy@gestaltwellness.com
Phone: 032 3454610
Send privacy questions and requests to: privacy@gestaltwellness.com
2) Scope
This Policy applies to personal information collected through:
our website pages, forms, and online workflows;
appointment inquiries, confirmations, and operational communications; and
payment link delivery and payment confirmation communications; and
opt-in email communications (surveys, feedback, special offers).
This Policy does not cover third-party websites or services you may access via links on our site. Their privacy practices are governed by their own privacy policies.
3) Important Clinic Notice: Please Avoid Sending Detailed Clinical Information Through the Website
Our website is intended for inquiries, scheduling, and payment coordination. Please avoid submitting highly sensitive details (e.g., full clinical history, diagnoses, detailed trauma narratives, or other extensive health information) through public web forms or unsecured channels. If sensitive clinical details are necessary, we will guide you to appropriate clinical channels.
This Privacy Policy does not replace professional confidentiality obligations or any separate informed consent/clinic forms you may sign with us for clinical services.
4) Information We Collect
A. Information you provide directly
We may collect:
Name
Contact number
Email address
Date of birth (optional at sign-up; used to confirm your identity, to prepare for your visit, and to know whether a parent or guardian needs to be involved)
Address (when needed for billing/receipts or service logistics)
Social media profile/handle (only if you voluntarily provide it)
Messages and communications you submit (inquiries, feedback, survey responses, and other content)
B. Appointment and service coordination information
We may collect:
appointment date/time preferences and confirmation details
service type requested (e.g., consultation category)
coordination and operational notes you voluntarily provide (which may be sensitive by nature)
C. Minor/guardian referral information
If a client is a minor and is referred for consultation/treatment, we may collect:
parent/guardian contact details
information reasonably necessary to coordinate consultation and services
D. Payment and transaction information
If you pay through the Services:
Payments are processed through Hitpay (including Bank Transfer and QR Ph via Hitpay).
We generally receive and retain transaction-related records (e.g., payment status, amount, timestamp, and reference/receipt identifiers).
Payment credentials and sensitive payment processing details are generally handled by the payment provider under their own privacy and security controls.
Your payment records (GWI Books). We keep a record of the services you book and pay for, the amounts, the invoice numbers and any balance, in our accounting system. To send you receipts and statements and to be sure we are dealing with the right person, that record also holds your name and the e-mail address on your booking account, matched to your client code. It never holds anything about what happens in your sessions. Only our front desk and Finance staff can see your name and e-mail; our auditor sees codes and figures only. We keep payment records for the period Philippine tax law requires (ten years) and then dispose of them. You may ask us to correct your details, to remove your e-mail once nothing is owed, or to tell you who your payment records were shared with: write to privacy@gestaltwellness.com.
E. Information collected automatically (cookies, analytics, ads)
When you use the Services, we may automatically collect:
IP address, browser type, device identifiers, operating system
website usage data (pages visited, time spent, navigation patterns)
referrer/exit pages
cookie and similar technology data
Contact form. When you write to us through our contact form, we collect your name, your e-mail address, what you need help with, your message and, if you choose to give them, a phone number, your organization and how you heard about us. Your message goes to our front desk inbox and is used only to answer you. Please do not include clinical details you would not want front desk staff to read.
Website chat (Chatwoot). The chat button on our pages is provided by Chatwoot Inc. To show it, your browser connects to Chatwoot’s servers on every page of this site, which lets Chatwoot receive technical data such as your IP address and browser type, and a cookie named cw_conversation is stored on your device so that a conversation can continue as you move between pages. If you start a chat, we collect the details you enter (such as your e-mail address) and the messages you send. They are stored by Chatwoot on servers in the United States and are read by our front desk team during clinic hours, Monday to Saturday, 9 am to 6 pm. The chat is not a crisis service and is not watched around the clock. Please do not include clinical details you would not want front desk staff to read.
Image delivery (Optimole). The pictures on this site are delivered through Optimole, a service of Vertigo Studio SA, over the Amazon CloudFront network, so that they load quickly and at the right size for your screen. When a page loads, your browser requests the pictures from that service, which receives your IP address, your browser type and the size the picture is needed at. It does not set cookies through our site, and we do not send it any information you give us.
We use Google Analytics to understand, in aggregate, which pages and services visitors look at. It loads only after you choose “Accept” or allow “Statistics” on our consent banner. If you decline or make no choice, it does not load and no analytics cookies are set. Google Analytics never loads on our appointment booking, contact, or payment pages, whatever you chose. You can change your choice at any time through “Manage consent”. We do not use Google Ads or any other advertising tracking. Basic technical data (such as IP address and browser type) may be processed by our hosting and security infrastructure for site operation, security, and abuse prevention.
5) How We Use Information (Purposes)
We use personal information to:
respond to inquiries and provide clinic-related support;
schedule, confirm, and manage appointments;
send operational communications (appointment confirmations/reminders and service messages);
send payment gateway links and confirm payment completion/records;
send opt-in emails (surveys, feedback requests, special offers) to subscribers;
operate, secure, and improve our website and Services;
measure advertising performance and conversions only if such tools are enabled in the future, subject to your consent; and
comply with legal obligations and protect rights, safety, and security.
6) Marketing Emails (Opt-In)
If you opt in to receive emails from us, we may send surveys, feedback requests, and special offers. You may unsubscribe at any time by using the unsubscribe link in the email or by contacting our DPO.
Operational emails related to appointments and payments (e.g., confirmations, reminders, and payment links) are not “marketing” and may be sent as part of service delivery.
7) Legal Bases for Processing (GDPR/UK GDPR — where applicable)
Where GDPR/UK GDPR applies, we process personal data on the following lawful bases (as appropriate to the context):
Contractual necessity (e.g., providing requested services; appointment and payment processing)
Consent (e.g., opt-in marketing emails; non-essential cookies where required)
Legitimate interests (e.g., site security, service improvement, analytics/measurement—balanced against your rights)
Legal obligation (e.g., accounting, recordkeeping, regulatory compliance)
8) Cookies (Clinic Context)
We use cookies and similar technologies for essential functions: basic site operation, such as remembering your session while you browse or complete a booking, and keeping your conversation in our website chat. With your opt-in only, we also use Google Analytics cookies for aggregate statistics. Nothing non-essential loads without your permission first, and analytics is never active on appointment booking, consultation request, or payment pages. We do not use advertising cookies.
For a full, itemised list of the cookies this site uses and their purposes, see our Cookie Policy.
Optional embedded video (YouTube). Our About page includes an optional short film hosted on YouTube (a Google service). To protect your privacy, the video does not load and no YouTube cookies are set unless you both (a) accept marketing cookies through our consent banner and (b) click to play it. If you choose to do so, YouTube may place cookies on your device (for example, VISITOR_INFO1_LIVE and YSC) and your viewing will be governed by Google’s and YouTube’s privacy policy. We use YouTube’s privacy-enhanced player (youtube-nocookie.com), and you may instead watch the film directly on YouTube using the link we provide.
Bot protection (reCAPTCHA). To protect account registration from automated abuse, our account sign-in and sign-up, application and inquiry forms, including the contact form, use Google reCAPTCHA Enterprise, which processes limited technical and interaction data to distinguish humans from bots. It is used only on those forms and is governed by Google’s privacy policy.
Managing cookies
You can manage cookies at any time via your browser settings.
CalOPPA “Do Not Track” disclosure
Some browsers offer a “Do Not Track” (DNT) signal. Because there is no universally adopted standard for how websites must respond to DNT, our Services may not respond uniformly to DNT signals. We will update this Policy if our practices change.
9) Sharing and Disclosure of Information
We may disclose personal information to:
Service providers that help operate the website and communications (e.g., hosting, email delivery, analytics, customer support tools)
Payment processors (Hitpay) to process payments and provide payment services
Advertising partners — not used. We do not share information with advertising partners. Analytics: Google Analytics is used only with your consent, as described in section 4. If this changes, we will update this Policy and obtain any consent required by law.
Professional advisers (lawyers, accountants) as needed
Authorities / regulators when required by law or to protect rights, safety, and security
Business transfers (e.g., merger, acquisition, reorganization), with appropriate safeguards
No sale of personal information
We do not sell or share personal information for money.
CCPA/CPRA note: California law can define “sale” and “sharing” broadly, and “sharing” can include disclosures for cross-context behavioral advertising. If our advertising configuration involves such “sharing” as defined by law and the law applies to you, you may opt out as described in Section 13(C).
10) International Data Transfers
Your information may be processed in countries other than where you reside (for example, where our service providers operate). Where required by applicable law, we use appropriate safeguards for international transfers.
11) Data Retention
We retain personal information only as long as reasonably necessary for the purposes described in this Policy, including:
Inquiries/communications: retained for follow-up, service quality, and record continuity
Appointments and service coordination records: retained as needed for operational continuity and appropriate clinic administration
Payment/transaction records: retained for accounting, audit, and legal compliance
Analytics/advertising data: retained according to our configurations and reasonable operational needs
12) Security
We use reasonable administrative, technical, and organizational safeguards to protect personal information. No method of transmission or storage is 100% secure; however, we work to prevent unauthorized access, disclosure, alteration, or destruction.
13) Your Rights and Choices
A. Philippines (RA 10173)
We process personal information guided by the principles of transparency, legitimate purpose, and proportionality, and we recognize data subject rights under the Data Privacy Act and its IRR.
Subject to applicable requirements and exceptions, you may request:
access to personal information we hold about you
correction of inaccurate information
deletion/blocking or restriction (where appropriate)
withdrawal of consent (where processing is based on consent)
To exercise rights, contact our DPO using the details in Section 1 or email privacy@gestaltwellness.com.
B. GDPR/UK GDPR (EEA/UK users — where applicable)
Subject to conditions and exceptions, you may have the right to:
access, rectify, erase
restrict or object to processing
data portability
withdraw consent (where applicable)
lodge a complaint with a supervisory authority
C. California (CCPA/CPRA — where applicable)
If the CCPA/CPRA applies to us for your interaction, California residents may have rights to:
Know/access categories and specific pieces of personal information collected and disclosed
Delete personal information (subject to legal exceptions)
Correct inaccurate personal information
Opt out of the sale or sharing of personal information (as defined by law)
Non-discrimination for exercising privacy rights
How to submit requests: Email privacy@gestaltwellness.com. We may verify your identity before fulfilling requests.
Authorized agent: Where required, you may use an authorized agent to submit a request on your behalf, subject to verification.
Global Privacy Control (GPC): Where applicable and required for covered businesses, we will treat a valid GPC signal as a request to opt out of sale/sharing.
14) Children and Minors (Clinic Referrals) + COPPA (Where Applicable)
Our clinic may receive inquiries and referrals involving minors. Typically, a parent or legal guardian provides information necessary for scheduling and treatment coordination. We collect only what is reasonably necessary for clinic operations and appropriate care coordination.
COPPA (U.S.) context: Where COPPA applies (e.g., collection of personal information online from children under 13 within COPPA’s scope), we will seek verifiable parental consent before collecting, using, or disclosing personal information from children under 13, and provide parents appropriate rights to review/delete such information. If we learn that we collected such information without required consent, we will take steps to delete it.
15) HIPAA & HITECH (U.S.) — Clinic Context (When Applicable)
HIPAA and HITECH are U.S. health-privacy laws that apply to U.S. Covered Entities and their Business Associates under specific conditions.
GWI is based in the Philippines, and our baseline compliance framework is the Philippines Data Privacy Act (RA 10173). However, if a specific engagement legally places us in the role of a HIPAA Business Associate to a U.S. Covered Entity (for example, where we provide services on behalf of a Covered Entity involving Protected Health Information), we will implement HIPAA/HITECH-aligned controls for that engagement, including appropriate contractual safeguards (e.g., a Business Associate Agreement when required), access controls, and incident response procedures consistent with applicable requirements.
Practical clinic commitment: Even where HIPAA does not apply, we treat client-submitted information with heightened confidentiality controls consistent with clinical ethics and healthcare privacy expectations.
16) Third-Party Links
Our Services may contain links to third-party websites or services. We are not responsible for their privacy practices. Please review their privacy policies.
17) Changes to This Policy
We may update this Policy from time to time. We will revise the “Last Updated” date and, where appropriate, provide additional notice for material changes.
18) Contact Us
For privacy questions or requests, contact our DPO:
Kirk Patrick S. Castro (Data Protection Officer)
Email: privacy@gestaltwellness.com
Phone: 032 3454610
Address: 2928 VH Garces Street, Laray, San Roque, Talisay City, Cebu 6045