Privacy Policy

Last updated: June 2026

1. Who We Are

The Skin Studio Chelsfield is a home-based skincare treatment studio run by Ellen Diamond, a VTCT qualified Skincare and Facial Therapist. Ellen is the data controller responsible for your personal data.

2. What Data We Collect

We collect personal data only when it is necessary for providing our services or communicating with you. The categories of data we collect are:

• Booking and contact details: Name, email address, phone number, date of birth (to verify age 16 and over)
• Health and Consultation Data: Skin type, skin conditions, allergies, contraindications, medical history, medications, and any other information you provide in your consultation form
• Booking and Treatment Data: Appointment dates and times, treatment choices, session notes, and payment information (we do not store card details)
• Photographs: Before and after treatment photographs, where you have given consent, kept as part of your treatment record
• Communication: Messages you send via our contact form, the skin quiz, email or phone

3. Why We Collect This Data

We collect and use your data for the following lawful reasons:

• Contract Performance: To arrange, confirm and deliver your treatments and bookings
• Consent: For health and medical consultation data - your informed consent is essential before treatment
• Legitimate Interest: To maintain treatment records for continuity of care, improve our service, and comply with professional standards
• Legal Obligation: To maintain records as required by business and tax law in the UK

4. How We Store Your Data

Your bookings, appointments, consultation and health records, treatment notes and treatment photographs are managed through Fresha, our booking and salon-management provider, which acts as a data processor on our behalf and stores your data securely with industry-standard encryption.

Information you submit through our website (our contact form and the skin quiz) is stored securely using Supabase, a hosted cloud database platform with EU-based servers, encrypted at rest and in transit.

We do not store payment card details. Card payments are processed by Fresha Pay using PCI-compliant systems, and we only receive confirmation of successful payment.

5. How Long We Keep Your Data

We retain personal data for the minimum period necessary:

• Health and Consultation Records: Minimum 3 years after your last treatment, in line with professional standards and industry best practice
• Booking and Treatment Notes: Minimum 7 years after your last treatment, to comply with UK tax requirements and for continuity of care
• Account Data: Kept until you request deletion or your account is closed, then deleted within 30 days
• Contact Form Messages: Kept for 12 months or until your query is resolved, whichever is longer

After these periods, data is securely deleted or anonymized.

6. Who We Share Your Data With

We do not sell, rent or share your personal data with third parties for marketing or commercial purposes. Your data may only be shared with:

• Fresha: Our booking and salon-management platform, which handles appointments, client records, consultation forms, treatment photographs and card payments on our behalf, bound by a data processing agreement
• Supabase: The cloud database behind our website's contact form and skin quiz, bound by a data processing agreement
• Postmark: Our transactional email service, used to send service communications such as quiz follow-ups (not third-party marketing)
• Google Analytics: Used only if you accept analytics cookies, to understand how our website is used (see section 9)
• Google Ads: Used only if you accept advertising cookies, to measure the performance of our ads and, where applicable, to show our ads to people who have visited our site (see section 9)

These providers are committed to GDPR compliance and data protection. Treatment photographs are never used publicly or for marketing without your separate, explicit consent. We do not share your data with any other parties without your explicit consent, except where required by law.

7. International Data Transfers

Some of our processors operate outside the UK. Fresha, Postmark and Google may process data in the United States under UK-approved safeguards, such as standard contractual clauses and the UK extension to the EU-US Data Privacy Framework. Supabase operates within the EU. All transfers are made in accordance with UK GDPR.

8. Your Rights

Under UK GDPR, you have the following rights. To exercise any of these rights, contact Ellen at the details above:

• Right of Access: You can request a copy of all personal data we hold about you
• Right to Rectification: You can correct inaccurate or incomplete information
• Right to Erasure: You can request deletion of your data, subject to legal obligations (e.g. tax records)
• Right to Portability: You can request your data in a structured, commonly used format to transfer to another service
• Right to Withdraw Consent: Where we rely on your consent, you can withdraw it at any time
• Right to Object: You can object to processing of your data for legitimate interest reasons
• Right to Complain: You can lodge a complaint with the Information Commissioner's Office (ICO) - see contact details below

We will respond to rights requests within 30 days of receipt.

9. Cookies and Analytics

We keep tracking to a minimum:

• Essential storage: A small amount of data in your browser (localStorage/sessionStorage) to remember your cookie choice and support basic site functions, such as the skin quiz.
• Google Analytics 4: We use Google Analytics to understand how our website is used. Analytics cookies are only set if you accept them via our cookie banner; if you decline, they stay switched off.
• Google Ads: If you accept advertising cookies, we use Google Ads to measure how well our ads perform and to reach people who have previously visited our site. These cookies are only set if you accept them via our cookie banner; if you decline, they stay switched off.

We only use advertising cookies with your consent, and we do not sell your data. You can change your cookie choice at any time by clearing your browser storage, and you can manage cookies through your browser settings.

10. Children and Young People

Our skincare treatments are designed for adults. We do not intentionally collect data from anyone under 16. If we become aware that we have data from someone under 16, we will delete it immediately. Parents or guardians who believe their child has provided information should contact us urgently.

11. Data Breaches

In the unlikely event of a data breach, we will notify affected individuals and the Information Commissioner's Office within 72 hours as required by law, unless the breach is unlikely to cause harm to your rights or freedoms.

12. Changes to This Policy

This privacy policy may be updated from time to time to reflect changes in our practices, technology or legal requirements. Any significant changes will be communicated to you by email if we have your contact details. Your continued use of our website and services after updates constitutes your acceptance of the updated policy.

13. Contact and Complaints

If you have questions about this privacy policy, how we use your data, or wish to exercise your rights:

If you are unhappy with how we handle your data or your complaint is not resolved, you can lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent authority for data protection: