Who we are
The Face Place is a nurse-led aesthetics clinic at Room 2, 11–12 Morgan Street, Tredegar NP22 3NA, run by Carly's full name or business name. In this policy, "we" and "us" means The Face Place.
We're responsible for the personal information you share with us (the "data controller"). If you have any questions about this policy or your information, email thefaceplacewales@gmail.com or call 07792 686134.
ICO registration number: add if registered with the Information Commissioner's Office
What information we collect
When you contact us
If you use our contact form, email, call or message us, we collect your name, contact details and anything you tell us in your message.
When you book
Bookings are made through our booking system, confirm: Aesthetic Nurse Software. It collects your name, contact details and appointment details, and payment details for your booking fee.
If you open a Beauty Bank or become a member
We keep your Beauty Bank balance, your membership and a record of your payments, linked to your account. Card payments are handled by Stripe, our payment provider: your card details go straight to Stripe and we never see or store them.
Before and during treatment
To treat you safely, we need to know about your health. Before treatment we collect your medical history, any medication you take, allergies and other health information, along with consultation notes, consent forms and treatment records. This may include photographs taken before and after treatment, which we only take with your consent.
Health information is "special category" data under data protection law, and we take particular care with it.
How we use your information
- To reply to your enquiries
- To book, manage and remind you about appointments
- To assess whether a treatment is safe and suitable for you, carry it out, and provide aftercare
- To keep accurate clinical records, as required of a registered nurse
- To take payments and keep financial records
- To send you news and offers, but only if you've agreed to this. You can opt out at any time
Our legal reasons for using it
Data protection law requires us to have a lawful basis for using your information. Ours are:
- Contract: to provide the treatments you've booked
- Legal obligation: to keep clinical and financial records
- Legitimate interests: to reply to your enquiries and run our clinic
- Consent: for marketing, and for using treatment photographs for anything other than your clinical record
- For health information, we rely on the provision of health care, or on your explicit consent
Who we share it with
We never sell your information. We only share it with:
- services that help us run the clinic, such as our booking system, website host and email provider, who may only use it on our behalf
- Stripe, which takes Beauty Bank and membership card payments and refunds on our behalf
- your GP or another healthcare professional, if it's needed for your safety, ideally with your agreement
- authorities, if the law requires it
Photographs
Before and after photographs are part of your clinical record. We will only use them on our website or social media if you've given separate written consent, and you can withdraw that consent at any time.
How long we keep it
We keep clinical records for retention period, following professional guidance. Enquiries that don't lead to a booking are deleted after e.g. 12 months. Financial records are kept for as long as the law requires.
Your rights
You have the right to:
- ask for a copy of the information we hold about you
- ask us to correct anything that's wrong
- ask us to delete your information, where we don't need to keep it by law
- object to, or ask us to limit, how we use it
- withdraw your consent at any time, where we rely on it
To use any of these rights, email thefaceplacewales@gmail.com. We'll reply within one month.
If you're unhappy with how we've handled your information, please talk to us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
Our website
Our website is hosted by Uddify. It uses fonts from Google Fonts, and shows reviews and our Instagram feed using Elfsight. These services may receive your device's IP address, and some may set cookies, when you visit pages that use them.
Cookies and analytics
With your permission, we use Google Analytics to understand how visitors use our website, for example which pages are visited and how people find us. It sets cookies (whose names start with _ga) and sends information such as the pages you view, your approximate location and the type of device you use to Google. We don't use it to identify you, and we don't use it for advertising.
Google Analytics only runs if you click Accept on our cookie banner. If you click Reject, no analytics cookies are set. You can change your mind at any time using Cookie settings at the bottom of every page.
Your choice, and your loyalty card details if you use it, are remembered on your own device using your browser's storage.
Our contact form sends your message to our email inbox using FormSubmit (formsubmit.co), which passes it on to us and does not use it for anything else.
Your account and loyalty card
If you join our loyalty scheme, we keep your name, email address, the number of stamps and rewards on your card, and the dates they were added. You open your card by entering your email address on our website, or by signing in to your account ("My account"). If you create an account, we also keep your sign-in details; your password is stored securely by Google and we can't see it. This is run using Google Firebase, which stores the information in London on our behalf. We don't use it for marketing. If you'd like to leave the scheme and have your card and account deleted, email thefaceplacewales@gmail.com. how long cards are kept if unused, e.g. 2 years
Keeping it safe
We take appropriate steps to keep your information secure, and only people who need it to provide your care can see it.
Changes to this policy
We may update this policy from time to time. The latest version will always be on this page.
Last updated: date to add when published