Data Management Policy

Data Type	Retention Period	Legal Basis	Notes
Reservation info (name, contact, date/time)	Deleted after purpose fulfilled	Personal Information Protection Act	Personal data should be deleted promptly after reservation is completed
Payment receipts / sales slips	7 years	Corporation Tax Act	Mandatory retention as sales-related records
Receipts / vouchers	7 years	Corporation Tax Act	-
Customer card (treatment history, etc.)	Period with explicit consent	Personal Information Protection Act	Consent for handling personal information required
Customer chart (treatments, chemicals, allergies)	Period with explicit consent	Personal Information Protection Act	Charts have quasi-medical nature and require careful management
Health / allergy information	Strictly managed as sensitive personal data	Personal Information Protection Act	Requires especially strict handling as sensitive personal data

Retaining customer data longer than necessary after a reservation may itself violate the law.
Tax-related records (sales evidence) and customer personal data must be managed separately.
Customer charts have a quasi-medical nature and require more careful management.
Health-related information such as drug allergies is classified as sensitive personal data and requires stricter handling.