Privacy Policy

At Polished Beauty London we take the privacy and security of your personal data seriously. This policy explains what information we collect, why we collect it, and how we use and protect it. Please read it carefully — if you have any questions we are always happy to help.

This policy applies to data collected through our website (polishedbeautylondon.co.uk), through our booking system, through direct contact (phone, WhatsApp, social media), and through the treatment records we maintain as part of providing our services. By using our website or booking treatments you acknowledge that you have read and understood this Privacy Policy.

1. Who We Are

Polished Beauty London (“we”, “us”, “our”) is an aesthetics clinic based at Waterloo House, 207 Waterloo Road, London SE1 8XD. We are registered in England and Wales under Companies House number 15157996. We are the data controller responsible for your personal data.

We are registered as a data controller with the Information Commissioner’s Office (ICO). Our ICO registration reference is: [ICO Registration Number — to be inserted].

For any data protection queries, please contact us at info@polishedbeautylondon.co.uk or by phone/WhatsApp on +44 7853305082.

2. Information We Collect

We may collect and process the following categories of personal information:

Identity Information

• Full name
• Date of birth
• Gender

Contact Information

• Email address
• Telephone number (including WhatsApp)
• Postal address (if provided)

Health and Treatment Information

Because some of our treatments involve skin assessments and injectables, we collect relevant health information with your explicit consent. This includes:

• Medical history relevant to treatment suitability
• Current medications and supplements
• Known allergies and contraindications
• Pregnancy or breastfeeding status
• Previous treatment history
• Skin type and condition notes
• Before and after photographs (where separate consent has been given)
• Patch test results
• Signed consent forms and aftercare notes
• Consent forms completed online before an appointment — the answers you give are stored encrypted, are seen only by the clinical team, and a copy is emailed to you only when you tick the box asking for one

Financial Information

• Payment details are processed securely by our third-party payment provider — we do not store full card numbers
• Transaction history relating to bookings and membership

Technical Information

• IP address and browser type when you visit our website
• Pages visited and time spent on the site
• Cookie identifiers (see our Cookie Policy)

Communications

• Enquiries, messages, or feedback sent via our website, email, WhatsApp, or social media
• Voicemails you leave and text messages you send to the clinic’s phone number, so we can reply to you properly
• Your conversations with the chat on our website, and your email address if you ask us to follow up, so a member of the team can carry on where the chat left off

Details You Choose to Share When Booking

Some bookings, such as a private booking page we send you, ask a few more questions so we can prepare for your visit with care. We only ask what helps us look after you, and a page always shows which questions are optional:

• Your home address and an emergency contact, so we can reach someone on your behalf if we ever need to during a visit
• Your social media handle, for collaborations you have agreed with us
• How you heard about us, which helps us understand what brings people to the clinic
• Your photography preferences, so a photograph is never taken or used without your agreement
• Where a booking page asks: your pronouns, postcode, the company or publication you work with, the size of your audience, what you would like to create with us, how you prefer to be contacted, anything that would make your visit easier, who referred you, what you would like to address, what you hope for, whether you have had the treatment before, whether you would like a short call first, and whether your visit is for an occasion
• Your answers to any question the clinic adds to a particular booking page
• That you ticked to accept a booking’s cancellation terms, so we both have the same understanding

Your Account Area

If you have an account with us, it also keeps a few things in one place for you:

• The messages between you and the clinic
• Any offer or voucher we set aside for you, and whether you have used it or put it away
• A list of the emails we have sent you, each with a short preview, so they are easy to find again
• Your display preferences, such as the colour theme you choose

Private Messages

Now and then we may need to send you something more personal, such as details about your treatment. Rather than leave it sitting in an inbox, we can send it privately: you receive a short note with a link to a page made just for you.

• The message, and any files with it, stay on our secure server rather than travelling by email, and the page closes on a date we choose, or sooner if we close it
• If a passcode is used, it reaches you separately, by email, by text to the mobile we hold for you, or from us in person. We keep it only in a scrambled form
• We note when the page was opened, with a one-way scrambled reference to the connection it was opened from, so we know it reached you
• A month after the page closes, the message and its files are removed

Keeping Bookings Safe and Fair

• Six digit codes we send by email or text to confirm a booking or a sign-in. They are stored only in a scrambled (hashed) form and are deleted once used, or within ten minutes
• A one-way scrambled reference to the internet connection a booking came from, used only where a booking page limits how many bookings one connection can make. It cannot be turned back into your address and is never used for anything else
• When a private booking page was opened, so the clinic knows it reached you

Photographs and Videos From Your Visit

If photographs or short videos are taken during your visit, for your clinical record or because you asked for them, we keep them with your booking, so your practitioner can look back gently at how things are progressing. If you would like them, or you tick the box on a booking page, we share them with you through a private page made just for you:

• The page opens a set number of times and closes after a set date, so your photographs are not available for longer than they need to be
• We may ask for a PIN, the email address the link was sent to, or for you to be signed in to your account before it opens, so that only you can see them
• The files are stored encrypted, and we note when the page was opened, simply so we know it reached you
• We never use them for anything else, such as our website or social media, unless you have told us you are happy for us to

3. How We Collect Your Information

We collect personal information:

• Directly from you — when you make a booking, complete a health questionnaire or consent form, or contact us
• Through our booking system — when you schedule or manage appointments online
• Automatically via our website — through cookies when you browse our site
• Via social media — when you message us through Instagram, TikTok, or WhatsApp

4. Why We Use Your Information

We only use your personal data where we have a lawful basis to do so:

Where we rely on consent (such as for marketing), you can withdraw it at any time by contacting us or clicking ‘unsubscribe’ in any email. Where we process health information, we do so on the basis of your explicit consent and our duty of care to you.

5. Who We Share Your Information With

We only share your data where necessary and always in accordance with UK data protection law. We may share it with:

• Our booking system provider — to manage appointments and send reminders
• Payment processing — card payments are processed securely by Stripe Payments Europe Ltd; we never see or store your full card details
• Professional indemnity insurers — where relevant to your care
• IT and security service providers — who help us maintain our systems securely

We do not sell, rent, or share your personal data with third parties for their own marketing purposes. All third parties who process data on our behalf are required to handle it securely and in line with UK data protection law.

6. International Transfers

We do not routinely transfer your personal data outside the United Kingdom. If any of our digital service providers process data outside the UK, we ensure appropriate safeguards are in place such as UK-approved standard contractual clauses.

7. How Long We Keep Your Information

After the relevant period, personal data is securely deleted or anonymised.

7a. Marketing Emails

If you tick the marketing box when booking, requesting a consultation or entering a prize draw, we add your email address, name and mobile number to our marketing list and record the date and the page you gave that permission on. The lawful basis is your consent, and consent is the only basis we use for marketing — we do not add anyone to this list because they have booked with us.

We use the list to send occasional emails about treatments, skin advice and clinic news. We do not sell, rent or share it with anyone, and we do not use it for automated decision-making or profiling.

Every marketing email contains a one-click unsubscribe link, which takes effect immediately and needs no account, password or reply. You may also email us and we will remove you the same working day. Unsubscribing stops marketing only — booking confirmations, appointment reminders and replies to your own enquiries are not marketing and will still reach you.

When you unsubscribe we keep a record that you have done so. That record exists solely to make sure you are not added again by a later booking; it is not used to contact you.

7b. Online Accounts, Memberships and Treatment Credit

If you choose to create an account on our website we store your name, email address, mobile number and a securely hashed password (we cannot see the password itself), together with the sign-in sessions needed to keep you signed in on your own devices. Creating an account is optional for booking; it is required only for memberships and treatment credit.

If you join a membership we keep a record of your tier, its status and its billing history, and a credit ledger recording every credit added to your balance and every credit spent, with the date and the reason. This ledger is what your balance page shows you, and we keep it for as long as you hold an account so that your balance can always be explained. Recurring payments are processed by our payment provider (Stripe); we never see or store your card number.

If you turn on two-step sign-in we email you short-lived security codes. These codes are stored only in a hashed form and expire within minutes. You can close your account at any time by emailing us; see section 10.

Your account also holds your messages with the clinic, any offers we set aside for you and a list of the emails we have sent you. Suggestions in your account, such as what your balance could go towards, are worked out only from your own bookings and balance, are shown only to you, and are never used to make decisions about you or shared with anyone.

8. Your Rights Under UK GDPR

Under UK data protection law you have the following rights:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data
• Right to erasure — in certain circumstances, request that we delete your data (note: treatment records may need to be retained)
• Right to restrict processing — ask us to limit how we use your data
• Right to data portability — request a transfer of your data in a machine-readable format
• Right to object — object to processing based on legitimate interests; you can always object to direct marketing
• Rights around automated decisions — we do not make automated decisions about you without human involvement

To exercise any of these rights please contact us at info@polishedbeautylondon.co.uk or +44 7853305082. We will respond within one calendar month.

9. Cookies

Our website uses cookies. For full details please read our separate Cookie Policy.

10. How to Contact Us

To ask what we hold, or to have it deleted: email info@polishedbeautylondon.co.uk with “Data request” in the subject line, or write to us at the address above. Tell us whether you want a copy of your data, a correction, or deletion. We will confirm receipt and respond within one calendar month, free of charge. We may ask you to confirm your identity first, so that nobody else can obtain or delete your records.

Where we cannot delete something, we will say so and explain why. In practice this applies to clinical treatment records, which we are required to retain, and to financial transaction records, which HMRC requires us to keep for seven years. Everything else — including your marketing preferences, enquiry history and prize-draw entries — can be deleted on request.

If you are not satisfied with how we have handled a data protection matter, you can complain to the Information Commissioner’s Office (ICO): ico.org.uk | 0303 123 1113 | Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

11. Changes to This Policy

We may update this policy from time to time. The current version will always be available at polishedbeautylondon.co.uk/privacy-policy. This policy was last reviewed in September 2026.