Legal

Privacy policy

Last updated: 25 July 2026

DRAFT — pending legal review before launch. Replace all bracketed placeholders: [Legal entity name], [Registered address], [Country of registration], [Contact email]. Have a qualified lawyer in [Country of registration] review this document and the data flows it describes.

Who we are

Bonita ("we", "us") is an independent verification index for cross-border cosmetic surgery, operated by [Legal entity name], [Registered address], [Country of registration]. For any privacy question or request, contact us at [Contact email].

What we collect

Contributions you submit (corrections, source tips, review signals): the type of contribution, the details you write, and — only if you choose to provide them — your name or initials and email address. Submissions are stored in our moderation queue (Cloudflare D1, EU/US infrastructure) until reviewed.
Technical data: when you contact the API, an irreversibly hashed IP address and your browser's user-agent string, used solely for abuse prevention and rate limiting.
On-device research data: your saved surgeons, shortlist choices, and last search are stored in your own browser's localStorage. This data never leaves your device unless you explicitly submit it.

What we do not collect

We do not require an account to browse the index.
We do not ask for medical records. Our contribution form explicitly asks you not to include them; please keep it that way.
We do not run advertising trackers, and we do not sell personal data to anyone. Surgeon rankings and trust scores are never influenced by payment.

How we use data

To moderate and verify contributions before anything is published.
To reply to you, only if you gave us an email address for follow-up.
To protect the service from abuse (hashed IP, rate limiting).
We do not use your submissions to train AI models and do not share them with clinics or third parties, except where a correction concerns a surgeon's published profile and fairness requires a right of reply. In that case we share the substance of the claim, never your identity, without your consent.

Legal bases (EEA/UK visitors)

Consent — when you optionally provide your name or email with a contribution.
Legitimate interest — moderation, verification research, and service security.

Retention

Pending contributions are kept for up to 12 months or until moderation is complete, whichever comes first. Published corrections retain an audit record (without your contact details) for the life of the relevant profile. On-device localStorage data is retained by your browser until you clear it.

Your rights

Depending on your location, you may have the right to access, correct, export, or delete your personal data, to object to processing, and to lodge a complaint with your data protection authority. Email [Contact email] and we will respond within 30 days. Because browsing requires no account, most requests concern contribution records; include the approximate date and content of your submission so we can locate it.

Processors and transfers

We use Cloudflare (Pages, Workers, D1) for hosting and storage, and Vercel for site delivery. Data may be processed in the EU or US under their respective data processing terms. No other processor receives personal data.

Changes

We will update this page when our data practices change and revise the date above. Material changes will be flagged on the homepage for 30 days.