Privacy Policy

1. Introduction

Bl-inked PMU Clinic ("we", "us", "our"), operated by Laura Goodacre in Wickford, Essex, is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and protect your information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We are the data controller for the personal information you provide to us. If you have any questions about this policy, please contact us at [email protected].

2. What Personal Data We Collect

We collect and process the following categories of personal data:

Contact & Booking Information

• Full name, email address, phone number
• Appointment history and booking preferences
• Payment records (we do not store full card details)

Health & Medical Information (Special Category Data)

• Medical history relevant to your treatment
• Current medications and known allergies
• Patch test results and treatment consent records
• Contraindication assessments

Health data is classified as special category data under UK GDPR. We collect this information only where it is necessary to provide you with safe and appropriate treatment, and with your explicit consent.

Photographic Data

• Before and after treatment photographs (only with your written consent)

3. How We Use Your Data

We use your personal data for the following purposes:

• To provide our services — managing appointments, consultations and treatments
• To ensure your safety — reviewing medical history and suitability prior to treatment
• To communicate with you — appointment confirmations, reminders and aftercare guidance
• To comply with legal obligations — maintaining treatment records as required under health and safety regulations
• Marketing — only where you have given explicit consent to receive promotional communications

We do not sell, rent or share your personal data with third parties for marketing purposes.

4. Legal Basis for Processing

We process your personal data on the following legal grounds:

• Contract — processing necessary to fulfil our agreement with you (e.g. booking and providing your treatment)
• Explicit consent — for special category health data, photographs and marketing communications
• Legal obligation — where we are required by law to maintain treatment records
• Legitimate interests — for general business administration and client communication

5. How Long We Keep Your Data

We retain your personal data only for as long as necessary:

• Treatment and consent records: 7 years from the date of your last treatment, in line with UK health and safety guidance for cosmetic practitioners
• Booking and contact records: 3 years from your last appointment
• Photographs: Indefinitely unless you withdraw consent, at which point they will be deleted within 30 days
• Marketing consent: Until you withdraw consent

6. Data Security

We take the security of your personal data seriously. Your data is stored securely using password-protected devices and encrypted systems. Paper records containing personal data are kept in a locked, secure location.

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss or destruction. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) as required by law.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access — to request a copy of the personal data we hold about you
• Right to rectification — to request that inaccurate data be corrected
• Right to erasure — to request deletion of your data (subject to legal retention requirements)
• Right to restrict processing — to request that we limit how we use your data
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — at any time, where processing is based on consent

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.

8. Cookies

Our website uses only essential cookies necessary for the site to function. We do not use tracking, advertising or analytics cookies without your consent. By continuing to use our website, you consent to the use of essential cookies.

9. Third-Party Services

We use the following third-party services which may process your data on our behalf:

• Booking system (BookApp / Ovatu) — for appointment management. Please refer to their respective privacy policies.
• Google — for Google Maps integration and Google Reviews
• Social media platforms — Instagram, Facebook and TikTok (only data you choose to share publicly)

We ensure that any third-party processors we use provide sufficient guarantees regarding data protection compliance.

10. Complaints

If you believe your data has been mishandled, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

ICO
Website: ico.org.uk
Phone: 0303 123 1113

We would, however, appreciate the opportunity to address your concerns directly before you contact the ICO. Please reach out to us at [email protected].

11. Contact

Bl-inked PMU Clinic
Wickford, Essex
Email: [email protected]
Phone: +44 7725 217093