1. Who we are

Zora Skin and Aesthetics Group is the data controller responsible for deciding how and why personal information is used. The clinic is owned and operated by Marina King. Questions about this policy or the use of personal information can be raised through the Business WhatsApp link on our website.

2. Purpose of this policy

This policy explains what personal information we collect through our website and related online services, why we use it, how it is protected, who it may be shared with and the rights available to individuals under UK data protection law.

3. Information we may collect

• Identity and contact details, such as name, date of birth, address, telephone number and email address.
• Enquiry information provided through WhatsApp, social media or another contact method linked from the website.
• Booking information submitted through the Faces booking platform.
• Consultation, treatment, medical history, consent and aftercare information recorded through Faces where a person becomes a client.
• Payment and transaction information, where applicable. Full card details are normally handled by the relevant payment provider rather than stored by the clinic.
• Photographs or videos where specific consent has been provided for clinical records, treatment monitoring or marketing.
• Technical information, such as IP address, browser type, device information, website usage data and cookie preferences where collected by the website or its service providers.
• Marketing preferences and records of consent or objections.

4. How we collect information

• Directly from individuals when they contact us, make an enquiry, book an appointment or attend the clinic.
• Through the Faces booking and client-record platform.
• Through Business WhatsApp, social-media messaging or other communication channels linked from the website.
• Automatically through website cookies or similar technologies, where these are used.
• From service providers that support website hosting, booking, communications, payments, analytics or business administration.

5. Why we use personal information and our lawful bases

We only use personal information where there is a lawful reason to do so. Depending on the circumstances, this may include:

• Contract: to respond to booking requests, provide services, manage appointments, take payment and communicate about treatment.
• Legal obligation: to meet tax, accounting, insurance, safeguarding, health and safety, medicines, clinical-record or regulatory requirements.
• Legitimate interests: to operate and improve the clinic, answer enquiries, prevent fraud, maintain security, manage complaints and establish or defend legal claims, provided these interests do not override an individual’s rights.
• Consent: for optional marketing, non-essential cookies and the use of identifiable photographs or videos for promotional purposes.
• Special-category conditions: health information is used only where permitted by law, including where necessary for health or care purposes, to protect vital interests, or for the establishment, exercise or defence of legal claims, as appropriate.

6. Health information and treatment records

Aesthetic treatment may require us to collect health and medical information to assess suitability, identify contraindications, obtain informed consent, record treatment and provide appropriate aftercare. This information is treated as confidential and is only accessed by people or providers who need it for a legitimate purpose.

7. Sharing personal information

We may share relevant information with trusted third parties where necessary, including:

• Faces or another booking, consultation and client-record provider.
• Prescribers, healthcare professionals or emergency services where necessary for safe care or where required by law.
• Payment processors, accountants, insurers, legal advisers and professional consultants.
• Website developers, hosting providers, IT support, communications providers and analytics services.
• Regulators, courts, law-enforcement bodies or public authorities where disclosure is legally required.
• A purchaser or successor organisation if the business is sold or restructured, subject to appropriate confidentiality and data-protection safeguards.

We do not sell personal information. Service providers are expected to use information only for agreed purposes and to protect it appropriately.

8. International transfers

Some service providers may store or process information outside the United Kingdom. Where this occurs, we will use an appropriate legal safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement or an approved UK Addendum, together with any additional safeguards considered necessary.

9. How long we keep information

Information is kept only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, clinical, insurance and professional requirements. Retention periods vary according to the type of record. Clinical and treatment records may need to be retained for several years after the last treatment, and longer where the client is under 18, where an insurer or regulator requires it, or where a complaint or legal claim is ongoing. Enquiry and marketing information will be reviewed regularly and deleted or anonymised when no longer needed.

10. Security

Reasonable technical and organisational measures are used to protect personal information against accidental loss, misuse, unauthorised access, alteration or disclosure. These measures may include password protection, access controls, secure systems, device security, backups and limiting access to those who need the information.

11. Marketing

We may send marketing messages only where permitted by law. Individuals can withdraw consent or object to direct marketing at any time by using the unsubscribe method provided, replying to the message or contacting us through Business WhatsApp. Stopping marketing does not affect communications required to manage bookings or provide treatment.

12. Cookies and website analytics

The website may use cookies or similar technologies. Strictly necessary cookies may be used without consent where permitted. Non-essential cookies, including certain analytics or advertising cookies, should only be placed after valid consent has been obtained. More detail will be provided in the website Cookie Policy and cookie settings.

13. Links to other websites and services

Our website may link to third-party websites or services, including Faces, WhatsApp and social-media platforms. Those providers are responsible for their own privacy practices, and individuals should review their privacy information before providing personal data.

14. Your data-protection rights

Depending on the circumstances, individuals may have the right to:

• ask for access to their personal information;
• ask for inaccurate or incomplete information to be corrected;
• ask for information to be erased where the legal requirements are met;
• ask us to restrict how information is used;
• object to processing based on legitimate interests or to direct marketing;
• receive certain information in a portable format;
• withdraw consent at any time where consent is the lawful basis; and
• raise a concern about automated decision-making, where applicable.

These rights are not absolute and may be limited by legal, clinical or regulatory requirements. We may need to confirm identity before responding. Requests should be made through the Business WhatsApp contact shown on our website.

15. Complaints

Please contact Zora Skin and Aesthetics Group first so that we have the opportunity to address any concern. Individuals also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection.

16. Changes to this policy

This policy will be reviewed at least annually and whenever there is a significant change to our website, services, systems, legal obligations or use of personal information. The current version will be published on the website.

17. Related documents

• Cookie Policy
• Cancellation and Rescheduling Policy
• Consent Policy
• Data Protection and Confidentiality Policy
• Photography and Media Consent Policy
• Complaints Policy