The Skin Nurse GDPR Privacy Policy 01 Oct 2026 1. Who we are The Skin Nurse Ltd (“we”, “us”, “our”) is the data controller for the personal information we collect through www.theskinnurse.co.uk and when you visit our clinic. This policy explains what we collect, why we collect it, who we share it with, how long we keep it and what your rights are. We are a nurse-led aesthetics and skin clinic. Because we provide healthcare, some of the information we hold about you is health information, which the law treats as especially sensitive. Section 3 explains how we protect it. Company The Skin Nurse Ltd, registered in England, company number 11122205 Registered office 240 Reculver Road, Herne Bay, Kent, CT6 6QR Clinic address 23A, Broad Street Teddington Middlesex TW11 8QZ ICO registration number ZB111242 Data protection contact Louise Walsh, Clinical Director Email hello@theskinnurse.co.uk Telephone 0777 911 3416 2. The information we collect We collect information you give us directly, information created during your care, and limited technical information from your use of our website. Type of information Examples How we collect it Identity Name, title, date of birth, gender Booking, consultation forms, clinic visits Contact Address, email, phone number Booking, enquiry forms, newsletter sign-up Health and clinical Medical history, medications, allergies, skin concerns, treatment notes, consent forms, aftercare records Consultation and consent forms, clinic appointments, virtual consultations Photographs Clinical before-and-after photos, photos you upload for a virtual consultation Taken in clinic or uploaded by you Payment Deposits, payments, account credit, transaction history (we do not store full card details) Our booking and payment providers Communications Emails, messages, Instagram direct messages, your marketing preferences When you contact us or sign up Technical IP address, browser, device, pages visited Cookies and analytics (see section 11) We only ask for the health information we need to assess whether a treatment is safe and suitable for you, to deliver it, and to look after you afterwards. 3. Health information and clinical photographs Health information and clinical photographs are “special category data” under UK GDPR. We process them because it is necessary for the provision of health care (Article 9(2)(h) UK GDPR). All clinical care is provided by, or under the supervision of, a registered healthcare professional bound by a duty of confidentiality. Clinical photographs. We take photographs to plan your treatment, record your results and keep an accurate clinical record. These form part of your medical record and are stored securely in our clinical records system. Photographs for marketing, social media or teaching. We will never use an identifiable photograph, or any image of your treatment, on our website, social media, in advertising or for teaching without your separate, explicit written consent. This consent is optional, is separate from your treatment consent, and does not affect your care. You can withdraw it at any time. Once withdrawn, we will remove your images from our own channels, although we cannot recall material that has already been printed or shared by others. Virtual/Remote consultations and services. If you use our online consultation service (such as The Glow Plan), you will be asked to submit health information. We treat these in exactly the same way as information given in clinic. 4. How we use your information and our lawful bases We must have a lawful basis for every use of your information. For health information we also rely on the Article 9 condition in section 3. What we do Information used Lawful basis Booking appointments, taking deposits and managing payments Identity, contact, payment Contract Assessing suitability, providing treatment, prescribing and aftercare Identity, contact, health, photographs Contract, plus provision of health care (Art. 9(2)(h)) Keeping accurate clinical records Identity, health, photographs Legal obligation and provision of health care Providing virtual consultations and product recommendations Identity, contact, health, photographs Contract, plus provision of health care Replying to enquiries and messages Identity, contact, communications Legitimate interests (responding to people who contact us) Sending appointment reminders and service messages Contact Contract Sending marketing emails and offers Contact, marketing preferences Consent Using photographs in marketing or teaching Photographs Explicit consent Running and improving our website, analytics and advertising Technical Consent (non-essential cookies) or legitimate interests (security and essential functions) Handling complaints, insurance claims and legal matters Any relevant information Legal obligation, legitimate interests, and establishing or defending legal claims (Art. 9(2)(f)) Keeping business and tax records Identity, payment Legal obligation We do not use automated decision-making or profiling that has legal or similarly significant effects on you. 5. Marketing We only send marketing emails or messages if you have opted in. You can unsubscribe at any time using the link in any email, by replying “STOP” to a text, or by contacting us. We will never use your health information to target marketing to you without your consent, and we will never sell or pass your details to other companies for their marketing. Unsubscribing from marketing does not stop essential messages about your appointments or care. 6. Who we share your information with We never sell your information. We use a small number of trusted service providers to run the clinic. They act on our instructions under contract and may only use your information to provide their service to us. Type of provider What they do Where data may be processed Booking and clinical records system Online booking, clinical records, consent forms and appointment payments UK, EU Online forms provider Collects virtual consultation forms and photographs UK, EU Skincare prescribing platform Prescribes and delivers skincare products you choose to order; also a controller for those orders UK Website hosting and email platform Hosts our website and sends emails, including marketing you have opted in to UK Automation tools Pass information securely between our forms and email systems UK/USA Payment processors Process online card payments; we never see your full card details UK, EU and USA Social media and advertising platforms Handle messages you send us on social media, and measure our adverts USA Website analytics provider Shows us how visitors use our website USA Accountant Bookkeeping and tax UK If you would like to know the specific providers we currently use, please contact us. We may also share information in these situations: With your GP or another healthcare professional, with your consent, or without it only where needed to protect your health or safety, such as a treatment complication. In an emergency, with emergency services. With our insurers and legal advisers, if needed to handle a claim or complaint. With regulators or authorities, such as the Nursing and Midwifery Council, where the law requires it. If the business is sold or restructured, with the new owner, who must continue to protect your information in line with this policy. 7. International transfers In plain terms, a “transfer” happens when your information is stored on, or accessed from, a computer system outside the UK. This is usually because some of the online tools we use are run by companies based in the EU or USA. We never deliberately send your records abroad. Some of our providers store or access information outside the UK, mainly in the EU and the USA. Where this happens, we make sure your information has the same level of protection as it would in the UK by using one of these safeguards: the country has a UK adequacy decision (this covers the EU and EEA); the US company is certified under the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”); or we have a contract with the provider using the UK International Data Transfer Agreement or Addendum. Contact us if you would like more detail about the safeguard used for a particular provider. 8. How long we keep your information We keep information only for as long as we need it, then delete or securely destroy it. Information How long we keep it Clinical records, consent forms and clinical photographs 8 years after your last treatment (see below) Virtual consultation forms and photographs As clinical records above Payment and financial records 6 years after the end of the financial year they relate to Enquiries from people who do not become patients 12 months after our last contact Marketing list Until you unsubscribe, or after 2 years without engagement Consent for marketing or teaching use of photographs Until you withdraw it, plus the records period above Website analytics data 14 months Why we keep clinical records for 10 years. There is no single law setting a retention period for private clinics. We follow the NHS Records Management Code of Practice for Health and Social Care, which sets a minimum of 8 years after the end of treatment for adult health records. We extend this to 10 years, in line with guidance from aesthetics insurers, so that your full treatment history is available if you need further care, have a late complication or raise a concern in the future. Financial records are kept for 6 years because HMRC requires it. We may keep information longer if we need it for a complaint, a legal claim or a regulatory investigation. 9. How we keep your information secure We take the security of your information seriously, especially your health information and photographs. Our measures include: storing clinical records and photographs in a secure, password-protected clinical records system, not on personal phones or social media; two-factor authentication on our systems and encrypted devices; limiting access to the people who need it to provide your care, all of whom are bound by confidentiality; using providers who meet recognised security standards; and a procedure for handling data breaches, including telling you and the Information Commissioner’s Office where the law requires. No system is completely secure, but we work hard to protect your information and review our measures regularly. 10. Your rights Under data protection law you can ask us for a copy of the information we hold about you, and ask us to correct it, delete it, limit how we use it, stop using it, or provide it in a format you can pass to someone else. Where we rely on your consent, you can withdraw it at any time. You can also ask us to stop sending you marketing at any time. Some rights have limits. For example, we cannot delete clinical records before the end of the retention period in section 8, because we must keep them for your safety and to meet our professional and legal duties. We will always explain if we cannot meet a request in full. To make a request, contact us using the details in section 1. There is normally no charge. We will respond within one month, or up to three months for complex requests, and we will tell you if we need longer. We may ask for proof of identity to protect your information. 11. Cookies Our website uses cookies, which are small files stored on your device. When you first visit, a banner lets you accept or reject non-essential cookies, and you can change your choice at any time using the [Cookie settings] link at the bottom of every page. Type What they do Examples Consent needed? Strictly necessary Make the site work, keep it secure and remember your cookie choice Website platform cookies No Analytics Show us how visitors use the site so we can improve it Google Analytics Yes Marketing Measure our adverts and show you relevant ads on social media Meta Pixel Yes You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop parts of the site, such as booking, from working. Our Cookie Policy lists each cookie by name. 12. Children Our services are for adults aged 18 and over and my injectable procedures for over 30’s only, and we do not knowingly collect information about children. If we learn that we have, we will delete it unless we must keep it for safety reasons. 13. Complaints If you are unhappy with how we have handled your information, please contact us first using the details in section 1. We will acknowledge your complaint within 30 days and aim to resolve it as quickly as possible. You also have the right to complain to the Information Commissioner’s Office (ICO). 14. Changes to this policy We may update this policy when the law or our services change. The latest version will always be on our website, and we will tell you directly about any significant changes. This policy was last updated on 01/10/2026