Privacy Policy
This privacy policy explains how Refined Medical Aesthetics ("we", "us", "our") collects, uses, stores and protects information about you when you visit our website, contact us, book a treatment with us, use our online face scan or use the Refined app. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
- Data controller: Refined Medical Aesthetics, owned by Rachel Storey, NMC registered nurse and clinic owner.
- Address: Double Row, Seaton Delaval, Whitley Bay, NE25 0PP, United Kingdom.
- Email: [email protected]
- Phone / WhatsApp: 07583 321635
- ICO registration: If you would like to confirm our ICO registration status, please contact us using the details above.
The Refined app, the face scan and our other notices
This policy covers our website and your clinic record. Some services have their own, more detailed notice, which you see before you use them:
- The Refined app: our privacy notice for the Refined app explains in full what the app holds, the choices it asks you to make and how long each record is kept. The app's terms, shop, booking, membership, gift card, rewards and events terms are listed on our terms and policies page.
- The online face scan at scan.refinedmedicalaesthetics.uk has its own privacy notice on that site. The skin analysis runs on your phone. Your photo is only sent anywhere if you separately choose an optional AI overview (see below).
What information we collect
Information you give us directly
- Booking information. When you book a consultation or treatment: your name, email address, phone number, date of birth, address, gender (where relevant), the treatment you're interested in, and any additional information you choose to share with the practitioner.
- Medical information. At your in-person consultation: a medical history, photographs of the treatment area (with your consent), notes about your goals, and consent forms for treatments you go on to receive. This is special-category health data and is held to a higher standard of protection.
- Marketing communications. If you explicitly opt in: your email address, the consent record, and the clinic updates you have asked to receive.
- Payments. When you pay online for a shop order, gift card, event or deposit: the amount, what it was for and a payment reference. Your card details are entered straight into Stripe or Pabau's payment page; we never see or store your full card number.
- Face scan and app choices. If you use the face scan or the app: the goals and comment you choose, your scan readings if you choose to save or share them, and a record of each consent you give or withdraw.
- Direct contact. When you email, phone, WhatsApp or DM us on Instagram: the message you send and any contact details you share.
Information collected automatically when you use the website
- Cookies and similar technologies. See our Cookie Policy for the full list. Non-essential cookies (analytics and advertising) only fire after you give consent on the cookie banner.
- Server logs. Your IP address, browser type, pages visited, and timestamp. Used for security and abuse prevention only; not linked back to you.
How we use your information, and our lawful basis for doing so
| What we use it for | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Booking and delivering treatments to you | Performance of a contract (Art. 6(1)(b)) |
| Holding your medical records and consent forms | Provision of healthcare (Art. 9(2)(h)) |
| Sending you marketing emails after you opt in | Consent (Art. 6(1)(a)). Withdrawable at any time via the unsubscribe link or by emailing us |
| Running our website analytics (after consent) | Consent (Art. 6(1)(a)) via the cookie banner |
| Showing you adverts on Meta (Facebook / Instagram) and Google after you've visited our site | Consent (Art. 6(1)(a)) via the cookie banner |
| Replying to enquiries you send us | Legitimate interests (Art. 6(1)(f)). To respond to a question you've asked |
| Running the Refined app, its shop, rewards and memberships, and sending care and service messages (such as sign-in codes, order and appointment updates) | Performance of a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) |
| Writing an optional AI overview of your face scan, and saving or sharing scan results with our clinical team | Consent (Art. 6(1)(a)) and explicit consent (Art. 9(2)(a)), each asked for separately and never pre-ticked |
| Keeping financial records of treatments paid for | Legal obligation (Art. 6(1)(c)). UK tax law |
Who we share your information with
We only share your information with the third parties listed below, and only for the specific purpose noted. We don't sell your data, ever.
| Third party | What they do for us |
|---|---|
| Pabau (current booking and clinic management system) | Hosts online booking and holds booking details, medical notes, consent forms and marketing preferences. |
| Meta (Facebook / Instagram) | Cookies + Conversions API for advertising and remarketing. Only after you give consent. Personal identifiers are hashed before being sent. |
| Google (Analytics + Ads + Tag Manager) | Cookies for analytics and advertising. Only after you give consent. Anonymised IP only. |
| Microsoft Clarity | Privacy-masked click, scroll and session analytics on the public marketing website. It loads only after Analytics consent and is excluded from the contact page, face scan and booking journey. |
| Stripe | Takes card payments for app shop orders, gift cards, paid events and online payments. Receives your card details (entered straight into Stripe), the amount and our order reference. Stripe also uses some information for its own fraud prevention and legal duties, under its own privacy notice. |
| Brevo | Sends our emails and text messages, including sign-in codes, appointment and order messages, and marketing you have agreed to. Receives your contact details, the message and delivery results (for example, whether a message bounced or you unsubscribed). |
| Anthropic PBC | Only if you tick the separate, optional AI overview box in the face scan or the app: receives your photo, the goals you chose and any comment, to write a short written overview. It does not receive your name, email or account details, does not use the information to train its AI, and deletes it within 30 days (inputs flagged for possible misuse may be kept for up to two years). Processing takes place in the United States under the UK International Data Transfer Addendum and Standard Contractual Clauses. |
| Supabase and Fly.io | Host the Refined app's database, sign-in, private file storage and server, in London. |
| Firebase Cloud Messaging (Google) and Apple Push Notification service | Deliver app notifications if you allow them. Receive a notification token for your phone and a general message, never treatment details. |
| FormSubmit (formsubmit.co) | Forwards email-form submissions from the website to our inbox. |
| SociableKit | Embeds our public Google reviews on the website. Does not handle your personal data. |
| Klarna | Where you pay with Klarna, Klarna handles the payment and is the data controller for that transaction. See Klarna's own privacy notice. |
| Netlify | Hosts the website. Sees standard server logs. |
| Cloudflare | Provides DNS and content-delivery / security in front of the website. |
Some of these providers process data outside the UK, including in the EEA and the United States. Where this happens, we rely on the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an applicable adequacy decision to keep your information protected to UK GDPR standards.
How long we keep your information
- Your clinical record in Pabau (medical history, notes, treatment consent forms). Kept for 8 years after your last treatment, under our records policy.
- Booking records, orders, payments and invoices. Kept for 6 years from the end of the tax year they relate to, to meet UK tax and accounting requirements. A delivery address is kept for 90 days after the order is delivered, cancelled or refunded.
- Your app account. Kept while your account is open. You can delete your account in the app; it is then erased except for records the law requires us to keep, such as invoices, and the record of the terms and consents you accepted (kept for 6 years).
- Face scan photos and results. Your photo stays on your phone unless you choose the AI overview or choose to share it with our clinical team. For an AI overview we hold the photo only while the request is processed and do not store it; Anthropic deletes it within 30 days, as above. Saved or shared scan results, and any photo you choose to share, are kept for at most 12 months, or less if you delete them or withdraw consent.
- Brevo contact record. Kept while you are a client or app user; we ask Brevo to delete it when you delete your account. A minimal record of an opt-out is kept so we never message you again against your wishes.
- Marketing consent and communications. Kept until you withdraw consent, after which your details are removed from the marketing list within 30 days.
- Website analytics data. Kept for up to 14 months in Google Analytics. Microsoft Clarity session recordings are retained for 30 days.
- Server logs. Kept for up to 30 days, then automatically deleted.
Your rights under the UK GDPR
You have the right to:
- Be informed about how we use your data. That's what this policy is.
- Access the personal data we hold about you (a "subject access request").
- Have inaccurate data corrected.
- Have your data erased in certain circumstances.
- Restrict how we use your data in certain circumstances.
- Object to certain uses of your data (especially marketing).
- Move your data to another provider where we hold it under consent or contract.
- Withdraw consent for marketing or analytics at any time. Withdrawing consent does not affect the lawfulness of processing we did before you withdrew it.
To exercise any of these rights, email us at [email protected]. We aim to respond within one calendar month. There is normally no charge.
Cookies and similar technologies
We use cookies and similar technologies to make the site work, to understand how it's used, and (with your consent) to advertise to you. Strictly necessary cookies are always on; everything else is opt-in via the cookie banner you saw when you arrived. You can change your choices at any time via the "Cookie preferences" link in the footer. See our Cookie Policy for the full list of cookies we use.
Children
We do not provide aesthetic treatments to anyone under 18, and we do not knowingly collect personal data from children. Our advertising is targeted only at adults aged 18 and over.
Changes to this policy
We may update this policy from time to time when our services, systems or legal obligations change. The date at the top of this page tells you when it was last revised. Where the change is significant, we'll let you know directly if we hold a contact address for you.
Complaints
If you're unhappy with how we've handled your data, please contact us first. We'll always try to resolve it. If you're still not satisfied, you can complain to the UK Information Commissioner's Office:
- Website: ico.org.uk
- Phone: 0303 123 1113
For the cookies we use and how to control them, please see our Cookie Policy.