Privacy Policy

Skin Solutions Henley is committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains what information we collect, how and why we use it, how long we keep it, who we may share it with, and your rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.

Data Controller

The data controller responsible for your personal data is:

Skin Solutions Henley
Belmont House, New Street
Henley-on-Thames
RG9 2BP

Email: enquiries@skinsolutionshenley.com
Phone: 01491 522106

Information We Collect

We collect and process the following categories of personal data where relevant:

Personal details — your name, date of birth, postal address, email address and telephone number.
Medical and health information — relevant health conditions, medications, allergies, medical history and other information necessary to assess your suitability for treatment and provide treatments safely.
Treatment records — consultation notes, consent forms, treatment plans, products used, treatment details, aftercare information, reviews and treatment outcomes.
Clinical photographs — photographs taken before, during and/or after treatment where required for clinical assessment, treatment planning, monitoring outcomes, maintaining appropriate treatment records and meeting applicable professional or insurance requirements.
Marketing photographs and media — photographs, videos or other media used for marketing, advertising, social media, educational or promotional purposes where separate appropriate consent has been obtained.
Communications — correspondence and communications between you and Skin Solutions Henley, including enquiries, appointment communications, complaints and aftercare correspondence.
Payment and transaction information — information required to process payments for treatments and services. Payment card information may be processed securely by our payment provider rather than being stored directly by Skin Solutions Henley.
Website usage and technical data — information that may be collected when you visit our website, including your IP address, browser and device information, pages visited and referring website, subject to applicable cookie and data protection requirements.

We only collect information that is reasonably necessary for the purposes for which it is being processed.

Health Information and Special Category Data

Information concerning your health is classified as special category personal data under UK GDPR and receives additional legal protection.

We process relevant health information where necessary to assess your suitability for treatment, identify contraindications and risks, provide treatment safely, maintain appropriate treatment records, manage complications or adverse events and meet applicable legal, professional and insurance obligations.

Where UK data protection law requires an additional condition for processing special category data, Skin Solutions Henley will ensure that an appropriate condition is identified and documented.

We will not use your health information for unrelated purposes without an appropriate lawful basis.

Legal Basis for Processing

Under UK GDPR, we must have a lawful basis for processing your personal data. Depending upon the information concerned and the reason for processing it, we may rely on:

Consent — where you have given clear consent for us to process your personal data for a particular purpose, including certain marketing communications or the use of photographs or videos for marketing and promotional purposes.
Contract performance — where processing is necessary to provide a consultation, treatment or other service you have requested or to take steps at your request before providing that service.
Legal obligation — where processing is necessary for us to comply with an applicable legal obligation.
Legitimate interests — where processing is necessary for our legitimate business or professional interests, including maintaining appropriate records, improving our services, protecting client safety, managing complaints, preventing fraud and establishing, exercising or defending legal claims, provided those interests are not overridden by your rights and freedoms.

Where we process special category information such as health data, we will also rely upon an appropriate condition for processing that information as required by UK data protection law.

How We Use Your Information

We may use your personal data for the following purposes:

Providing consultations and treatment — to assess your suitability, understand your concerns and objectives, plan and deliver treatments and provide appropriate follow-up and aftercare.
Client safety — to maintain accurate treatment records, identify contraindications, record treatment details, monitor outcomes and manage adverse reactions or complications.
Clinical documentation — to maintain appropriate written and photographic records relating to consultations and treatments.
Communication — to contact you regarding enquiries, appointments, consultations, aftercare, treatment reviews, treatment recommendations and other matters relating to the services you receive from us.
Marketing — to send marketing communications or use identifiable photographs or media for promotional purposes where we have an appropriate lawful basis and, where required, your consent.
Legal, regulatory, professional and insurance purposes — to comply with applicable obligations, respond appropriately to complaints or incidents and establish, exercise or defend legal or insurance claims.
Service improvement — to review our services and client experience and, where appropriate, analyse anonymised or aggregated information.
Payment processing — to process payments, refunds and other financial transactions.

We will not use your personal information for purposes that are incompatible with the purposes for which it was collected unless permitted or required by law.

Clinical Photographs

Clinical photographs are required for certain treatments and may be taken before, during and/or after treatment for purposes including assessment, treatment planning, documenting treatment, monitoring outcomes, managing complications, maintaining appropriate records and complying with applicable professional or insurance requirements.

Where clinical photographs are required as part of the treatment record or our applicable insurance requirements, Skin Solutions Henley may be unable to provide the treatment if the required photographs cannot be taken and retained.

Clinical photographs taken for these purposes form part of your confidential treatment record and will be stored and handled accordingly.

Clinical photography is separate from marketing photography.

We will not use identifiable clinical photographs for advertising, social media, promotional or other marketing purposes solely because they have been taken as part of your treatment record.

Where we wish to use identifiable photographs, videos or other media for marketing or promotional purposes, separate appropriate consent will be obtained.

You are not required to consent to marketing use of your photographs in order to receive treatment. Refusing or withdrawing consent for marketing use will not affect your eligibility for treatment, provided that any clinical photographs required as part of the treatment and treatment record can still be taken and retained.

Medical and Treatment Records and Data Retention

Skin Solutions Henley retains consultation, medical, treatment and related records for an appropriate period having regard to applicable legal requirements, professional guidance, insurance requirements, client safety and the need to establish, exercise or defend legal claims.

Our retention periods may vary according to the nature of the information and the circumstances in which it was collected.

Records may be retained for longer where there is an ongoing treatment, complaint, adverse event, insurance matter, legal claim or other legitimate legal, regulatory, professional or clinical reason for doing so.

When personal data is no longer required and there is no lawful reason for retaining it, it will be securely deleted, destroyed or anonymised as appropriate.

Electronic records are protected using appropriate technical and organisational security measures, with access restricted to persons who require access for legitimate purposes.

Any paper records that are maintained are stored securely with access appropriately restricted.

Data Sharing

We do not sell, rent or trade your personal data.

We may share relevant information where reasonably necessary with:

Practitioners, prescribers and healthcare professionals involved in your consultation, treatment, prescribing, aftercare or management of a complication.
Payment processors — including PayPal and any other payment provider we use to process payments securely.
IT, website, booking, communications and hosting providers that provide services necessary for the operation of our business and systems.
Product manufacturers or suppliers where appropriate in connection with an adverse event, product concern, investigation or other legitimate treatment-related matter.
Insurers and professional indemnity providers where necessary in connection with insurance requirements, an incident, complaint, potential claim or actual claim.
Legal and professional advisers where necessary to obtain professional advice or to establish, exercise or defend legal claims.
Regulators, professional bodies, public authorities, law enforcement agencies or other appropriate organisations where disclosure is required or permitted by law or is necessary in connection with an applicable professional, regulatory or safety obligation.

We only disclose information that is reasonably necessary for the relevant purpose.

Where third parties process personal data on our behalf, we take appropriate steps to ensure suitable contractual and data protection safeguards are in place.

Payment Processing

Online payments may be processed through PayPal or another payment provider identified to you at the point of payment.

Payment providers process payment information in accordance with their own privacy and security policies.

Skin Solutions Henley does not ordinarily receive or retain complete payment card details where these are entered directly into a third-party payment provider’s secure payment system.

We may retain appropriate transaction information, such as the amount paid, date of payment, transaction reference, payment status and details necessary for accounting, refunds and record keeping.

Cookies and Website Analytics

Our website may use cookies and similar technologies to operate correctly, maintain security, remember preferences, process bookings or payments and understand how visitors use the website.

Cookies are small files or pieces of information stored on or accessed from your device when you use a website.

Depending upon the services and technologies used on our website, these may include:

Strictly necessary cookies and technologies — required for essential website functionality, security, booking or other services requested by you.
Analytics cookies and technologies — used, where applicable, to help us understand how visitors use our website and improve its performance.
Functional cookies and technologies — used, where applicable, to remember choices or provide additional website functionality.
Third-party cookies or technologies — which may be used where our website incorporates services provided by third parties.

Where consent is required for a cookie or similar technology, it will not be used until the appropriate consent or choice has been obtained.

You can manage applicable cookie preferences through the cookie controls provided on our website and may also be able to control cookies through your browser settings.

Blocking or disabling certain technologies may affect the operation or functionality of parts of the website.

Marketing Communications

Where required by law, we will only send electronic marketing communications where you have provided the necessary consent or another lawful basis permits us to do so.

You can withdraw your consent or unsubscribe from marketing communications at any time using the unsubscribe facility provided in the communication, where available, or by contacting us.

Withdrawing consent to marketing will not affect communications that are necessary in connection with your appointments, treatment, aftercare or other services you have requested.

Your Rights Under UK GDPR

Depending upon the circumstances and the lawful basis upon which your personal data is processed, you may have the following rights:

Right of access — you can request a copy of personal data we hold about you, commonly known as a Subject Access Request.
Right to rectification — you can ask us to correct personal data that is inaccurate or complete information that is incomplete.
Right to erasure — you may ask us to delete your personal data in certain circumstances, subject to circumstances in which we are entitled or required to retain it.
Right to restriction of processing — you may ask us to restrict how we process your personal data in certain circumstances.
Right to data portability — in applicable circumstances, you may request personal data in a structured, commonly used and machine-readable format.
Right to object — you may object to certain processing, including processing based upon legitimate interests and direct marketing.
Right to withdraw consent — where processing is based upon consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

These rights are not absolute and different rights apply in different circumstances.

For example, a request to erase information does not necessarily require us to delete consultation or treatment records that we have an appropriate lawful reason to retain.

How to Exercise Your Rights

To exercise your data protection rights or ask a question about how Skin Solutions Henley handles your personal information, please contact:

Post: Skin Solutions Henley, Belmont House, New Street, Henley-on-Thames, RG9 2BP
Phone: 01491 522106
Email: enquiries@skinsolutionshenley.com

We will respond to valid requests within the period required by applicable data protection legislation.

This will normally be within one month. Where the law permits additional time because a request is particularly complex or multiple requests have been made, we will inform you where an extension is required.

We may need to verify your identity before disclosing personal information or acting upon certain requests.

Data Security

We take appropriate technical and organisational measures designed to protect personal information against unauthorised or unlawful access, alteration, disclosure, loss or destruction.

Access to client information is restricted to persons who require it for legitimate business, professional or treatment-related purposes.

Where we use third-party systems or service providers to process or store personal information, we take reasonable steps to select providers that maintain appropriate data protection and security safeguards.

International Data Transfers

Some third-party service providers used by Skin Solutions Henley may process or store personal information outside the United Kingdom.

Where personal data is transferred internationally, we will take appropriate steps to ensure that the transfer is permitted under UK data protection law and that appropriate safeguards are in place where required.

Complaints About Your Personal Data

If you are unhappy with how we have handled your personal data, please contact us so that we have an opportunity to investigate and address your concerns.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

Information Commissioner’s Office
Telephone: 0303 123 1113

Further information about your data protection rights and how to make a complaint is available from the ICO.

We would appreciate the opportunity to address your concerns before you contact the ICO, although you are not required to contact us before exercising your right to complain to the ICO.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, systems, data processing activities, legal requirements, professional requirements or regulatory guidance.

Any significant changes will be published on our website. We recommend reviewing this Privacy Policy periodically to remain informed about how we process and protect your personal information.

Last reviewed: September 2026