Privacy policy

Who is responsible for your data

This website is operated by , trading as , a based at .

For the purposes of UK data protection law, that person is the data controller — the one responsible for deciding how your information is used and for keeping it safe.

Registered with the Information Commissioner's Office, registration number .

What is collected, and why

Only what is needed to provide the service safely and lawfully. Nothing is collected "just in case".

Information	Why it is needed	Lawful basis
Name, phone number, email	To book, confirm and remind you about appointments	Contract
Medical and skin history	To check a treatment is safe for you — pregnancy, medication, skin conditions, allergies	Consent (special category data)
Patch test records	Insurance and safety. Evidence that a reaction test was carried out	Legal obligation / legitimate interest
Treatment notes & pigment records	So a top-up or refresh matches your previous work	Contract
Before and after photographs	Clinical record. Published only with separate written permission	Consent
Payment records	Accounting and tax	Legal obligation

What this website itself collects

The website is a set of static pages. It has no contact form, no user accounts and no tracking pixels. Nothing you type is stored on the site.

• No analytics. Your visit is not tracked or profiled.
• No advertising cookies. Nothing follows you to other websites.
• One functional cookie only — it remembers that you dismissed the cookie notice, so you are not asked again. Nothing else.

One feature loads content from another company, and that company sets its own cookies when you use it. See the cookie policy for the detail.

Who your information is shared with

Your data is never sold, and never shared for marketing. It is shared only with the services needed to run the studio:

• Ovatu / book.app — the booking system. Holds your name, contact details and appointment history.
• Hostinger — the web host.
• An accountant and HMRC — payment records only, as legally required.

Information may also be disclosed where the law requires it, or to an insurer if a claim is made.

How long it is kept

Client treatment and consultation records are kept for years after your last appointment. This is an insurance and liability requirement for cosmetic procedures, not a marketing choice. Financial records are kept for six years, as HMRC requires. Anything else is deleted when it is no longer needed.

Your rights

Under UK GDPR you can, free of charge:

• Ask what information is held about you, and get a copy
• Have anything inaccurate corrected
• Ask for your data to be deleted — though records that must legally be retained for insurance cannot be erased until that period expires
• Withdraw consent for photographs at any time, including photographs already published
• Object to how your data is used, or ask that its use be restricted
• Ask for your data in a portable format

Email [email protected] and you will get a response within one month.

If you are not satisfied with the response, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Keeping it secure

Paper consultation forms are kept locked at the studio. Digital records sit inside the booking system, which is protected by a password and two-factor authentication. This website is served over HTTPS.

No system is perfect. If a breach ever occurred that put your rights at risk, you would be told, and so would the ICO, within 72 hours.

Changes

If this policy changes, the date at the top changes with it.