This notice explains what personal information Lucy's Aesthetics collects when you visit this website, enquire or book, why it is collected, how long it is kept, and the rights you have over it. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, in plain English.
No medical information through this website, please. The contact form is for getting in touch only. Your medical history, suitability and consent are taken in person at your consultation — never through this site. Please don't include health details in an enquiry.
Who is responsible for your information
The data controller is Lucy's Aesthetics, an aesthetics practice run by Lucy, an NMC-registered nurse and independent prescriber, based in Birmingham (B31). Lucy is the only person with routine access to enquiry and client records.
Lucy's Aesthetics is working towards registration with the Information Commissioner's Office (ICO); the registration number will be published here once issued.
For anything relating to your information, email hello@lucysaesthetics.co.uk.
What I collect
If you enquire through this website
- Contact details — your name, and an email address and/or phone number.
- Treatment interest — the treatment area you select, and anything you choose to write in your message.
The contact form does not send anything to a server. It opens a pre-filled message in your own email app, so nothing you type is stored by this website — I only receive what you choose to send by email.
If you message me on Instagram
- Your Instagram handle and the content of your messages. These are held within Instagram (Meta) under their privacy policy, as well as in my record of our conversation.
If you book or become a client
- Booking and consent are handled by Faces Consent, a separate booking and medical-records platform, under their own privacy terms. Health information (your medical history, suitability, consent and treatment records) is collected there and at your in-person consultation — not on this website.
- I keep clinical records of your consultation and treatment as a registered healthcare professional. This is "special category" data under UK GDPR and is handled with extra care.
Why I use it, and the legal basis
- Responding to your enquiry and arranging a consultation. Legal basis: your consent, and steps taken at your request before entering a contract (Article 6(1)(a)/(b)).
- Providing treatment and aftercare once you are a client. Legal basis: performance of a contract (Article 6(1)(b)); for health information, provision of health care by a registered professional subject to a duty of confidentiality (Article 9(2)(h)).
- Meeting legal and professional obligations — medicines legislation, NMC record-keeping standards, tax and accounting rules (Article 6(1)(c)).
- Protecting you in an emergency — for example sharing information with emergency services during a complication (Article 6(1)(d) and Article 9(2)(c)).
I do not send marketing without your prior consent, and you could withdraw it at any time. Your information is never sold.
Who your information is shared with
- Faces Consent — the booking and consent platform, where booking and clinical consent are processed.
- A dispensing pharmacy or prescriber — only where a prescription-only treatment is clinically appropriate and has been assessed in person.
- My indemnity insurer or professional advisers — if needed to respond to a complaint or claim.
- Regulators and authorities — the NMC, courts or other bodies where the law requires it.
Where service providers process data on my behalf, they do so under contract and, if any processing happens outside the UK, only with the safeguards UK GDPR requires.
Cookies and this website
This website sets no cookies and runs no analytics or tracking. Fonts are loaded from Google Fonts, which means your browser requests those files from Google's servers and Google sees your IP address as part of serving them — see Google's privacy policy. Nothing else on the site sends data anywhere.
How long I keep it
- Enquiries that don't become bookings — up to 12 months, then deleted.
- Clinical records — a minimum of 8 years from your last appointment, in line with healthcare record-keeping guidance and my indemnity requirements. Records for anyone under 18 would be kept until their 25th birthday.
- Financial records — 6 years after the end of the relevant financial year, as tax law requires.
How it is protected
Records are stored with access controls; clinical records are held on Faces Consent's secure platform and my own protected devices. Access is limited to Lucy.
Your rights
- Access — ask for a copy of the information I hold about you.
- Rectification — have inaccurate information corrected.
- Erasure — ask for deletion. Note that clinical records usually must be retained for the periods above, so this right is limited while those obligations apply.
- Restriction and objection — limit or object to certain uses of your information.
- Withdraw consent — where I rely on your consent, you can withdraw it at any time.
To use any of these rights, email hello@lucysaesthetics.co.uk. I will respond within one month.
Not happy with how your information has been handled? Please raise it with me first — see the complaints procedure. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes to this notice
Any changes will be published on this page with a new "last updated" date.