Privacy notice for the Refined app

Version: 1.4 · Last updated: 7 October 2026 · Applies to: the Refined app for iPhone and Android, and your app account.

This notice explains what information the Refined app holds about you, why, who helps us with it, how long we keep it and what you can do about it. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

The short version

• Who we are. We are Refined Medical Aesthetics, an aesthetics clinic and skincare shop in Seaton Delaval. We decide how your information is used.
• What we hold. The email address or mobile number you sign in with, what you do in the app (appointments, orders, rewards, your choices) and, because we are a clinic, some information about your treatments.
• Your skin scan runs on your phone. Uploading a photo for an optional AI overview, saving results, sharing with our clinical team and storing a shared photo each need separate explicit choices, and nothing is pre-selected. You choose the AI overview before your scan, by ticking the separate AI box and pressing Continue; every choice starts unticked. Hermes cannot access scans.
• Location is optional. Choose the clinic area or ask us to use your approximate area for today’s UV reading. We remember your area choice on this device. A separate morning SPF reminder choice saves only the rounded area or clinic choice against your account. See section 3.6.
• Our clinic assistant. We use Hermes to help our team run Studio, our staff dashboard. It can use client contact and marketing details and the operational dashboard, but it does not access health information. A staff member must approve anything it sends to clients, publishes or changes for clients. See section 17.
• Marketing is your choice. We may email or text offers for our own similar treatments and skincare after you buy, request or book with us, if we showed you the opt-out and you did not use it. We can also carry over a recorded yes from our clinic system. Push marketing and marketing chosen using treatment or health history need your explicit consent in the app. You can turn each off at any time. Care and service messages stay on.
• Our clinic system is our main record. Your appointments, payments, consultation notes, medical history, consent forms, treatment photos and membership are kept in our clinic system (Pabau), not in the app. The app shows information from it. Our website privacy policy covers your clinical record. This notice also covers information from that record used through the app or Studio. Hermes receives only the non-health information described in section 17. If you give separate written consent, we may show your before-and-after photos on our dermal filler pages (section 10).
• We don't sell your information, and we don't use it for advertising in other companies' apps or websites.
• No tracking by other companies. We count how the app is used ourselves, without Facebook, Google or other trackers. You can choose to share more with the "Help improve the app" switch (section 12).
• You're in control. You can see and change your choices in the app, download a copy of some of your data, and delete your account in the app. A few records have to be kept by law, such as invoices.
• Questions or concerns? Contact us at [email protected]. You can also complain to the Information Commissioner's Office (ICO).

Contents

1. Who we are
2. What this notice covers
3. The information we hold
4. Health information
5. The skin scan
6. Why we use your information, and our lawful basis
7. Messages: care and service messages, and marketing
8. Google reviews and review points
9. Your birthday and your age
10. Results photos on our dermal filler pages
11. Help and feedback
12. App statistics
13. Who we share information with, and transfers outside the UK
14. How long we keep information
15. Your rights, and how to use them
16. Children
17. Automated decisions and profiling
18. How we keep your information safe
19. What the app stores on your phone
20. Complaints
21. Changes to this notice

1. Who we are

The controller of your information (the organisation responsible for it) is:

• Refined Medical Aesthetics, a sole trader clinic
• Address: Double Row, Seaton Delaval, Whitley Bay, NE25 0PP, United Kingdom
• Email for privacy questions: [email protected]
• Phone: 07583 321635

Our clinical lead is an NMC-registered nurse. Your treatments are carried out by our qualified practitioners, and your booking tells you who your practitioner is.

We have not appointed a Data Protection Officer. The law does not require one for a clinic of our size, because we do not process health information on a large scale. Questions go to the contact details above.

2. What this notice covers

This notice covers the Refined app, your app account and how we use information in Studio, our staff dashboard, including through Hermes, our clinic assistant. That includes: signing in, linking the app to your clinic record, appointments and booking in the app, your course tracker and Skin Plans, the shop, gift cards and clinic credit, memberships, points and rewards, referrals and prize draws, the wallet card, events, the skin scan, today’s UV reading, messages and notifications, results photos shown with your consent, help and feedback, app statistics, and the clinic assistant described in section 17.

Our clinic system is our main record. Your appointments, payments and deposits, forms and consents, clinical records and membership are held in our clinic system, Pabau. The app shows information from it and passes your requests to it, such as a booking. If the app and Pabau show something different, Pabau's record is the one we rely on, and you can ask us to correct either of them (section 15).

Your clinical record. We keep your consultation notes, medical history, consent forms and treatment photos in Pabau. Our website privacy policy explains how we keep and use that record for your clinical care. This notice also covers information from it used through the app or Studio, and results photos you agree we may show on our dermal filler pages (section 10). Hermes does not access your clinical record or health information.

It does not cover:

• Our website (including the online skin scan on the website) and its cookies. See the website's own privacy and cookie policies.
• Other companies' services you choose to use, such as Google (if you leave a review), WhatsApp (if you message us), Klarna (if you choose to pay later) or Apple and Google Wallet. They have their own privacy notices.

3. The information we hold

3.1 Information you give us

• Sign-in details. The email address or mobile number you sign in with. We send a one-time code to it; the code expires after a few minutes and we don't keep it.
• Your acceptance of our terms and this notice. Which versions you accepted and when, with your phone type (iPhone or Android) and app version.
• Your choices. Your marketing choices for each channel and for personalisation (including consent, any purchase or booking notice, a recorded clinic choice we carried over, the wording and when it was recorded), your choices about updates from the clinic and extra aftercare content, whether you allowed notifications, and whether you asked not to be invited to leave reviews.
• Appointments and requests. The treatment and time you choose, the price and payment option you were shown, waiting list requests (treatment, preferred days and times of day), whether you are running late or have arrived, and offers of a time that you accept.
• Shop orders. What you buy, how you want to collect it or have it delivered, and, for local delivery, the recipient's name, address and any delivery note.
• Gift cards. For a gift card you buy: the recipient's name, your name as the sender, your message, the design, the delivery date, and the recipient's email address or mobile number (kept only until the card has been sent).
• Your birthday, if you choose to give it. Day and month only, never the year. See section 9.
• Your age confirmation. That you have confirmed you are 18 or over.
• Skin scan choices and results, if you choose to save them. See section 5.
• Help and feedback. The topic, your message and any rating you give. See section 11.

3.2 Information created as you use the app

• Your account number and the state of your account.
• Appointments. Your appointments at the clinic, copied from Pabau for 30 days back and 90 days ahead: date and time, status, the treatment, who is seeing you, and whether your forms are complete. Notes are never copied into the app.
• Your care in the app. Your course tracker (which sessions you've had and when the next is due), Skin Plans your practitioner sends you and whether you accepted them, aftercare steps and what you've marked as done, and which aftercare leaflets are available to you.
• Orders and payments. Order history, amounts, payment status, refunds, invoices (which show the name and address given for the invoice), and the payment reference from our payment provider. We never see or store your card number.
• Clinic credit and gift cards. Your clinic credit history and balance. For gift card codes, we keep only a scrambled fingerprint and the last four characters, so nobody at the clinic can see a code once it has been sent.
• Membership and rewards. Your membership tier and status (from Pabau), points history, offers and rewards you have received or used, check-ins at the clinic, milestones (such as your fifth appointment), events you've signed up for (and, for a paid event, the payment), and stories you've seen.
• Prize draws. Your entries in each draw (free and referral entries). If you win, what we need to check you can receive the prize (proof of age, identity and address) and to deliver it.
• Your skincare routine, if you use the routine tracker: the days you logged morning and evening care, and any reminder times you set.
• Wallet card, if you add one: see section 13.
• Messages. A record of the care, service and marketing messages we sent you (the type of message, when, and whether it was delivered), and the messages in your in-app inbox, including personal messages from our team.
• App statistics. See section 12.
• Technical information. Your phone type and app version, a notification token for your phone (stored encrypted), and the internet (IP) address your phone connects from, which our systems use to stop misuse and attacks.

3.3 Information from our clinic system (Pabau)

To link your app to your clinic record we look you up in Pabau using the email address or mobile number you have just proved is yours. We link automatically only when exactly one client record matches. If more than one could match, a member of our team checks it; the app never guesses. We keep your Pabau client number, how the link was made, and a scrambled (hashed) copy of the contact detail used, not the detail itself.

Once linked, we also read Pabau's recorded email and text marketing choices. We carry over a recorded yes only if you have made no earlier choice for that channel in the app. We do not use its newsletter, phone or post flags as consent; section 7 explains this. The app does not write your marketing choices back to Pabau.

Once linked, the app reads from Pabau: your appointments, your membership, treatments you have completed (for your course tracker), and, when needed to address a message or show your card, your first name and contact details. Where possible the app does not keep a second copy of your name and contact details; it reads them from Pabau when needed. When you book in the app, the booking is made in Pabau, which is our main record.

3.4 Information from other people

• Gift cards. If someone buys you a gift card, they give us your name and your email address or mobile number so we can send it. We use them only to deliver the card, and we remove your email address or mobile number once the card has been sent.
• Referrals. If you join through a friend's referral code, we record that you were referred, so that your 10% off, your friend's points and any prize-draw entry can be given. Your friend only sees how many referrals are pending or confirmed, never who used their code or anything about your treatment.
• Our team. Our team may record, for example, that you have an open complaint, a reaction or a safety concern, or that you did not attend an appointment. This stops review invitations and marketing messages to you while it is open.

3.5 What the app does not collect

• Your precise location. For “Today’s skin”, your device rounds your location before sending it to us, and only when you choose to use it (section 3.6). If you add the wallet card, your phone may show it on your lock screen near the clinic; your phone works that out on its own and we never receive your location from that wallet feature.
• Your contacts or photo library, other than an image you deliberately select for the scan or attach to feedback. Scan uploads need the separate choices in section 5.
• Your face measurements or face geometry. A photo is uploaded only under the separate optional choices in section 5.
• Your face or fingerprint data from app lock. App lock uses your phone's own Face ID, Touch ID or fingerprint. We only learn whether the check succeeded, and we don't even record that.
• Your card number. Card payments go straight to our payment provider.
• Your year of birth.

3.6 Today’s skin: your UV area

Your choice. You can choose the clinic area without sharing your location. If you tap “Use my location”, your device asks for permission. We round the reading on your device to a 0.1° grid before sending it to our server. This is an approximate area, about 11 km north to south; its width varies. We round it again on the server. We use the area only to fetch UV information from MET Norway (the Norwegian Meteorological Institute). We do not track your movements. The app reuses your chosen area until you change it; it does not ask for a fresh device location in the background.

What leaves your device. The location information sent to our server is limited to the rounded coordinates. The request also uses your normal sign-in session and technical connection information. Your device may supply a location reading up to 10 minutes old; we do not store the precise reading. Our server sends the rounded coordinates to MET Norway, identifying our app but not you. It does not send your name, contact details, account number, device location permission or reminder choices to MET Norway. MET Norway receives the request from our server, not directly from your phone.

Ordinary UV readings. We do not attach your selected area to your account merely because you ask for a UV reading. The existing bounded hourly cache and request limiter operate without an account-location history. The UV code does not log coordinates or include them in analytics.

Your optional morning push reminder. The separate unticked choice uses wording morning-spf-v1.0: “Send me a morning SPF reminder when UV is forecast to reach 3 or above. Store my approximate area (a 0.1° grid cell) or use the clinic area for this reminder. I can turn it off and delete the saved area at any time.” We save only the rounded cell or the clinic-area choice, consent version and time, and the minimum daily delivery state against your account. We do not retain precise coordinates or track your movements. Device permission alone is not consent to this reminder.

At 07:30 Europe/London, our server obtains the forecast daily maximum for each distinct opted-in cell and caches the result. For UV 3 or higher, it queues at most one care push per account per day, subject to quiet hours and device permission. There is no product promotion. Android delivery uses FCM; iPhone shows “coming soon” while its push service is unavailable. Our UV forecasts come from MET Norway, which publishes its forecasts as open data that businesses may use (licence CC BY 4.0); the UV card credits it. Its UV figure is for a clear sky, so on a cloudy day the real UV is lower.

Turning off the morning reminder deletes the account-linked area and prevents an unsent reminder. Account erasure removes it too. The shared daily forecast cache contains no account identifier. Ordinary in-app UV device choices remain separate: the selected cell or clinic choice and dismissed reminder date stay on that device until replaced or local storage is cleared; signing out clears the current reading but not those choices.

Our lawful basis. Consent under Article 6(1)(a) for the optional reminder and approximate area; legitimate interests under Article 6(1)(f) for location-free abuse prevention.

4. Health information

Because we are a clinic, some information in the app is about your health, for example which treatments you have booked or had, your course progress, your Skin Plan, aftercare, a reaction or safety concern noted by our team, and saved or shared skin scan results, goals, comments, written overviews and optional photos. The law calls this "special category" data and it gets extra protection.

We use health information only:

• to provide and manage your care. This is allowed under UK GDPR Article 9(2)(h) (health care) and the Data Protection Act 2018, Schedule 1, Part 1, paragraph 2. This information is used by, or under the responsibility of, a registered health professional, and everyone who uses it owes you a duty of confidentiality;
• with your explicit consent for the separate skin scan AI overview, saving, clinical sharing and optional photo sharing (Article 9(2)(a)); see section 5;
• with your explicit consent for personalised offers and reminders using treatment or health history (Article 9(2)(a)). A separate, optional, unticked choice on Stay in touch asks for this expressly: "Use my treatment history to personalise offers and reminders". We record its own purpose, wording version and time, and you can change it independently from each marketing channel. A purchase, booking or carried-over clinic choice does not give us this permission;
• with your explicit consent for showing your before-and-after photos on our dermal filler pages (Article 9(2)(a)); see section 10;
• where needed to make, defend or respond to a legal claim (Article 9(2)(f)).

Hermes, our clinic assistant, does not access or change health information. This includes medical forms and answers, consultation and clinical notes, treatment records, aftercare answers and photos, skin scan results and history, clinical Skin Plans, allergies, medications and contraindications. It cannot access clinical-review queues or private staff notes that may contain health details. Staff approval cannot give it access. Your separate scan and marketing choices still apply to our team’s use of your information.

Prescription-only treatments are never priced, discounted or rewarded in the app, and our messages never name the medicine or show a price.

5. The skin scan

The optional scan describes how skin appears in this photo. It is not a medical assessment or a decision about treatment suitability. There is no age estimate, beauty score, ranking or comparison with other people. Treatment suitability is assessed in consultation.

On your phone. Before using the camera, you choose your goals and may add a comment of up to 500 characters. Existing onboarding concerns may be selected for you to review. You tap Continue in the app and then Ready to capture when ready (or Take photo if the face guide is unavailable), or choose an existing photo. The app controls capture; analysis and concern markers then run in an isolated frame on your phone, without access to your app account or the camera. Face measurements and geometry never leave it. The photo and working data are cleared on retake, leaving the scan, sign-out or when you return after ten minutes in the background. No microphone is requested. The “Today | Illustration” control changes only an on-device illustration, labelled “Illustration, not a prediction of your results”; it does not generate a new face image or soften expression lines.

Optional AI overview: scan-ai-v1.2. A separate unticked choice on the scan's start screen shows: “Tick this box if you'd like an AI overview.” Its “What happens to my photo” link opens notice face-scan-ai-overview-v1.2, which is recorded with the label version. Nothing is sent unless you tick the optional AI box and press Continue. You can request up to three overviews per email or mobile. We send the photo, chosen goals and optional comment through our server to Anthropic PBC, our processor under its Data Processing Addendum. We do not send your name, email or account ID from your account, or face landmarks or geometry. A face photo can identify you; please keep names and contact details out of your comment. US processing is covered by the UK International Data Transfer Addendum and Standard Contractual Clauses (SCCs). Anthropic does not use these inputs or outputs for training; we do not submit feedback or join training opt-in programmes.

Anthropic deletes API inputs and outputs within 30 days. Inputs flagged for possible misuse may be kept for up to two years, and the safety scores used to assess misuse for up to seven years. Information may be kept longer where the law requires it. We hold the uploaded photo only in request memory, without logging or storing it. Anthropic returns structured observations, which we check and turn into Refined-written wording; it does not write unrestricted advice. The on-phone analysis continues to draw the markers. This overview is not a diagnosis.

We briefly keep the structured observations with an account-bound verification reference, valid for 30 minutes and removed by the scan deletion worker after expiry. We keep only the structured overview in a saved scan record, and only if you separately save or share it. To scan without it, press Continue without it. Each new scan asks again. If an overview cannot be written, trying again needs you to press Try again. To withdraw afterwards, stop requesting overviews, delete saved scans or use Stop sharing in Profile > Privacy and data, or contact us. We cannot undo a completed request or promise immediate deletion at Anthropic; its retention periods and exceptions still apply. Refusing does not affect your scan or care. Read the full AI overview notice.

Saving: scan-save-v2.0. A separate unticked choice says: “Save my scan results, goals, comment and any AI overview to my account. My photo stays on this phone unless I separately choose to share it.” With the owner’s DPIA saving switch enabled, we store your ten concern readings, bands, confidence and coarse area levels, chosen goals, optional comment and any written overview. We never store face geometry, landmarks, heat maps or illustration images. Your saved record remains private until you share it. Historical numbers-only consent does not authorise the new information.

Sharing: scan-share-v1.0. A separate unticked choice says: “Share my scan results, goals, comment and any AI overview with the Refined clinical team. I can stop sharing and delete this any time.” With consent, authorised clinical reviewers can see the saved information and its link to your booking intent or help request. A booking, help request or saved scan by itself is not consent. Reception, other non-clinical staff and Hermes cannot access it. Every clinical view is logged. A consultation note subsequently written in Pabau is a separate clinical record.

Photo sharing: scan-photo-share-v1.0. A second unticked choice says: “Also share my photo with the Refined clinical team. Keep it for up to 12 months, unless I delete it or withdraw sooner.” We store the photo in a private Supabase bucket, with signed links that expire after 60 seconds, issued only after a clinical reviewer’s access check. Every authorised photo access is logged. Concern markers displayed with the photo use saved coarse areas, not face geometry. Declining photo sharing still permits the written results to be shared.

Your control and retention. You can delete a scan, use Stop sharing, or withdraw consent at any time. Stop sharing ends clinical access in both our current and older scan systems. Access is removed immediately; a previously issued photo link can continue for up to 60 seconds, and our deletion worker removes the object. Saved records and shared photos expire after at most 12 months; the clinic can shorten the period. Erasing your account deletes these records and queues file deletion. Under-18 use is not allowed.

Purpose and basis. Scan information supports your own understanding and a consultation with our team. It is never used for advertising, marketing targeting, analytics or ranking. On-device educational suggestions use your goals and readings with the clinic’s catalogue; they do not determine suitability. We rely on consent under Article 6(1)(a) and explicit consent under Article 9(2)(a) where the information relates to health. AI processing, saving, clinic sharing and photo sharing each require their own consent. Hermes cannot access any scan information.

6. Why we use your information, and our lawful basis

Where we rely on legitimate interests, we must weigh our needs against your interests and rights. The balancing note for Hermes is in section 17. You can ask us for details, and you can object (see section 15).

7. Messages: care and service messages, and marketing

Care and service messages stay on. We send messages needed for appointments, preparation and aftercare, orders and refunds, payments, events you have already booked, gift cards and similar services you asked for. These are separate from marketing and need no marketing consent. We rely on our contract with you or our legitimate interests in providing the service, and the health-care condition where needed. They never include offers or clinical detail. Your phone still controls whether push notifications are allowed.

Marketing includes offers, news, invitations to new events, and reminders intended to encourage a purchase or booking. Our team prepares the messages and approves any client-facing wording drafted with Hermes. Some messages are scheduled or sent automatically. We use the following rules.

Offers after a purchase, treatment request or booking

At shop checkout and when you request or book a treatment in the app, we show this notice under the pay or confirm button:

We'll send you occasional offers about our treatments and skincare by email and text.

Below it is an unticked box: Don't send me offers. If you leave it unticked and complete the shop payment, or submit the treatment request or booking, we may send offers by email and, if your account has a verified mobile number, by text. An unpaid shop order does not turn marketing on. Ticking the box records a refusal.

This is the soft opt-in under PECR regulation 22(3). For UK GDPR we rely on our legitimate interests in promoting our own similar products and services. We obtain your details in connection with a sale or negotiations for a sale, offer a clear way to refuse when we collect them, and include an easy opt-out in every marketing message. This covers only our own similar treatments and skincare. We never use treatment or health history to choose these messages, and it never allows push or WhatsApp marketing.

A previous refusal or withdrawal for a channel always blocks this automatic route. Buying or booking again does not turn that channel back on. You can give fresh consent yourself later if you wish.

A recorded yes from our clinic system

When your app account is linked to your clinic record in Pabau, we may carry over a recorded yes for email or text marketing, separately for each channel, only if you have made no earlier app choice for it. We rely on that recorded consent, not on soft opt-in. We never treat Pabau's newsletter, phone or post setting as consent. This does not include push, WhatsApp or permission to use treatment or health history for marketing. We explain any carried-over choice when you first open Profile > Notifications and marketing, with a way to turn it off.

Your one-tap choice in the app

The Stay in touch step says:

Yes, send me offers and news by email, text and WhatsApp, and push. I can turn any of these off any time. Care and service messages continue.

Tapping Yes, keep me posted gives consent for email, text and WhatsApp, and push marketing. We rely on UK GDPR Article 6(1)(a); email and text also use consent under PECR regulation 22. There are no pre-ticked marketing choices.

A separate optional box, unticked by default, says Use my treatment history to personalise offers and reminders. Only explicitly ticking it gives permission to use treatment history for this purpose, under Articles 6(1)(a) and 9(2)(a). Either Stay in touch button saves this separate choice only if you tick it. We record its purpose, wording version and timestamp, and you can change it independently in preferences. Without this permission, our offers and marketing reminders stay generic. Previous bundled marketing choices do not grant it.

Tapping Not now records no marketing channel decision and does not change a channel choice already on record. Leaving the separate history box unticked does not change an existing history choice. Either button then asks your phone for push permission so we can send care messages. Allowing notifications on your phone is not marketing consent. Push marketing needs both explicit in-app consent and phone permission, as required by Apple guideline 4.5.4. Personalised offers and reminders need both consent for that channel and the separate personalisation choice; neither a soft opt-in nor a carried-over clinic yes is enough.

Changing your choices

Profile > Notifications and marketing shows each channel's current state and why it is on: your consent, a client soft opt-in or a recorded clinic choice. Turn a channel off with one tap. It takes effect straight away and suppresses marketing still queued for that channel. Turning off personalisation suppresses queued personalised marketing too. An automatic purchase, booking or Pabau import cannot override an earlier refusal or withdrawal. Every marketing email has an unsubscribe link and every marketing text offers STOP. Care and service messages continue.

We keep a record of the choice, its source and basis, the notice or wording version, and when it was recorded. A new wording does not silently widen an earlier permission.

Quiet hours. We do not send offers between 8pm and 9am UK time, and we do not send push notifications between those times. We also limit how many marketing notifications we send.

Clinic updates and aftercare. We post updates in the app's inbox. You choose whether to receive optional news and offers, whether to be told by push, and whether to see optional extra aftercare content. Essential care and service messages remain separate.

WhatsApp. Tapping our WhatsApp button opens WhatsApp with a short message for you to send; it contains no scan results or other personal details. We may use WhatsApp for care you already have with us. Version 1.2 of Stay in touch expressly includes WhatsApp. The Texts and WhatsApp preference covers WhatsApp only if your latest text consent used wording naming it. Version 1.1 text consent, soft opt-in and imported Pabau flags do not authorise it. To stop texts and WhatsApp together, turn off that preference. To stop WhatsApp, reply STOP or tell us; our team records the refusal. Only a new explicit yes under wording naming WhatsApp covers it again. WhatsApp is run by WhatsApp (part of Meta), under its own privacy notice.

Our messaging provider, Brevo, keeps a small contact record: your email address, app account number, each channel's current marketing state and basis, and flags controlling whether personalised campaigns are allowed. We include your first name only if marketing is allowed on at least one channel. Brevo never receives your date of birth, treatments, appointments or clinical record. Soft-opt-in channels are excluded from personalised campaigns. Opted-out channels are blocked for marketing. We do not track email opens or clicks.

8. Google reviews and review points

After an appointment that actually took place, we may invite you to leave a Google review. We invite everyone who is eligible in the same neutral way, whether or not they seem happy.

• Points for reviewing. If you go to our Google review page from the app, we add 100 points to your account, at most once every 3 months, under our rewards terms. You get the same points whatever you write and whatever rating you give. Before you leave the app, we show you a short notice explaining this, and we record which version of that notice you saw.
• Please say so in your review. Because you receive points, we ask you to start your review with this sentence: "I received 100 reward points from Refined Medical Aesthetics for leaving this review. The points did not depend on my rating or what I wrote."
• What we can see. We record that you went to Google's review page and came back. We never see, ask for or store your rating or what you write. Google does not tell us whether you posted a review.
• When we don't invite you. We don't invite you, and no points are given, while a complaint, a reaction, a safety concern or a missed appointment is open, or if you have chosen "Never ask me again".
• Google. Your review, and anything you do on Google's site, is controlled by Google under its own privacy notice.

9. Your birthday and your age

Your birthday (optional). You can tell us your birthday in the app so we can send you a birthday treat. We keep the day and month only, never the year. We use it to put a birthday treat in your app and, where marketing is allowed on a channel under section 7, to send you a birthday message on that channel. Our team's daily list may show that your birthday is coming up, and we send a birthday message only on a channel where marketing is allowed under section 7. You can remove your birthday at any time. If we later copy your birthday from your clinic record, we will copy the day and month only.

Your age. The app and our treatments are for adults. We ask you to confirm that you are 18 or over when you sign up and before you use the skin scan. We do not ask for your date of birth in the app. See section 16.

10. Results photos on our dermal filler pages

Your treatment photos are part of your clinical record, and we never show them to anyone outside your care without your permission. The one exception is if you choose to let us show your before-and-after photos on the dermal filler pages of the app and our website.

• Only with your separate written consent. After a dermal filler treatment, we may ask whether you are happy for this. It is entirely your choice, and saying no makes no difference to your care. We record your consent and the photos it covers.
• How we show them. As taken, never retouched or filtered, with the same lighting and angle before and after, labelled "Results vary. Photos shared with consent.", and never with your name.
• Where we never use them. Never for prescription-only treatments, and never in adverts, on social media, or in emails, texts, WhatsApp messages or push notifications.
• Who can see them. Anyone who uses the app or visits our website. Once a photo has been shown, we cannot control copies other people may have saved.
• Changing your mind. You can withdraw your consent at any time by telling us or emailing [email protected]. We then remove the photos from the app and website within 30 days. Your clinical record is not affected.
• Our lawful basis. Your consent and, because the photos show the result of a treatment, your explicit consent (UK GDPR Articles 6(1)(a) and 9(2)(a)).

11. Help and feedback

You can send us a question, a problem or feedback from Help in the app.

• What we collect. The topic you choose, your message, any rating you give, and your account, so we can reply to you. If the app lets you attach a screenshot, we keep that too. Please don't include medical details: for advice about a treatment or a reaction, call the clinic directly.
• Who sees it. Your message goes to the help inbox in our staff system, where our team (the people the clinic authorises) can read it, record its progress and add notes. We reply by email or WhatsApp. We record who handled your message, when and what they did, and we may keep a copy of our reply.
• Why. To answer you and to improve the app and our service (legitimate interests, UK GDPR Article 6(1)(f)). If you choose to tell us about your health, we use it only to deal with your message and your care (Article 9(2)(h)).
• How long. We keep your message, our notes and the record of our replies for 2 years after your request is resolved, and screenshots for 90 days. Deleting your account deletes them sooner.

12. App statistics

We want to know whether the app works well, for example how many people finish a booking and where they get stuck. We do this ourselves, in a privacy-friendly way.

• Counts from our own systems. Our server counts things it already records to run the app, such as a booking made or an order paid. We use them as totals for statistics. We rely on legitimate interests for this (UK GDPR Article 6(1)(f)).
• "Help improve the app" (optional). If you switch this on in Profile > Notifications and marketing, the app also tells us which screens and features you use, with your phone type, app version and a random identifier that is not your name or contact details. It starts off. If you switch it off, we stop collecting straight away. We rely on your consent for this (Article 6(1)(a) and PECR regulation 6).
• No tracking by other companies. We don't use Facebook, Google Analytics or any other company's tracking or advertising tools in the app. Your statistics are never sold or shared with other companies, never used for advertising, and never include your skin scan results.

13. Who we share information with, and transfers outside the UK

We share information only with organisations that help us run the app, and only what each one needs. They act on our instructions under written contracts, unless we say otherwise below. We never sell your information.

Other companies you choose to use, which make their own decisions about your information (independent controllers): Klarna, if you choose to pay later; Google, if you leave a review; WhatsApp, if you message us or we message you; Apple and Google, as the providers of your phone and app store.

We may also share information with our professional advisers and insurers, with regulators such as the Nursing and Midwifery Council, and with the police or courts, where the law requires or allows it; and with a buyer if the business is sold, in which case we will tell you.

Transfers outside the UK. Some of these providers, or their support teams, are based outside the UK, including in the European Economic Area and the United States. Before information goes outside the UK, we must confirm a safeguard UK law allows: the UK's adequacy regulations (for example for the EEA), the UK Extension to the EU-US Data Privacy Framework where the company is certified, or the UK International Data Transfer Agreement or Addendum. You can ask us for details.

14. How long we keep information

We keep information only for as long as we need it. The main periods are below.

15. Your rights, and how to use them

You have the right to:

• be told how we use your information (this notice);
• get a copy of your information (a "subject access request");
• have wrong information corrected;
• have your information deleted, where there is no good reason for us to keep it;
• restrict how we use your information in some cases, for example while we check a complaint about accuracy;
• object to our use of your information where we rely on legitimate interests. You can always object to marketing, and we will stop;
• take your information with you in a common electronic format, where we use it because of a contract with you or your consent;
• withdraw your consent at any time, where we rely on it. This does not affect what we did before you withdrew it.

You can object to Hermes using your information for our legitimate interests by emailing [email protected] or asking at the clinic. Tell us about your situation so we can consider it. We must stop that use unless we can show compelling legitimate grounds that override your interests and rights, or need it for legal claims. Marketing objections are unconditional: we stop using your information for that marketing.

In the app you can:

• change your marketing choices: Profile > Notifications and marketing;
• see, stop sharing or delete your skin scan results: Profile > Skin scans, or Profile > Privacy and data;
• download a copy of the updates and messages we have sent to your inbox in the app: Profile > Privacy and data export. For a full copy of everything we hold, ask us;
• change today’s UV area back to the clinic area, or withdraw the morning push reminder and delete its saved area on Today’s skin (section 3.6);
• stop review invitations: "Never ask me again" on the review screen;
• switch "Help improve the app" on or off: Profile > Notifications and marketing;
• stop texts and WhatsApp together in Profile > Notifications and marketing; to stop WhatsApp, reply STOP or tell us;
• delete your account: Profile > Privacy and data > Delete account. You type DELETE to confirm.

When you delete your account, it closes straight away and you are signed out. Within a few minutes the app erases what it holds about you: your notification settings and notification tokens, your birthday and 18+ answer, skin scan results, the link to your clinic record, baskets, routine logs and product reminders, quiz and engagement activity, event places, Skin Plans and course history, aftercare records, check-ins, membership copies, appointment copies, waiting list entries and offers of a time, help and feedback messages, the updates and messages in your inbox, and your contact record at our email provider. Queued messages are cancelled, wallet cards are cancelled, and your referral code stops working. Any files, such as a screenshot you attached or a voice note in your inbox, are removed by our team within one month. Your sign-in email or mobile number is removed from our sign-in system within 7 days. Your points history, offers you used, review invitations and referral records are kept only as anonymous totals, under a random number that is never linked back to you. A delivery address is removed once that order is delivered, cancelled or refunded. We keep only what we must, for the periods in section 14: orders, payments and invoices for tax (these include the name and address given for an invoice), proof of what you agreed to, and a record that the deletion happened. Gift cards you bought keep their amounts and dates, but your names and message are removed. Your clinical record in Pabau is not deleted by the app: please ask us about it.

The UV choices stored on your device are separate from your account and are not removed by signing out. Clear the app’s local storage to remove them (section 3.6). The handling of any client information in Hermes records must be confirmed before launch (section 14).

To withdraw your consent to showing results photos, tell us or email [email protected] (section 10).

To use any other right, email [email protected], call 07583 321635 or ask at the clinic. We may need to check it's you, usually by asking you to use the app or reply from the contact details we hold. We will respond within one month. If your request is complex, we may extend this by up to two further months, and we'll tell you why. There is normally no charge.

Some rights have limits. For example, we may need to keep clinical records and invoices for legal reasons even if you ask us to delete them, and we will tell you if this applies.

16. Children

The app is for adults aged 18 and over. We do not offer treatments to anyone under 18 and we do not knowingly collect information about children. If you tell the skin scan you are under 18, it will not save any results and deletes any it holds. If we learn that someone under 18 has an account, we will close it and delete their information, except anything we must keep by law.

17. Automated decisions and profiling

We do not make decisions about you by automated means that have legal or similarly significant effects.

Hermes, our clinic assistant

We use Hermes, an AI assistant, to help our team run Studio. It helps with campaigns, offers, events, stories and news, the shop and stock, gift cards, loyalty, Rituals Club memberships, referrals, reviews, clinic settings and aggregate reports. It can use client contact and marketing basics when needed for that work. Hermes never sees health information.

Health information is excluded. The system refuses health forms, medical questionnaires and answers, consultation and clinical notes, treatment records and prescription-only assessments, aftercare and care-journey answers and photos, face-scan results, images and history, clinical Skin Plans, contraindications, allergies, medications, clinical-review queues and staff notes that may contain clinical content. Neither the assistant nor a staff approval can override this restriction.

Where a screen combines health and operational information, the database supplies a restricted version for Hermes. Appointments show dates, times and a generic service category, without treatment names or health-form status. Client views and orders omit treatment history, clinical content and private notes. Reports contain aggregate, de-identified numbers. Staff with the appropriate permissions keep their existing views.

Marketing choices. Hermes cannot read or change the treatment-history personalisation choice. Hermes cannot choose clients using treatment history or health information, even if personalisation consent exists. Its audience rules may use only visit recency, membership tier, birthday month, consent status and spend band. Marketing consent and channel restrictions still apply.

A staff member stays responsible. Hermes can prepare private drafts. It cannot send anything to clients, publish, change prices, or issue points, credit or refunds without a separate staff member approving the request in Studio. The system enforces this. Hermes cannot approve its own request. Every access is logged, including refused calls. The log records the assistant, action, time, outcome and any approval reference. Reads of client records also record which client was accessed.

An approval record keeps the exact proposed change, its preview and affected records, the staff decision and any note, and the outcome. Hermes receives a restricted status view; private staff decision notes and detailed snapshots are withheld. These records can contain personal information. The seven-day approval deadline does not delete them. Section 14 explains their retention and deletion; contact us about any record you want to exercise your rights over.

Third-party AI services. Information needed for an authorised task is processed by the AI services configured for our clinic assistant. Health information remains excluded. The provider terms and retention for this separate assistant are available from us on request. The optional scan overview has its own named processor, consent and retention rules in section 5. Section 14 explains records we keep ourselves.

Our lawful basis. We rely on legitimate interests in running a safe, well-organised clinic (Article 6(1)(f)). The benefit is helping staff prepare work and manage the operational dashboard. We must balance that against the risk of exposing private information to AI services, inaccurate outputs and uses clients would not expect. We exclude health information, limit other information to what the task needs, require staff approval for client-facing actions, log every access and assess the provider terms and retention before use.

Hermes and its AI providers do not receive shared skin scan results or other health information through this integration. Marketing still follows section 7. This notice does not widen your separate choices about saving and sharing scan results.

You can object to this use of your information as explained in section 15. Hermes does not make clinical decisions or decisions with legal or similarly significant effects on its own.

We do use some simple, automatic rules:

• Skin scan suggestions. After a scan, the app suggests treatments and products to talk through with your practitioner, based on your focus areas. This is worked out on your phone. It is not a diagnosis and does not decide whether a treatment is suitable; only your practitioner can, at a face-to-face consultation.
• Reminders. For example, when a course session or a refresh may be due, or when a product you bought may be running low. Marketing reminders follow section 7. If we use treatment or health history to choose one, we need explicit personalisation consent and consent for that channel; soft opt-in does not cover it.
• Our team's daily list. Each morning our staff system lists clients who may welcome a message (for example, a course session to book, or no appointment for six months). Our team decides whether to contact anyone. For a prescription-only treatment, a reminder is only ever an invitation to book a review: it never includes a price or an offer, and our messages never name the medicine.

You can object to any of this, and to any use of your information for marketing, at any time.

18. How we keep your information safe

• Access is limited. Clients can reach only their own information. Our team signs in with a password or code and an authenticator app, and each person sees only what they need. Every view of shared skin scan results by our clinical team is recorded. Hermes has a separate identity and every access is logged. An owner can pause its access. Database access rules exclude health information from Hermes, including shared scan results (section 17).
• Built-in protections. Database rules stop one person's information being read by another, and they are checked by automated tests.
• Less information to lose. We avoid keeping copies we don't need. For example, a scan photo leaves your phone only under its separate optional permission, gift card codes are kept only as scrambled fingerprints, notification tokens are stored encrypted, and card details go straight to Stripe.
• Secure connections. Information travels between your phone and our systems over encrypted connections, and we choose providers that encrypt the data they store for us.
• Sessions end. You stay signed in for up to 30 days, or until 14 days without use, then sign in with a new code. You can add Face ID or fingerprint app lock on your phone.

No system is perfectly secure. If something goes wrong that puts you at high risk, we will tell you without undue delay, and we will report it to the ICO where the law requires.

19. What the app stores on your phone

The app stores a small amount of information on your phone so it can work: your sign-in session, your app lock setting (in your phone's secure storage), and working data for an active scan in the app’s memory. The active scan can include the photo, goals, comment, results and optional overview; it is cleared as described in section 5, and is not an automatic offline upload queue. This is strictly necessary to provide the app, so it does not need your consent. The app contains no advertising trackers and no analytics tools from other companies (section 12). If you switch on "Help improve the app", the app keeps a random identifier on your phone for that purpose only, with your consent.

If you choose a UV area, we also store your rounded area or clinic choice on this device. The reminder setting and last dismissal date stay here too. These values have no automatic expiry, survive sign-out and are separate from your account. Section 3.6 explains how to replace or clear them. This optional storage is separate from the essential session storage above.

20. Complaints

If you are unhappy with how we have handled your information, please tell us first at [email protected]. We will acknowledge your complaint within 30 days and try to put things right.

You can also complain to the Information Commissioner's Office (ICO):

• Website: https://ico.org.uk/make-a-complaint/
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

21. Changes to this notice

We will update this notice when the app or the law changes. Each version has a number and a date. When we publish a new version, the app shows you what has changed. If the change is significant, the app will ask you to read and accept the new version before you carry on. Earlier versions are available on request.