Your information
Privacy policy
Last updated: October 2026
Who I am
SkinXcel is a private skin studio in Aveley, South Ockendon, Essex RM15 4AR, run by Natalie. I am the data controller for the personal information described here, which means I decide how it is used and I am responsible for keeping it safe.
What I collect and why
| Information | Why I use it | Lawful basis |
|---|---|---|
| Name, phone number, email address and appointment details | To book, confirm and manage your appointments and contact you about them | Contract |
| Consultation form answers, including medical history, medication, allergies and skin concerns | To check a treatment is safe and suitable for you, and to plan it | Your explicit consent, plus contract |
| Skin scan images, treatment notes and your skin report | To assess your skin, track your progress and recommend treatments and products | Your explicit consent, plus contract |
| Before and after photos shown on my website or social media | To show the results of my work | Your separate written consent, which you can withdraw at any time |
| Email address for the SkinXcel newsletter | To send skin tips, studio news and offers | Your consent |
| Messages you send by WhatsApp, phone, email or social media | To answer your questions | Legitimate interests |
| Booking fee and payment records | To take payment and keep business accounts | Contract and legal obligation |
Health information is a special category of personal data under UK GDPR. I only ask for what I need to treat you safely, and I ask for your explicit consent on the consultation form.
Who I share it with
I never sell your information. I use a small number of trusted services to run the business, and they only handle your information on my behalf:
- Acuity Scheduling for online bookings
- Stripe to take booking fees and online payments. I never see your full card details.
- Jotform for consultation forms
- MailerLite for the newsletter
- WhatsApp, if you choose to message me there
- Cloudflare Web Analytics to count website visits. It does not use cookies and does not identify you.
Some of these providers may store data outside the UK. Where they do, they use safeguards recognised under UK data protection law. I may also share information where the law requires it, or with my insurer if there is a claim.
How long I keep it
- Client records, consultation forms and treatment notes: for as long as my insurance and professional record-keeping requirements need me to, then securely deleted
- Payment records: 6 years, for tax purposes
- Newsletter sign-ups: until you unsubscribe
- Before and after photos: until you withdraw your consent
Clients under 18
If you are under 18, a parent or guardian must come to your appointment with you and give consent on your behalf.
Your rights
Under UK GDPR you have the right to:
- ask for a copy of the information I hold about you
- ask me to correct anything that is wrong
- ask me to delete your information, where I do not need to keep it by law
- object to, or ask me to restrict, how I use it
- withdraw your consent at any time, for example by unsubscribing from the newsletter or asking me to remove a photo
I will reply within one month, and there is no charge.
Contact and complaints
If you are unhappy with how I have handled your information, please talk to me first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.