Last updated: 20 July 2026

1. About This Privacy Policy

Orchid Skin Rejuvenation Clinic respects your privacy and is committed to protecting your personal information.

This privacy policy explains how we collect, use, store and protect your personal information when you:

• Visit our website

• Submit an online enquiry

• Contact us by telephone, WhatsApp, social media or another communication method

• Book or attend a consultation

• Receive a treatment from us

• Make a payment

• Provide feedback, a review or a complaint

• Agree to receive marketing communications

We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and the Data (Use and Access) Act 2025.

2. Who We Are

Orchid Skin Rejuvenation Clinic is the data controller responsible for deciding how and why your personal information is used.

The person responsible for data protection matters is:

Sarah Watson
Orchid Skin Rejuvenation Clinic
Sharpe’s Hair and Beauty
105 Dalestorth Road
Skegby
Sutton-in-Ashfield
NG17 3AG

Telephone: 07584 168579

You may contact us by telephone, post or through the consultation form on our website regarding any questions, requests or complaints relating to your personal information.

3. Personal Information We Collect

The personal information we collect will depend on how you interact with us.

Contact and identification information

This may include:

• Your name

• Telephone number

• Email address, where provided

• Address, where required

• Date of birth or age

• Emergency contact details

• Details of a parent, guardian or representative, where relevant

Enquiry and appointment information

This may include:

• The treatment or treatments you are interested in

• Your preferred appointment dates and times

• Questions or comments submitted through our website

• Records of telephone calls, messages, emails or WhatsApp conversations

• Appointment history

• Cancellation and rescheduling information

Health and treatment information

To assess whether a treatment is safe and suitable, we may collect information about:

• Your medical history

• Existing health conditions

• Allergies and sensitivities

• Previous aesthetic, cosmetic or medical treatments

• Medication and supplements

• Pregnancy or breastfeeding status

• Relevant lifestyle information

• Skin conditions and concerns

• Treatment goals and expected outcomes

• Contraindications or reasons why a treatment may not be suitable

• Treatment consent

• Products used, treatment areas and dosage information

• Treatment notes, aftercare and follow-up information

• Side effects, reactions or complications

Health information is treated as special category personal data and is given additional protection.

Photographs

We may take photographs before, during or after treatment where they are reasonably required to:

• Assess your suitability

• Plan your treatment

• Maintain an accurate treatment record

• Monitor treatment results

• Respond to a complication, concern or complaint

Clinical photographs will be treated as confidential treatment records.

We will ask for separate consent before using identifiable photographs for advertising, social media, our website, case studies or other promotional purposes. Refusing marketing photography will not affect your ability to receive treatment.

Payment and transaction information

This may include:

• Payment amounts

• Payment dates

• Transaction references

• Deposits, refunds and outstanding balances

• Limited payment card information supplied through a payment provider

We do not normally retain complete payment card details.

Website and technical information

When you use our website, we may collect:

• Internet Protocol address

• Browser and device type

• Pages visited

• Date and time of visits

• Referring website

• General location information

• Cookie identifiers

• Information about how the website is used

• Security and error logs

Marketing and communication preferences

We may record:

• Whether you have agreed to receive marketing

• How you would prefer to be contacted

• When and how your consent was obtained

• When you unsubscribe or ask us to stop contacting you

4. How We Collect Your Information

We may collect personal information:

• Directly from you

• Through our website consultation form

• During consultations and treatment appointments

• Through telephone calls, email, WhatsApp or social media

• Through consent forms, medical questionnaires and treatment records

• Through payment and booking systems

• From a parent, guardian or authorised representative

• From a prescribing practitioner or healthcare professional, where appropriate and authorised

• Automatically through cookies and website technologies

Please make sure that any information you provide is accurate and let us know when your information changes.

5. How We Use Your Personal Information

We may use your information for the following purposes.

Responding to enquiries

We use your name, contact details, treatment interests and messages to respond to your questions and discuss the services you are considering.

Our lawful basis is normally taking steps at your request before entering into a contract or our legitimate interest in responding to genuine enquiries.

Booking and managing appointments

We use your information to arrange consultations, confirm appointments, send reminders, manage cancellations and maintain appointment records.

Our lawful basis is normally the performance of a contract or taking steps before entering into a contract.

Assessing treatment suitability

We use health information, treatment history and consultation information to assess whether a treatment is safe and appropriate for you.

Our lawful basis for general personal information is normally the performance of a contract, taking steps before entering into a contract or our legitimate interests in providing safe and responsible services.

For health information and other special category data, we will rely on an additional lawful condition. This will normally be your explicit consent. Where appropriate, information may also be processed for the provision of health care by, or under the responsibility of, a healthcare professional who is subject to confidentiality obligations.

Providing treatments and aftercare

We use your information to plan and provide treatments, record the products and techniques used, give aftercare advice, monitor your results and respond to any side effects or complications.

Our lawful basis is normally the performance of our contract with you and our legitimate interests in providing safe, appropriate and properly documented treatment.

Maintaining treatment and clinical records

We keep treatment records to support continuity of care, respond to questions, meet insurance requirements and establish, exercise or defend legal claims.

Our lawful bases may include the performance of a contract, compliance with legal obligations and our legitimate interests in maintaining accurate professional records.

Where records contain special category information, we may also rely on explicit consent, the provision of health care where applicable, or the establishment, exercise or defence of legal claims.

Processing payments

We use payment information to collect deposits and treatment fees, issue refunds, maintain accounting records and prevent fraud.

Our lawful bases are the performance of a contract, compliance with legal and tax obligations and our legitimate interests in managing the clinic’s finances.

Communicating important information

We may contact you about appointments, consultations, treatment preparation, aftercare, product safety information, changes to our services or matters affecting your treatment.

These are service communications rather than marketing messages.

Marketing

Where permitted, we may contact you about treatments, availability, offers, clinic news or related services.

We will normally rely on your consent. In limited circumstances, we may contact an existing client about our own similar services where the electronic marketing soft opt-in applies and the client was given a clear opportunity to opt out.

You may unsubscribe at any time by following the instructions in the message or contacting us directly.

Operating and protecting our website

We may use technical information to operate the website, prevent fraud, maintain security, diagnose problems and understand general website performance.

Our lawful basis is our legitimate interest in maintaining a secure and effective website. Consent will be requested before non-essential cookies are placed where required.

Complying with legal and regulatory requirements

We may use or disclose information where necessary to:

• Comply with a legal obligation

• Respond to a lawful request from a regulator, court or law enforcement body

• Protect the health or safety of a client or another person

• Report or investigate suspected fraud or criminal activity

• Establish, exercise or defend legal claims

• Meet insurance or professional requirements

6. Medical Information and Confidentiality

Information about your health, medication, medical history and treatment suitability is particularly sensitive.

We will only collect health information that is reasonably necessary to assess suitability, provide treatment, protect your safety and maintain appropriate treatment records.

Access to this information will be limited to people who genuinely need it for treatment, administration, prescribing, insurance, legal or safety purposes.

Where a treatment requires the involvement of a prescriber or another healthcare professional, relevant information may be shared with that professional so they can assess your suitability and make an independent clinical decision.

Please do not include unnecessary medical information in an initial website enquiry or social media message. Detailed medical information should be provided through the clinic’s approved consultation and consent process.

7. Who We May Share Your Information With

We do not sell your personal information.

Where necessary, we may share limited information with:

• Prescribing practitioners

• Doctors, nurses, pharmacists or other healthcare professionals involved in your treatment

• Emergency healthcare services where necessary to protect health or safety

• Booking and appointment system providers

• Payment processing providers

• Website hosting, maintenance and security providers

• Secure document storage or clinic management system providers

• Telephone, email and messaging providers

• Accountants and professional advisers

• Insurance providers and insurance advisers

• Legal advisers

• Regulatory bodies

• Courts, law enforcement bodies and public authorities

• A purchaser or successor if the clinic is sold or transferred

Service providers acting on our behalf are expected to use personal information only for the agreed purpose and to protect it appropriately.

8. WhatsApp and Social Media

You may choose to contact us through WhatsApp or social media.

These services are operated by independent third-party companies. Information sent through these platforms may be processed according to their own privacy policies and may be stored outside the UK.

Please avoid sending highly sensitive medical information through social media or an unsecured messaging platform unless we have specifically asked you to use that method.

We may transfer relevant information from a message into your secure enquiry or treatment record where necessary.

9. International Transfers

Some technology, communication, hosting, payment or software providers may process personal information outside the United Kingdom.

Where this happens, we will take reasonable steps to make sure appropriate safeguards are used. These may include:

• UK adequacy regulations

• The UK International Data Transfer Agreement

• The UK Addendum to approved standard contractual clauses

• Other safeguards permitted by UK data protection law

10. How Long We Keep Your Information

We will not keep personal information for longer than reasonably necessary.

Our retention periods depend on the type of information and why it was collected.

As a general guide:

• Enquiries that do not lead to an appointment may be retained for up to 12 months after the last contact.

• Appointment, payment and accounting records may be retained for up to six years after the end of the relevant financial year.

• Marketing information may be retained until you unsubscribe or withdraw your consent.

• Website security logs may be retained for a limited period required to investigate security issues.

• Consent records may be retained for as long as necessary to demonstrate how and when consent was obtained.

• Complaints, incidents and legal correspondence may be retained for as long as necessary to investigate the matter and establish, exercise or defend legal claims.

Treatment records, consent forms, medical questionnaires and clinical photographs may need to be retained for a longer period. The retention period will take account of insurance requirements, professional guidance, prescribing arrangements, the type of treatment provided and the period during which a legal claim could be made.

When information is no longer required, it will be securely deleted, destroyed or anonymised.

11. How We Protect Your Information

We use reasonable technical and organisational measures to protect personal information from:

• Unauthorised access

• Accidental loss

• Inappropriate disclosure

• Misuse

• Alteration

• Destruction

These measures may include password protection, device security, access controls, secure storage, staff confidentiality, backups and the careful selection of service providers.

No website, email system or internet transmission can be guaranteed to be completely secure. You should avoid sending unnecessary sensitive information through ordinary email, social media or public Wi-Fi networks.

12. Cookies

Cookies are small files placed on your device when you visit a website.

Our website may use cookies for purposes such as:

• Making the website function correctly

• Remembering preferences

• Maintaining security

• Understanding website performance

• Measuring visitor activity

• Supporting embedded or third-party content

Strictly necessary cookies may be used without consent where they are required for the website to work.

Where required, analytics, advertising or other non-essential cookies will only be used after you have given consent through the website’s cookie controls.

You can change your cookie preferences through the website’s cookie settings or through your browser. Blocking some cookies may affect how the website works.

13. Third-Party Websites

Our website may contain links to third-party websites, including product manufacturers, training providers, WhatsApp and social media platforms.

We are not responsible for how those organisations collect or use personal information. You should read the privacy policy of any third-party website or service before providing information.

14. Your Data Protection Rights

Depending on the circumstances, you may have the right to:

• Ask for confirmation that we process your personal information

• Request a copy of the personal information we hold about you

• Ask us to correct inaccurate or incomplete information

• Ask us to delete information in certain circumstances

• Ask us to restrict how information is used

• Object to certain processing

• Request the transfer of information in a portable format where applicable

• Withdraw consent at any time where processing is based on consent

• Object to direct marketing at any time

• Complain about how your personal information has been handled

Withdrawing consent will not affect the lawfulness of processing carried out before consent was withdrawn. We may also need to keep certain records where another lawful basis applies, such as legal, insurance or professional record-keeping requirements.

We may ask for proof of identity before responding to a request. This helps us avoid disclosing personal information to the wrong person.

We will normally respond to a valid rights request within one calendar month. This period may be extended where a request is particularly complex or where permitted by law.

15. Automated Decision-Making

We do not use your personal information to make treatment or eligibility decisions based solely on automated processing.

Treatment recommendations and suitability decisions are made through consultation and professional assessment.

16. Data Protection Complaints

You may raise a data protection complaint if you believe we have not collected, used, stored or protected your personal information properly.

Complaints can be made by telephone, post or through the enquiry form on our website. Please clearly state that your concern is a data protection complaint and explain:

• What has happened

• Which information is involved

• What you would like us to do

• How you would prefer us to contact you

We will acknowledge a data protection complaint within 30 days of receiving it.

We will take appropriate steps to investigate the complaint, keep you reasonably informed and provide an outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office. We would appreciate the opportunity to investigate and resolve your concern directly before you approach the ICO, but you are not required to do so.

17. Changes to This Privacy Policy

We may update this privacy policy when our services, suppliers, website or legal responsibilities change.

The latest version will be published on our website with the date of the most recent update.

Where a change materially affects how we use personal information, we will take reasonable steps to bring it to the attention of affected clients.