Privacy Policy

1. Data Controller

The data controller responsible for your personal information is:

Lenka Clark — Beauty Secret Clinique
7 Montpellier Terrace, Cheltenham, Gloucestershire, GL50 1US
Email: [email protected]
Phone: 07546 152 758

2. What Personal Data We Collect

We collect and process the following categories of personal data:

• Identity data: full name, date of birth
• Contact data: email address, phone number, postal address
• Health data: medical history, allergies, medications, contraindications, pregnancy status
• Booking data: appointment history, treatment notes, follow-up records
• Financial data: payment records (we do not store full card details)
• Photography: before and after images, where explicit consent has been given
• Communication data: records of emails, messages and enquiries

Health data is classified as special category data under UK GDPR and is handled with the highest level of care and security.

3. How We Collect Your Data

• Directly from you: via our booking system, consultation forms, in-clinic conversations, and email or telephone enquiries
• Automatically: basic website usage data via our hosting platform (GoHighLevel)
• From third parties: our online booking system (beautysecret.book.app)

4. Legal Basis for Processing

• Contract performance: to book and deliver treatments you have requested
• Legal obligation: to maintain treatment records as required by professional standards
• Legitimate interests: to manage bookings, send reminders, follow up on treatments and improve our services
• Explicit consent: for health data, photography and marketing communications

You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5. How We Use Your Data

• To confirm and manage your appointments
• To carry out pre-treatment consultations and maintain accurate treatment records
• To send appointment reminders and follow-up communications
• To process payments
• To comply with professional and legal obligations
• With your consent: to send promotional offers and marketing communications
• With your consent: to use before/after photographs for portfolio or marketing purposes

6. Who We Share Your Data With

We do not sell, rent or trade your personal data. We may share it only with our booking platform, payment processors, website platform (GoHighLevel), professional advisors where legally required, and regulatory authorities where required by law. All third parties are required to handle your data securely and in accordance with UK GDPR.

7. Data Retention

• Treatment and health records: minimum 7 years, in line with UK health and beauty professional standards
• Financial records: 6 years, in accordance with HMRC requirements
• Marketing data: until you unsubscribe or withdraw consent
• Enquiry data: 2 years from last contact

After the retention period, your data will be securely deleted or anonymised.

8. Your Rights Under UK GDPR

You have the right to: access your data, correct inaccuracies, request erasure, restrict processing, data portability, object to processing, and withdraw consent at any time. To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

9. Data Security

We take appropriate technical and organisational measures to protect your personal data. These include secure, password-protected systems, restricted access to authorised staff, encrypted communications, and regular reviews of our data handling procedures. In the event of a data breach likely to affect your rights, we will notify you and the ICO as required by law.

10. Cookies & Website Data

Our website may use cookies and similar tracking technologies to improve your browsing experience and analyse traffic. You can control cookie settings through your browser.

11. Marketing Communications

We will only send you promotional emails or offers if you have given explicit consent. You can unsubscribe at any time via the unsubscribe link in any email or by contacting us directly. We will process your request within 5 working days.

12. Children’s Privacy

Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe we have done so inadvertently, please contact us and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. The current version will always be available on our website.

14. How to Complain

If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113. We would appreciate the opportunity to address your concerns first, so please contact us at [email protected] before approaching the ICO.