This is correct, hidden services are fully encrypted from the users browser to the tor relay running the hidden service