Privacy
Policy

Effective date: 8 October 2026

Who we are

LovesSkin is a skin and aesthetics clinic operated by LOVES SKIN LTD (company number 11969603), an active private limited company incorporated on 29 April 2019. We provide consultation-led skin, aesthetics and beauty treatments from our clinic in Weybridge, Surrey.

For the purposes of UK data protection law, LOVES SKIN LTD is the data controller of your personal information.

Contact details

Company	LOVES SKIN LTD
Company number	11969603
Registered office	Middleborough House, 16 Middleborough, Colchester, England, CO1 1QT
Clinic	118 Oatlands Drive, Weybridge, Surrey, KT13 9HL
Email	info@lovesskin.co.uk
Telephone	01932 212798
Website	lovesskin.co.uk

What personal data do we collect?

We may collect and process the following personal data, depending on how you interact with us and the services you receive:

Information you provide directly

• Your name, date of birth and contact details
• Appointment, consultation and treatment enquiries
• Health and medical information relevant to treatment suitability, including medical history, medications, allergies and other information you choose or are asked to provide
• Treatment records, consent records, practitioner notes and aftercare information
• Photographs or images taken for clinical or treatment-record purposes, where appropriate
• Payment, transaction and purchase information
• Marketing preferences and communications with us
• Any other information you provide through forms, email, telephone, booking systems or in person

Information collected automatically

• IP address
• Browser type and version
• Device type
• Pages visited and interactions with the website
• Time spent on the website
• Referring website or traffic source
• Cookie and similar technology data

Special category data

Information about your health is special category personal data and receives additional protection under UK data protection law. We only collect health information that is relevant and necessary for consultation, treatment suitability, treatment delivery, aftercare, safety, record keeping or related legal and insurance requirements.

Where special category data is processed, we identify both an appropriate lawful basis under Article 6 of the UK GDPR and an additional condition under Article 9. Depending on the circumstances, this may include explicit consent and, where applicable, the provision or management of health or social care. Treatment consent is separate from data protection consent.

How we use your data

We may use your personal information to:

• Manage enquiries, consultations, appointments and bookings
• Assess treatment suitability and provide treatments safely
• Maintain treatment, consent and aftercare records
• Process payments and manage purchases or refunds
• Contact you about appointments, aftercare or service-related matters
• Respond to questions, complaints or requests
• Improve our services, website and client experience
• Maintain the security and performance of our systems and website
• Send marketing communications where permitted by law
• Meet legal, regulatory, professional, insurance and record-keeping obligations
• Establish, exercise or defend legal claims where necessary

Lawful basis for processing

Under UK data protection law, we rely on one or more of the following lawful bases, depending on the purpose of the processing:

• Contract: where processing is necessary to take steps at your request before entering into a contract or to provide services you have booked
• Legitimate interests: where necessary to operate and improve our clinic, manage client relationships, protect our systems and respond to enquiries, provided those interests are not overridden by your rights
• Consent: where you have opted in to marketing, accepted non-essential cookies or where consent is otherwise appropriate
• Legal obligation: where we must process information to comply with applicable law

For health information and other special category data, we also rely on an appropriate Article 9 condition as described above.

Clinical photographs and marketing images

We may take photographs where they are useful or necessary for consultation, treatment planning, progress monitoring or clinical records. Images used as part of your treatment record are handled as personal data and, where they reveal health information, may also constitute special category data.

We will not use identifiable before-and-after photographs, testimonials or other client images for marketing or social media unless we have obtained separate, specific permission for that use. You may withdraw marketing consent for future use at any time, although this will not affect processing already carried out lawfully before withdrawal.

How we share your data

Where necessary, we may share personal data with:

• Authorised LovesSkin staff, practitioners and contractors who need the information to provide or support your services
• Appointment-booking, customer-management, communications and website service providers
• Payment processors and financial service providers
• IT, hosting, cyber-security, analytics and software providers
• Professional advisers, insurers and legal representatives
• Regulators, law enforcement bodies or public authorities where required by law
• Other service providers where you have asked us to arrange or coordinate a service

We do not sell your personal data to third parties.

International transfers

Some of our service providers may process personal data outside the UK. Where this happens, we take reasonable steps to ensure an appropriate lawful transfer mechanism and safeguards are in place, as required by UK data protection law.

How long do we keep your data?

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, including treatment continuity, legal, regulatory, professional, insurance, accounting and reporting requirements. Retention periods vary according to the type of record and the reason it is held.

Treatment and consultation records may need to be retained for several years after your last interaction with us. Transaction and financial records are retained in line with applicable statutory requirements. Marketing information is retained until you unsubscribe or we determine that it is no longer appropriate to keep it.

Website forms, online booking and payments

If you submit information through our website, booking system or other online service, the information you provide will be used to respond to your request, manage your appointment or purchase and provide relevant follow-up. Third-party booking or payment providers may process information in accordance with their own privacy terms as well as under our contractual arrangements with them.

Please only provide health or other sensitive information through the channels we ask you to use for that purpose.

Cookies

Our website may use cookies and similar technologies to support website functionality, booking features, security, preferences and analytics. Where required, non-essential cookies are only used with your consent. Please see our Cookie Policy for more information.

Analytics and third-party tools

We may use third-party services such as website analytics, spam protection, booking tools, payment services, embedded content, maps or social media features. These services may process technical or account information where relevant. Some providers act as our processors and others may act as independent controllers under their own privacy policies.

How we protect your data

We take reasonable technical and organisational measures to protect personal data. These measures may include access controls, secure systems, role-based access, password protection, appropriate contractual safeguards and staff confidentiality requirements. No online transmission or storage system can be guaranteed to be completely secure.

Your rights

Depending on the circumstances, UK data protection law gives you rights including the right to:

• Request access to your personal data
• Request correction of inaccurate or incomplete data
• Request erasure of your personal data in certain circumstances
• Request restriction of processing in certain circumstances
• Object to processing where we rely on legitimate interests
• Request transfer of your data in certain circumstances
• Withdraw consent where processing is based on consent
• Complain about how your personal data has been handled

These rights are not absolute and may be subject to legal exceptions. To exercise a right, please contact us using the details above.

Data protection complaints

If you have a concern about how we use your personal data, please contact us using the details above. We will acknowledge a data protection complaint within 30 days, investigate it appropriately and communicate the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection. We would normally appreciate the opportunity to address your concern directly first.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services, systems or legal obligations. Any changes will be posted on our website and the updated effective date will be shown at the top of this policy.