Privacy Policy

• Identity & contact details: name, email address, phone number
• Booking information: appointments booked, treatment history, notes, cancellations and no-shows
• Payment information: payments, deposits and refunds processed via Stripe. We do not see or store your full card details, these are held securely by Stripe.
• Health information: consultation form answers, including allergies, skin conditions, medical conditions, medication and pregnancy status relevant to your treatment; patch test results or signed patch test waivers
• Consent records: signed consultation forms, waivers, parental consent forms (for clients under 18), photo consent
• Photos: before and after photos of treatments, only where you have given consent
• Website & technical data: information collected automatically when you use our website, such as IP address, device and browser information, and cookies

• Taking and managing bookings, providing treatments — performance of a contract
• Processing payments, deposits and cancellation/no-show charges — performance of a contract
• Health and consultation information to carry out treatments safely — your explicit consent (special category health data, UK GDPR Article 9(2)(a))
• Keeping records of consultations, waivers and consent forms — legitimate interests (protecting clients and our business) and legal obligations, including insurance requirements
• Before/after photos on our website or social media — your consent; you can say no, and treatment is never conditional on photo consent
• Replying to enquiries and sending appointment reminders — legitimate interests
• Marketing messages — your consent; you can unsubscribe at any time

Before certain treatments we ask you to complete a consultation form covering allergies, medical conditions and other health details relevant to your treatment. This is special category data under UK GDPR and we only process it with your explicit consent. If you choose not to provide it, we may be unable to carry out some treatments safely and may decline to provide them. You can withdraw consent at any time by emailing us, although we may need to retain records already created where necessary for legal or insurance purposes.

Clients under 18 are only treated with a parent or legal guardian present, and consultation and consent forms for under-18s must be completed and signed by the parent or guardian. We collect the minimum information necessary and hold parental consent records securely.

• Stripe — our payment processor. Stripe processes your card details under its own privacy policy: stripe.com/gb/privacy
• Website and booking platform providers — our website is built and hosted on third-party infrastructure which processes booking data on our behalf
• Professional advisers and insurers — where necessary, for example in the event of a claim or dispute
• Authorities — where required by law

We do not sell your personal information.

• Booking and contact details: while you remain a client and for up to 2 years after your last appointment
• Consultation forms, health records, waivers and consent forms: for as long as reasonably necessary to defend potential claims, in line with insurance guidance (typically several years after treatment; longer for under-18s)
• Payment records: 6 years, in line with HMRC requirements
• Photos: until you withdraw consent or ask us to remove them

Our website uses essential cookies needed for it to function (for example, to process bookings and payments) and may use analytics cookies to help us understand how the site is used. You can control cookies through your browser settings.

Records are stored securely with access limited to Sherella Johnson. Payments are handled by Stripe, which is PCI-DSS certified. Paper forms, where used, are stored securely at our premises.

Under UK GDPR you have the right to: access a copy of your information; correct inaccurate information; ask us to delete your information; restrict or object to how we use it; data portability; and withdraw consent at any time where consent is our legal basis. To exercise any right, email beautybyrellaldn@gmail.com. We will respond within one month.

If you are unhappy with how we handle your information, please contact us first so we can try to resolve it. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk or 0303 123 1113.

We may update this policy from time to time. The latest version will always be published on this page with the date above.