Privacy Notice

1. Who we are

The MH Skin Club is a private facial treatment studio based near Tewkesbury on the edge of the Cotswolds. We are responsible for the personal information you provide when you book, attend appointments or complete our consultation forms.

If you have any questions about this notice or your data, please email themhskinclub@gmail.com.

2. What personal information we collect

We only collect the information we need to provide safe, personalised treatment. This may include:

• Your name, date of birth, address, email address and mobile number.
• Emergency contact details, if you choose to provide them.
• Skin history, concerns, allergies, sensitivities, medication and health information relevant to your treatment.
• Appointment details, treatment notes and aftercare records.
• Photographs or video taken for confidential treatment records or, with your separate agreement, for marketing.
• Your marketing preferences and how you heard about us.

3. How we use your information

We use your information on the following legal bases:

• To provide your treatment — assessing suitability, personalising your facial, maintaining a confidential record and keeping you safe. This is necessary to perform our contract with you.
• To manage your appointment — confirmations, reminders, rescheduling and essential service messages. This is necessary for our contract and our legitimate interest in running the practice.
• To comply with legal obligations — such as insurance, tax, accounting, health and safety, and record-keeping requirements.
• With your consent — for health details, marketing photographs, and marketing messages. You can withdraw consent at any time.

4. Health information

Information about your skin, health, medication, allergies, pregnancy and medical history is classed as special category data. We only collect this with your explicit consent, where it is necessary for the provision of healthcare, or to establish, exercise or defend legal claims. You can withdraw your consent for future health data processing at any time, though this may mean we cannot safely provide certain treatments.

5. Photographs, social media and marketing

We may take photographs or video as part of your confidential treatment record. These are not used for marketing and are kept securely as part of your treatment notes.

Where you choose to allow optional marketing photographs, those images may be used for our website, social media, printed materials, advertising and other promotional activity by default, unless you opt out. You may choose to allow only non-identifying close-up images, identifiable images, or no marketing use at all. You can change your mind or withdraw your consent at any time by emailing us, although material already published may not be fully recoverable.

6. How we keep your information safe

We store your information digitally using encrypted, password-protected systems and reputable cloud service providers. Access is limited to the practitioner and, where necessary, trusted professionals bound by confidentiality. Paper records, if any, are kept in a secure place. We do not sell your information to third parties.

7. Who we share your information with

We only share your information when necessary and lawful. This may include:

• Our insurers, legal advisers or accountants, when required.
• Regulatory or law enforcement bodies, if we are legally required to do so.
• Trusted IT or service providers who process data on our behalf under strict confidentiality and security obligations.

8. How long we keep your data

We keep treatment records for as long as necessary for your care, legal, insurance and accounting purposes. As a general guide, adult treatment records are kept for at least seven years from the date of the last appointment. Records relating to children are kept until the client reaches age 25. Marketing photographs are kept only while your consent remains valid and are securely deleted when you withdraw consent or request removal. Some anonymised images may be retained where identification is no longer possible.

9. Your rights

Under UK data protection law you have the right to:

• Access a copy of the information we hold about you.
• Ask us to correct inaccurate or incomplete information.
• Ask us to delete your information in certain circumstances.
• Restrict or object to certain processing.
• Request a portable copy of the data you provided.
• Withdraw your consent at any time, where we rely on it.

To exercise any of these rights, please contact us at themhskinclub@gmail.com. We will respond within one month, free of charge.

10. Cookies and analytics

Our website does not use intrusive tracking or third-party advertising cookies. We may use basic analytics to understand how visitors use the site and to improve the experience. You can manage cookies through your browser settings.

11. Complaints

If you are unhappy with how we handle your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters: www.ico.org.uk.

12. Changes to this notice

We may update this notice from time to time to reflect changes in our practice or the law. The latest version will always be available on this page, and the date at the top will tell you when it was last revised.