Privacy policy

Introduction

1. At Skin Social Club, we treat your privacy and clinical confidentiality with the highest importance. This Privacy Policy explains how we collect, use, disclose, and protect your personal and medical information when you visit our website, skinsocial.club (the "Site"), visit our studio for treatments, or purchase our memberships.

We operate in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. By booking a treatment or using our Site, you agree to the practices described in this policy.

2. Information We Collect We collect two main types of data: General Personal Data and Special Category (Medical) Data.

A. Personal Information When you create an account, purchase a membership, or book a consultation, we collect:

• Identity Data: Name, date of birth (for age verification).

• Contact Data: Email address, phone number, billing/mailing address.

• Financial Data: Payment card details (processed securely by our third-party payment processors; we do not store full card details).

• Transaction Data: Details of memberships and treatments you have purchased.

B. Special Category Data (Medical & Health) To provide safe laser treatments, we are required to collect sensitive health information. This includes:

• Medical History: Details of current medications, allergies, hormonal conditions (e.g., PCOS), and pregnancy status.

• Skin Health Data: Fitzpatrick skin typing, reaction to sun exposure, and history of keloid scarring or skin sensitivities.

• Treatment Records: Patch test results, laser settings used, and clinical progress notes.

• Photographs: We may take "Before and After" photographs of treatment areas to monitor clinical progress. These are stored securely as part of your medical record.

3. Lawful Basis for Processing Under UK GDPR, we rely on the following legal bases to process your data:

• Contractual Necessity: To fulfill your membership and deliver the treatments you have booked.

• Legal Obligation: To comply with insurance requirements and health and safety laws.

• Explicit Consent: For the processing of your Special Category (Medical) Data. You will be asked to sign a consultation form explicitly consenting to us holding this health data for your safety.

• Legitimate Interests: For marketing communications (where you have not opted out) and business analytics.

4. How We Use Your Information We use your information to:

• Ensure Clinical Safety: To determine if you are medically suitable for laser hair removal and to avoid adverse reactions.

• Manage Your Membership: To process monthly payments, track credit usage, and manage pauses/cancellations.

• Communication: To send appointment reminders (via text/email), post-care advice, and booking confirmations.

• Improve Services: To analyze treatment outcomes and studio performance.

5. Sharing Your Information We do not sell your data. We may share your information with:

• Service Providers: Third-party software used for booking (e.g., CRM systems) and payment processing (e.g., Stripe/GoCardless), who act as data processors on our behalf.

• Medical Professionals: In the rare event of an adverse reaction, we may need to share details with a doctor or dermatologist for your safety.

• Legal & Insurance: To comply with legal obligations or to defend ourselves in the event of an insurance claim.

6. Data Retention

• General Data: We retain account information as long as your membership is active.

• Medical Records: In line with UK medical aesthetic insurance standards, we are required to retain client consultation forms, treatment records, and consent forms for a minimum of seven (7) years following your last treatment. After this period, data is securely deleted or anonymized.

7. Data Security We implement strict technical measures to protect your data. Medical records and photos are stored in secure, password-protected clinical software systems with restricted access limited to authorized staff members only.

8. Your Rights Under UK data protection law, you have the right to:

• Access: Request a copy of the personal data we hold about you.

• Rectification: Request correction of inaccurate information.

• Erasure ("Right to be Forgotten"): You may ask us to delete your data. Note: We may be legally unable to delete medical treatment records for the mandatory retention period (7 years) due to insurance and liability requirements.

• Restriction: Request we limit the processing of your data.

• Withdraw Consent: You may withdraw consent for marketing at any time.

9. Children's Privacy Laser hair removal is an adult service. We do not knowingly collect data from children under the age of 16. Clients aged 16–17 may only be treated with explicit written consent from a parent or guardian, who must be present at the initial consultation.

10. International Transfers Some of our external software providers may host data on servers outside the UK (e.g., in the US). In such cases, we ensure your data is protected through UK-approved safeguards, such as the International Data Transfer Agreement (IDTA).

11. Changes to This Privacy Policy We may update this policy to reflect changes in our clinical practices or the law. We will notify members of significant changes via email.

12. Contact Us If you have questions about your medical data or privacy rights, please contact our Data Protection Officer at:

Skin Social Club [Insert UK Street Address] [Insert City, Postcode] Email: support@skinsocial.club