Privacy Policy

Skin Anatomy (“we”, “us”, “our”) is an aesthetic skin clinic at 17 Queen Street, Southwell, Nottinghamshire NG25 0AA. We are the controller of the personal information described in this notice, which means we decide how and why it is used and are responsible for looking after it.

• Email: info@skin-anatomy.co.uk
• Phone: 07777 711 277
• Post: Data Protection, Skin Anatomy, 17 Queen Street, Southwell, Nottinghamshire NG25 0AA
• ICO registration number: [to be added][to confirm]

Questions about this notice or your personal information are handled by our data protection lead, Magdalena Wasiewicz[to confirm].

This notice explains how we handle personal information when you visit our website, book an appointment, buy skincare products or gift vouchers from our shop, contact us, create a client account, have a consultation or treatment at the clinic, or agree to receive marketing. It applies to clients, prospective clients, customers and website visitors. We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

Health information and photographs that show your health are special category data, which the law protects more strictly. We collect only what we need to treat you safely.

• Directly from you — when you book, buy, fill in a form, talk to us or attend the clinic.
• From your GP or another healthcare professional, where you have agreed to this or it is needed for your care.
• From someone who books or buys on your behalf, such as a person who gives you a gift voucher.
• From our payment provider (Stripe), which confirms whether a payment succeeded.
• From our website and cookies, as described in our Cookie Policy.

We must have a lawful basis under Article 6 of the UK GDPR for everything we do, and an additional condition under Article 9 for special category data.

Where we rely on legitimate interests, we have balanced our interests — running a safe, efficient clinic and business — against your rights, and you can object at any time (see “Your rights”). We do not make decisions about you based solely on automated processing.

We never sell your personal information. We share it only where necessary, with:

• Service providers who process data for us under contract and our instructions: website hosting and IT support, database and cloud storage, our booking and client-record system, email and text message providers, and accounting software.
• Stripe, which processes card payments for online orders as an independent controller for fraud prevention and payment regulation.
• Royal Mail and delivery couriers — your name, delivery address and contact details so they can deliver your order.
• Prescribers involved in your care, where a treatment needs a prescription. Details of any independent prescriber.[to confirm]
• Your GP or NHS services, where it is clinically necessary, in an emergency, or with your consent.
• Our insurers, lawyers, accountants and other professional advisers, where needed for their services.
• Regulators, law enforcement and courts, when the law requires it.
• Google (reCAPTCHA), which checks form submissions for spam and abuse to protect our site.
• Meta (Facebook and Instagram) and Google, to measure and improve our adverts — only if you accept marketing cookies. When you do, and you book, buy or send an enquiry, we may share the type of event (for example “booked an appointment”), the treatment or product name and its value, together with your email address, phone number and name in hashed (scrambled) form so these platforms can match the event to their users without us sending your details in readable form. We never share medical history, questionnaire answers, notes or photographs with advertising platforms.

Some of our providers (such as Google, Meta, Stripe and cloud hosting companies) may process personal information outside the UK, including in the United States. When this happens we make sure it is protected — for example by relying on UK adequacy regulations (including the UK–US data bridge for certified organisations) or by using the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

We may keep information for longer if we need it for a complaint, claim or legal requirement. When it is no longer needed, we delete or anonymise it securely.

• Our website and client account use encrypted (HTTPS) connections, and passwords are stored only in hashed form.
• Clinical records are available only to staff who need them, with individual log-ins and an audit trail of access and changes.
• Everyone who works with us is bound by confidentiality, and our suppliers must meet security standards set out in contracts.
• If a personal data breach is likely to put your rights at risk, we will tell the ICO within 72 hours and, where required, tell you without delay.

You have the right to:

• Access — ask for a copy of the personal information we hold about you.
• Rectification — ask us to correct information that is inaccurate or incomplete.
• Erasure — ask us to delete your information. We may not be able to delete clinical or financial records we are required to keep, and we will explain why.
• Restriction — ask us to limit how we use your information while a concern is resolved.
• Portability — receive information you gave us, where we rely on consent or contract, in a commonly used electronic format.
• Objection — object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent — at any time, where we rely on consent. This does not affect anything we did before you withdrew it.

Using your rights is free. We will respond within one month; if your request is complex we may extend this by up to two further months and will tell you why. We may ask you to confirm your identity first, to protect your information.

• If you have a client account, use the privacy page in your account to download your data or send a request.
• Email info@skin-anatomy.co.uk or call 07777 711 277.
• Write to Data Protection, Skin Anatomy, 17 Queen Street, Southwell, Nottinghamshire NG25 0AA.

We send marketing emails or texts only if you opt in. The choices are separate and unticked when you book, buy or contact us, and saying no never affects your care. Every marketing email includes an unsubscribe link, and you can reply STOP to texts or contact us at any time. We do not promote prescription-only medicines in our marketing.

We use strictly necessary cookies to run the website, and analytics and marketing cookies only if you agree. Our Cookie Policy lists every cookie. You can change your choices at any time: Cookie settings.

We do not provide treatments to anyone under 18, and our website and shop are not intended for children. We do not knowingly collect information from children; if we learn that we have, we will delete it unless we must keep it by law.

If you are unhappy with how we have handled your information, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

We may update this notice from time to time. The date at the top shows when it last changed, and we will tell you about any significant changes that affect you — for example by email or when you next book.