Privacy policy
Last reviewed: August 2026 · Draft pending client sign-off
Who we are
SKIN Aesthetics & Academy Ltd ("we", "us") operates Skin Aesthetics by Krystian, an aesthetic clinic at 15 Old Bridge Close, Bursledon, Southampton SO31 8AX, and the website skinaestheticsbykrystian.com. We are the data controller for the personal information described in this policy.
You can contact us about anything in this policy at info@skinaestheticsbykrystian.com or on 07394 117112.
The information we collect
- Contact details: your name, phone number and email address when you enquire, book a consultation or join our mailing list.
- Booking information: appointments are booked and managed through Fresha, which acts as a separate data controller for the account you hold with them. Their privacy policy is available at fresha.com.
- Health information: before any treatment we take a medical history and consultation record. This is special category data under the UK GDPR. We process it on the basis of your explicit consent and for the provision of health care (Article 9(2)(a) and (h)), and we treat it with strict confidentiality.
- Photographs: clinical photographs taken before and after treatment, held as part of your treatment record. They are never used in marketing without your separate written consent.
- Website data: limited technical data (such as pages visited) as described in our cookie policy.
Why we use it and our lawful bases
- To provide safe, appropriate treatment: consent and provision of health care.
- To respond to enquiries and manage appointments: our legitimate interest in running the clinic.
- To send appointment reminders and aftercare instructions: our legitimate interest in your care.
- To send occasional marketing you have opted in to: consent, which you can withdraw at any time.
- To meet our legal and insurance obligations: legal obligation, including record-keeping required by our insurer, Cathedral Insurance.
How long we keep it
Consultation and treatment records are retained for as long as required to meet our clinical, legal and insurance obligations, and are then securely deleted. Enquiry records that do not lead to treatment are deleted within 24 months. Marketing consents are kept until you withdraw them.
Who we share it with
We do not sell your information. We share it only with the service providers who make the clinic work: Fresha (bookings and payments), our email and telephone providers, and our insurer or legal advisers where a claim or complaint requires it. Any provider processing data on our behalf does so under contract and only on our instructions.
Your rights
Under the UK GDPR you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to our use of it, to receive a copy in a portable format, and to withdraw consent at any time. To exercise any of these rights, email info@skinaestheticsbykrystian.com. We respond within one month.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes to this policy
We review this policy at least annually and will post any changes on this page.