Privacy Notice

Last updated: 27 September 2026

This notice explains how Natural Reflection Skin Care Limited (“we”, “us”, “our”) collects and uses your personal data when you visit this website, request an appointment, attend a consultation or have a treatment with us. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), both as amended by the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations 2003 (PECR).

1. Who we are

We are registered with the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator, and pay the data protection fee. We have not appointed a Data Protection Officer because the law does not require one for an organisation of our size and type. For any privacy question, or to use your rights, please email us.

2. Information we collect

When you request an appointment

When you send the booking form, your details are sent securely (over HTTPS) to our form provider, Netlify. Netlify stores the submission and forwards it to the clinic’s email inbox. The form collects:

• your name, email address and mobile number
• the treatment you are interested in, your preferred date and time, and whether that treatment needs a specialist consultation
• any notes you choose to add
• your confirmation that you are 18 or over, and that you have read this notice and our Booking Terms

The booking form does not ask for health information. Please don’t include any in your notes. We ask for it privately at your consultation.

When you visit this website

Netlify, our hosting provider, automatically processes technical data such as your IP address, browser type and the pages you request, to deliver the website securely and prevent abuse. We do not use analytics, advertising or tracking cookies. Glowbot, the robot on our homepage, does not collect any information. See our Cookie Policy.

3. Treatments that need a specialist consultation

The following treatments are only offered after a face-to-face consultation and a medical history review:

• Advanced Skin (18+): Polynucleotides – Eye Area, Mesotherapy – Face, Skin Booster, Lip Filler and Smile Line Filler
• Consultations: Hair Loss Treatment, Fat Dissolving Consultation, Lines & Wrinkles Consultation and Vitamin Wellness Consultation

For these treatments we collect special category data (health information), which the law protects more strictly. This may include:

• your medical history, current medications, allergies and any previous cosmetic treatments
• whether you are pregnant or breastfeeding, where this affects whether a treatment is safe
• your skin assessment, treatment plan, consent forms and aftercare notes
• clinical photographs, taken only with your separate written consent and never used for marketing unless you specifically agree
• proof of age. Under the Botulinum Toxins and Cosmetic Fillers (Children) Act 2021, filler and similar treatments cannot be given to anyone under 18, so we may check photo ID. We record that we checked it; we don’t keep a copy.

Our legal basis for health information

• Your explicit consent (UK GDPR Article 9(2)(a)). You give it in writing on your consultation form.
• Health care purposes (UK GDPR Article 9(2)(h), with DPA 2018 section 10 and Schedule 1, Part 1, paragraph 2), where a treatment is assessed, prescribed or given by or under the responsibility of a registered health professional who owes you a duty of confidentiality.
• Legal claims (UK GDPR Article 9(2)(f)), to keep records we may need if there is a complaint or claim about a treatment.

Prescription-only treatments

Some treatments can only be provided if a qualified independent prescriber decides, after a face-to-face assessment, that they are right for you. With your consent, we share the health information the prescriber needs. The prescriber is responsible for their own prescribing records under their professional obligations, and will give you their own privacy information.

If you withdraw consent

You can withdraw your consent to us using your health information at any time. If you do, we may not be able to treat you safely, and we will tell you. We may still need to keep records of treatments already given, to meet our legal and insurance obligations.

4. Why we use your information, and our legal basis

We will never sell your data. We do not make decisions about you using only automated means, and we do not profile you.

5. Who we share it with

We only share your data when we need to, and only as much as is needed:

• Website hosting and forms: Netlify, Inc., which hosts this website, receives and stores booking form submissions, and filters out spam.
• Email provider: Google (Gmail), which delivers and stores the booking emails we receive.
• Independent prescribers and healthcare professionals: where a treatment needs a prescription or medical assessment, with your consent (see section 3).
• Our insurers, professional advisers and regulators: where needed to handle claims or meet legal requirements.
• Emergency services or your GP: in an emergency, or where you have agreed.

Netlify and Google act as our processors under written contracts and may process data in the United States. Where your data leaves the UK, it is protected by safeguards recognised under UK law, such as the UK Extension to the EU–US Data Privacy Framework or the ICO’s International Data Transfer Addendum.

6. How long we keep it

• Booking form submissions: deleted from Netlify once we have dealt with your request, and within 3 months at most.
• Booking enquiries that don’t lead to an appointment: deleted from our inbox within 3 months.
• Consultation and treatment records, including health information and clinical photographs: kept for 8 years after your last treatment, in line with healthcare record-keeping guidance and limitation periods for claims.
• Financial records: 6 years after the end of the financial year they relate to, as HMRC requires.
• Hosting logs: kept by Netlify for a limited period, in line with its own retention policy.

When records are no longer needed, we delete or securely destroy them.

7. Keeping it safe

We protect your data with measures suited to its sensitivity. Health records are kept separately from booking details and are only accessible to the people treating you. Devices are protected with passwords and encryption, paper records are locked away, and our email and form accounts use two-step verification. We do not send health information by ordinary email. If a data breach is likely to put you at risk, we will tell you and report it to the ICO within 72 hours, as the law requires.

8. Your rights

Under the UK GDPR and DPA 2018 you have the right to:

• access a copy of your personal data, including your treatment records
• have inaccurate data corrected
• have your data erased, where there is no legal reason for us to keep it
• restrict or object to how we use your data
• data portability, where it applies
• withdraw your consent at any time. This does not affect anything done before you withdrew it.

To use any of these rights, email us. We may need to confirm your identity first. We will respond within one month, or within three months for complex requests, in which case we will tell you why. There is normally no charge.

9. Complaints

If you are unhappy with how we have handled your data, please email us first so we can put it right. We will acknowledge your complaint within 30 days and respond without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO):

10. Children

Our services and this website are intended for adults. We do not knowingly collect data from anyone under 18 for treatment purposes.

11. Changes to this notice

We may update this notice from time to time. The latest version will always be on this page, with the date it was last updated. If we make significant changes, we will tell existing clients.