Privacy Policy | Louise Alexander Skin Studio

Louise Alexander Skin Studio

Last updated: August 2026

At Louise Alexander Skin Studio, I value your privacy and am committed to protecting your personal information.

Before providing certain treatments, I may need to ask relevant questions about your health, medication, skin and treatment history. This information helps me assess whether a treatment is suitable for you, identify any contraindications and decide whether a treatment needs to be adapted or postponed. I only collect health information that is relevant to providing your treatment safely.

Your personal, consultation and treatment information is handled confidentially and in accordance with UK data-protection law. Client consultation and treatment records are retained for at least five years from the date of the relevant treatment, or for longer where required for legal, professional or insurance purposes.

I use Fresha to help manage appointments, client records, consultation forms and payments. Information processed through Fresha is also subject to Fresha's own privacy and security arrangements.

Please read the full Privacy Policy below for more information about what information I collect, why I use it, how it is stored and shared, and your data-protection rights.

Client records are stored and payments processed by Fresha please click

for their privacy policy.

Who I am

Louise Alexander Skin Studio is operated by Louise Alexander as a sole trader. I am the data controller for the

personal information I collect and use in connection with my treatments and business.

I take your privacy seriously and only collect and use personal information where I have a genuine treatment, business, legal, professional or regulatory reason to do so.

If you have any questions about this Privacy Policy or how I use your information, please contact me using the contact details shown on this website.

Information I collect

Depending on how you interact with my business and the treatment you receive, I may collect:

• your name, date of birth and contact details;

• appointment and booking information;

• relevant consultation, treatment and treatment-history information;

• relevant health information, including medical conditions, medication, allergies, skin conditions, previous reactions and other information that may affect the suitability or safety of a treatment;

• treatment notes and records;

• payment and transaction information;

• correspondence between us, including email or messages;
• information you voluntarily provide when contacting me;
• photographs where these are specifically required or agreed for treatment records; and
• technical information generated when you use my website, such as IP address, browser information and cookies.

I aim to collect only information that is relevant and necessary for the purpose for which it is required.

Where I get your information

Most personal information is provided directly by you, for example when you book, complete a consultation form, attend an appointment, make a payment or contact me. I may also receive booking, transaction or account information through service providers such as Fresha.

Health and treatment information

Some treatments require me to ask questions about your health, medication, allergies, skin condition and treatment history. This information helps me assess whether a treatment is suitable for you, identify possible contraindications, decide whether a treatment needs to be adapted or postponed, and provide treatment as safely as possible.

Health information is classed as special category personal data under UK data-protection law and receives additional protection. I only ask for health information that is relevant to the treatments I provide.

For ordinary personal information needed to arrange or provide a treatment you have requested, my lawful basis under Article 6 of the UK GDPR will normally be contract or taking steps at your request before entering into a contract.

Where I process health information for treatment-suitability and safety purposes, I also need an Article 9 condition. Where applicable, I rely on your explicit consent to process relevant health information for these purposes.

You are not required to provide health information to me. However, where information is necessary to establish whether a treatment is safe and suitable, I may be unable to provide the treatment without it.

Where treatment or health records need to be retained or used for the establishment, exercise or defence of legal or insurance claims, I may continue to retain and use that information where data-protection law permits.

Why I use your personal information

I may use your information to:

• arrange and manage appointments;

• communicate with you about bookings or treatments;

• assess whether a treatment is suitable and safe;

• provide and adapt treatments;

• maintain accurate consultation and treatment records;

• provide appropriate treatment advice and aftercare;

• take and process payments;

• respond to enquiries;

• manage complaints, incidents or insurance matters;

• comply with legal, regulatory, professional and insurance requirements;

• operate and improve my business and website; and

• send marketing communications where permitted by law and where you have the appropriate choice to opt in or opt out.

I do not use your health information for marketing.

My lawful bases

The lawful basis I rely upon depends on why I am using your information.

These may include:

• Contract - where information is necessary to arrange or provide a treatment or service you have requested.

• Legal obligation - where I am required by law to keep, use or disclose particular information.

• Legitimate interests - where using the information is reasonably necessary to operate and protect my business, maintain appropriate records, deal with enquiries, complaints or potential claims, and where those interests are not overridden by your rights and interests.

• Consent - where I have specifically asked for your consent, such as certain marketing activities. Special-category health information is subject to the additional protections explained in the Health and treatment

information section above.

Fresha and other service providers

I use Fresha to help manage appointments, client records, consultation forms and payments. Information entered

into or processed through Fresha is also subject to Fresha's own privacy and security arrangements.

I may also use trusted service providers where necessary for the operation of my business, such as website and hosting providers, email and communications providers, payment providers, accountants, professional advisers, insurers and professional bodies.

I only share personal information where it is necessary and appropriate for the relevant purpose.

I do not sell your personal information.

International transfers

Some service providers I use, including Fresha and its authorised service providers, may process personal information outside the UK. Where a transfer is subject to UK international-transfer rules, the relevant provider is required to use a lawful transfer mechanism and appropriate safeguards where required by data-protection law.

Sharing information

I will not normally disclose your health or treatment information to another person without an appropriate reason. Information may be disclosed where necessary:

• with your agreement;
• to professional advisers or insurers in connection with a complaint or claim;
• where I am legally required to disclose it;
• where disclosure is necessary to protect someone's vital interests in an emergency; or

• for the establishment, exercise or defence of legal claims.

Only the information necessary for the particular purpose will be disclosed.

How long I keep your information

Client consultation and treatment records may be stored electronically and/or securely in paper form and are retained for at least five years from the date of the relevant treatment, in accordance with my current professional and insurance record-keeping requirements.

For a client who was under 18 at the time of treatment, records may need to be retained for longer in accordance with applicable professional and insurance requirements.

Records may also need to be kept for longer where required by law, taxation requirements, an insurer, an ongoing complaint, or for the establishment, exercise or defence of a legal claim.

Information that is no longer required will be securely deleted or destroyed. A request for deletion does not necessarily mean that I can immediately delete all information where I have a lawful reason or obligation to retain particular records.

Keeping your information secure

I take reasonable technical and organisational steps to keep personal information secure. Electronic client and treatment information is stored using password-protected systems and trusted service providers such as Fresha. Paper records are kept securely with access restricted.

I take particular care with health and treatment information because of its sensitive nature.

Marketing

Treatment and health information is not used for marketing. Where I send marketing communications electronically, I will do so in accordance with applicable data-protection and electronic-marketing rules.

Where consent is required, you can withdraw that consent at any time. You can also ask me to stop sending marketing communications at any time.

Website and cookies

My website may use cookies and similar technologies. Some cookies are necessary for the website to operate. Other cookies will only be used in accordance with applicable data-protection and electronic-communications rules, and where consent is required you will be given a choice before they are placed.

My website may contain links to other websites. I am not responsible for the privacy practices of third-party websites, and you should review their privacy information separately.

Automated decision-making

I do not use your personal information to make solely automated decisions that have legal or similarly significant effects on you.

Your data-protection rights

Depending on the circumstances, UK data-protection law gives you rights including the right to: • ask what personal information I hold about you and obtain a copy;

• ask me to correct inaccurate or incomplete information;
• ask me to delete your information in certain circumstances;

• ask me to restrict how your information is used in certain circumstances;
• object to certain uses of your information;
• request transfer of your information where the right to data portability applies; and

• withdraw consent where I rely on consent.

Not all rights apply in every situation. For example, I may need to retain treatment records despite a request for deletion where I have a lawful reason to keep them.

Data-protection complaints

If you have concerns about how I have collected or used your personal information, you can make a data-protection complaint to me by email using the business contact email shown on this website. Please put Data protection complaint in the subject line so I can identify it promptly.

I will acknowledge receipt of a data-protection complaint within 30 days. I will take appropriate steps to investigate the complaint, keep you informed as appropriate, and communicate the outcome without undue delay.

You also have the right to raise a concern or complaint with the Information Commissioner's Office (ICO), the UK's data-protection regulator.

Changes to this Privacy Policy

I will review this Privacy Policy periodically and update it when my business practices, services or legal obligations change.

The date of the latest version will be shown at the top of this page.

here