Privacy Policy

Hannah Louise Beauty
Website: www.hannahlouisebeauty.com
Last updated: 14/10/2026

1. About Me

Hannah Louise Beauty is committed to protecting your privacy and handling your personal information responsibly.

This Privacy Policy explains how I collect, use, store and protect your personal information when you visit my website, contact me, book an appointment or receive a treatment.

The data controller is Hannah Louise Watkins, trading as Hannah Louise Beauty. For privacy enquiries, please contact me at hannahlouisebeauty@hotmail.com.

2. Information I Collect

Depending on how you interact with me, I may collect:

Personal details: Your name, contact details and other information provided when making a booking or enquiry.
Appointment information: Your chosen treatments, appointment history, booking preferences and relevant communications.
Consultation and medical information: Medical history, allergies, medications, skin conditions, previous treatments and other information relevant to assessing treatment suitability.
Treatment records: Consultation notes, patch test results, treatment consent and records of treatments performed.
Photographs: Before-and-after treatment photographs, where taken, for treatment documentation or, with separate appropriate permission, promotional purposes.
Payment information: Relevant payment and transaction records.
Website information: Technical information collected through cookies and similar technologies.

I collect only information reasonably necessary for the purposes explained in this policy.

3. How I Use Your Information

I use personal information to:

Respond to enquiries and manage appointment bookings.
Provide treatments and maintain relevant treatment records.
Assess treatment suitability and identify potential contraindications.
Record consultation decisions, patch test results and treatment consent.
Send appointment confirmations, reminders and essential service communications.
Process payments and maintain financial records.
Respond to customer queries, complaints or concerns.
Comply with applicable legal obligations and establish or defend legal claims where necessary.
Send promotional communications where permitted by law.

I do not use your medical information for advertising or marketing.

4. Medical Information and Treatment Consent

Certain treatments require me to collect information about your health to establish whether the treatment is appropriate and safe.

I collect this information through consultation and consent forms managed using Jotform, a third-party online form service.

Medical information is treated as special category personal data under UK data protection law and is subject to additional protection.

My lawful basis under Article 6 of the UK GDPR for processing information necessary to assess and provide treatments is the performance of a contract, or taking steps before entering into a contract.

For processing health information, I rely on your explicit consent under Article 9(2)(a) of the UK GDPR.

You may withdraw that consent by contacting me. This may mean I cannot assess your suitability for, or provide, certain treatments. Withdrawal does not affect processing carried out lawfully before withdrawal, and some information may need to be retained where another applicable legal basis and special category condition permits or requires it.

Treatment consent is separate from consent to process personal data.

5. Other Lawful Bases

Depending on the purpose, I may also process information on the following grounds:

Legal obligation: Maintaining records required by law.
Legitimate interests: Managing my business, responding to enquiries, protecting my legal interests and improving my services, where these interests do not override your rights.
Consent: Where required for marketing communications, promotional photography or optional website technologies.

I respect your right to object to direct marketing at any time.

6. How I Store and Share Information

I use trusted service providers to operate the business, including:

Wix: Website hosting, online bookings and associated business services.
Jotform: Consultation forms, medical screening information and treatment consent records.
Other relevant providers: Payment processing, accounting and communication services where applicable.

These providers may process information on our behalf to deliver their services.

I do not sell your personal information.

Access to confidential customer information is restricted to individuals who need it for legitimate business purposes. I take appropriate measures to protect records against unauthorised access, loss or misuse.

7. International Data Transfers

Some technology providers may process or access personal information outside the United Kingdom.

8. How Long I Keep Information

I retain personal information only for as long as reasonably necessary for the purposes for which it was collected.

Consultation, medical and treatment records: [Insert confirmed retention period and any relevant insurance requirements.]
Booking and customer information: [Insert retention period.]
Financial records: Retained for applicable legal and tax obligations.
Marketing preferences: Retained until consent is withdrawn or marketing is otherwise discontinued, subject to maintaining appropriate suppression records.

I review information and securely delete or anonymise records when they are no longer required.

9. Treatment Photographs

Photographs may be taken to document treatment results or support consultation and aftercare.

Photographs will only be used for advertising, social media or other promotional purposes where we have obtained separate, appropriate permission.

You may withdraw permission for future promotional use by contacting me.

10. Cookies and Website Analytics

My website is hosted by Wix and may use cookies and similar technologies to support website functionality, understand website usage and improve the visitor experience.

Where required, we seek permission before placing optional cookies.

For further information, please refer to the Cookie Policy.

11. Your Data Protection Rights

Under UK data protection law, you may have the right to:

Request access to the personal information I hold about you.
Request correction of inaccurate information.
Request deletion of information in certain circumstances.
Request restrictions on how your information is processed.
Object to certain uses of your information, including direct marketing.
Request transfer of information where applicable.
Withdraw consent where consent is the legal basis for processing.

These rights are subject to applicable legal conditions and exceptions.

To exercise your rights, please contact hannahlouisebeauty@hotmail.com.

If you are unhappy with how your information is handled, you may complain to the Information Commissioner's Office (ICO) at www.ico.org.uk.

12. Changes to This Policy

I may update this Privacy Policy to reflect changes in my services, business practices or legal requirements.

The latest version will always be available on my website.