This notice explains what personal information Lucy's Aesthetics collects when you visit this website, enquire or book, why it is collected, how long it is kept, and the rights you have over it. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, in plain English.
No medical information through this website, please. The contact form is for getting in touch only. Your medical history, suitability and consent are taken in person at your consultation, never through this site. Please don't include health details in an enquiry.
Who is responsible for your information
The data controller is Lucy's Aesthetics Ltd (registered in England and Wales, company number 15823477), trading as Lucy's Aesthetics. The practice is run by Lucy, an NMC-registered nurse and independent prescriber, based in Birmingham (B31). Registered office details are on our company information page. Lucy is the only person with routine access to enquiry and client records.
Lucy's Aesthetics Ltd is working towards registration with the Information Commissioner's Office (ICO); the registration number will be published here once issued.
For anything relating to your information, email hello@lucysaesthetics.co.uk.
What I collect
If you enquire through this website
- Contact details: your name, and an email address and/or phone number.
- Treatment interest: the treatment area you select, and anything you choose to write in your message.
The contact form does not send anything to a server. It opens a pre-filled message in your own email app, so nothing you type is stored by this website. I only receive what you choose to send by email.
If you message me on Instagram
- Your Instagram handle and the content of your messages. These are held within Instagram (Meta) under their privacy policy, as well as in my record of our conversation.
If you book or become a client
- Booking and consent are handled by Faces Consent, a separate booking and medical-records platform, under their own privacy terms. Health information (your medical history, suitability, consent and treatment records) is collected there and at your in-person consultation, not on this website.
- I keep clinical records of your consultation and treatment as a registered healthcare professional. This is "special category" data under UK GDPR and is handled with extra care.
Why I use it, and the legal basis
- Responding to your enquiry and arranging a consultation. Legal basis: your consent, and steps taken at your request before entering a contract (Article 6(1)(a)/(b)).
- Providing treatment and aftercare once you are a client. Legal basis: performance of a contract (Article 6(1)(b)); for health information, provision of health care by a registered professional subject to a duty of confidentiality (Article 9(2)(h)).
- Meeting legal and professional obligations: medicines legislation, NMC record-keeping standards, tax and accounting rules (Article 6(1)(c)).
- Running this website and understanding how it is used (Cloudflare hosting and Web Analytics, and Google Analytics). Legal basis: legitimate interests in keeping the site working, seeing which pages are useful and how many visitors go on to book (Article 6(1)(f)). You can opt out at any time; see "Cookies and this website" below.
- Protecting you in an emergency: for example sharing information with emergency services during a complication (Article 6(1)(d) and Article 9(2)(c)).
I do not send marketing without your prior consent, and you could withdraw it at any time. Your information is never sold.
Who your information is shared with
- Faces Consent: the booking and consent platform, where booking and clinical consent are processed.
- Cloudflare: hosts this website and provides cookieless visit counts.
- Google: provides Google Analytics, which measures how this website is used (see "Cookies and this website" below), and serves the site's fonts.
- A dispensing pharmacy or prescriber: only where a prescription-only treatment is clinically appropriate and has been assessed in person.
- My indemnity insurer or professional advisers: if needed to respond to a complaint or claim.
- Regulators and authorities: the NMC, courts or other bodies where the law requires it.
Where service providers process data on my behalf, they do so under contract and, if any processing happens outside the UK, only with the safeguards UK GDPR requires.
Cookies and this website
This website uses Google Analytics to understand how many people visit, which pages are useful and how many go on to book. When a page loads, Google Analytics sets two cookies in your browser:
- _ga: tells one visitor apart from another using a random ID. It lasts up to 2 years.
- _ga_ZT0JPLQ6MN: keeps track of your current visit. It lasts up to 2 years.
Using these, Google Analytics records the pages you view, your approximate location (town or region, worked out from your IP address), your type of device and browser, the website that sent you here, and when you click a link to book through Faces Consent (the link's address and wording). It does not record your name, your contact details or anything you type into the contact form, and Google Analytics does not store your IP address. Google provides Google Analytics to me under contract, and may process this information outside the UK, including in the United States, with the safeguards UK GDPR requires. Visit-level data is deleted after no more than 14 months; after that, only anonymous totals remain. See how Google uses information from sites that use its services.
Your choice: you can turn Google Analytics off for this browser with the button below. You can also block or delete these cookies in your browser's settings, or install Google's Google Analytics opt-out browser add-on. The website works exactly the same without them.
If you turn Google Analytics off, the site deletes its Google Analytics cookies and remembers your choice in your browser's local storage (not a cookie), so on every page Google Analytics sends nothing about your visit and sets no cookies. Your browser still downloads the Google Analytics code file, so, as with the fonts, Google sees your IP address when serving it. Clearing this site's data in your browser resets the choice.
Cloudflare hosts the site, so, like any web host, it processes your IP address to deliver the pages to you; its Web Analytics also counts visits, without cookies and without tracking you across other websites. Fonts are loaded from Google Fonts, which means your browser requests those files from Google's servers and Google sees your IP address as part of serving them; see Google's privacy policy. The two Google Analytics cookies above are the only cookies this website sets, and nothing else on the site sends data anywhere.
How long I keep it
- Enquiries that don't become bookings: up to 12 months, then deleted.
- Website analytics (Google Analytics): visit-level data for no more than 14 months.
- Clinical records: a minimum of 8 years from your last appointment, in line with healthcare record-keeping guidance and my indemnity requirements. Records for anyone under 18 would be kept until their 25th birthday.
- Financial records: 6 years after the end of the relevant financial year, as tax law requires.
How it is protected
Records are stored with access controls; clinical records are held on Faces Consent's secure platform and my own protected devices. Access is limited to Lucy.
Your rights
- Access: ask for a copy of the information I hold about you.
- Rectification: have inaccurate information corrected.
- Erasure: ask for deletion. Note that clinical records usually must be retained for the periods above, so this right is limited while those obligations apply.
- Restriction and objection: limit or object to certain uses of your information.
- Withdraw consent: where I rely on your consent, you can withdraw it at any time.
To use any of these rights, email hello@lucysaesthetics.co.uk. I will respond within one month.
Not happy with how your information has been handled? Please raise it with me first. See the complaints procedure. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes to this notice
Any changes will be published on this page with a new "last updated" date.