Privacy Policy

1. Who we are

AF13 Aesthetics & Skin is a sole trader business operated by Fiona Russell, trading from Tranent, East Lothian, Scotland. We operate the website af13fionarussell.co.uk.

As the data controller, Fiona Russell is responsible for your personal data. If you have any questions about this policy or how we handle your data, please contact us at aestheticsfionarussell@gmail.com.

2. What personal data we collect

Data you provide directly

When you submit our contact form or make an enquiry, we collect:

• Your name
• Your email address
• The treatment or service you are interested in
• Any additional information you choose to include in your message

Special category data

Data collected automatically

When you visit our website, certain technical data may be collected automatically, including your IP address, browser type, pages visited and referring website. Please see our Cookie Policy for full details.

3. How we use your data

We use your personal data for the following purposes:

• To respond to your enquiry or consultation request
• To provide information about treatments you have asked about
• To book and manage appointments
• To comply with legal obligations including health and safety regulations
• To improve our website and services

We do not use your data for automated decision-making or profiling.

4. Legal basis for processing

Under UK GDPR, we rely on the following legal bases:

• Consent — where you have actively submitted a form or opted in to communications
• Legitimate interests — to respond to enquiries and run our business effectively
• Legal obligation — where we are required to retain records for regulatory or tax purposes

For special category health data, we rely on your explicit consent, which you give when you submit an enquiry specifying a treatment.

5. How long we keep your data

• Enquiry and contact form data: up to 2 years from last contact
• Client appointment and treatment records: up to 7 years (clinical record-keeping guidance)
• Financial records: 6 years (HMRC requirement)

When data is no longer required, it is securely deleted.

6. Who we share your data with

We do not sell your personal data. We may share it with:

• Faces Consent — our booking system provider, to manage consultation bookings
• Google — via reCAPTCHA on our contact form (Google Privacy Policy)
• SiteGround — our hosting provider, who store data on secure servers
• Legal or regulatory authorities where required by law

All third-party processors are required to handle your data securely and in accordance with UK GDPR.

7. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct any inaccurate or incomplete data
• Request erasure of your data ("right to be forgotten")
• Restrict or object to how we process your data
• Data portability — receive your data in a machine-readable format
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us at aestheticsfionarussell@gmail.com. We will respond within 30 days.

8. Data security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or destruction. Our website uses HTTPS encryption and our hosting provider maintains industry-standard security.

9. Transfers outside the UK

Some third-party service providers may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the ICO.

10. Changes to this policy

We may update this Privacy Policy from time to time. The date at the top of this document shows when it was last revised. We encourage you to review this page periodically.