Privacy Policy

1. Who We Are

Business name: The Skinvestment Consultant

Website: theskinvestmentconsultant.com

Contact email: emmalillybourdeaux@gmail.com

We are registered with the Information Commissioner's Office (ICO) as a data controller. Our ICO registration number will be displayed here once registration is complete.

2. What Data We Collect

Information you provide directly

• Full name and email address when you create a client portal account
• Contact details submitted via our enquiry form (name, email, phone number)
• Information about your skin concerns, skin type, and treatment goals submitted during consultations
• Payment information when purchasing products or services (processed securely by Stripe — we do not store card details)

Special category data (health information)

As a clinical skincare business, we collect and process health-related information about your skin including:

• Fitzpatrick skin type classification
• Skin concerns and conditions
• Contraindications and sensitivities
• Treatment history and clinical notes
• Recommended home care prescriptions

This data is classified as special category data under UK GDPR. We process it only with your explicit consent and for the purpose of providing clinical skincare services to you.

Information collected automatically

• Browser type and device information
• Pages visited and time spent on our website
• IP address (anonymised)
• Referral source

Information from third parties

• If you sign in using Google, we receive your name and email address from Google as permitted by their privacy policy

3. How We Use Your Data

We use your personal data for the following purposes:

• Providing our services — managing your client portal, tracking your treatment protocols, and delivering clinical skincare services
• Processing orders — fulfilling product purchases and processing payments securely through Stripe
• Communication — responding to enquiries, sending appointment reminders, and providing aftercare guidance
• Marketing emails — sending newsletters, product updates, and educational content (only with your explicit consent, unsubscribe any time)
• Improving our services — understanding how clients use our website and services
• Legal compliance — maintaining records as required by law

4. Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent — for marketing emails, health data, and optional data collection. You can withdraw consent at any time.
• Contract — to fulfil our obligations when you purchase products or services from us
• Legitimate interests — for website analytics and improving our services
• Legal obligation — where required by law to retain certain records

5. Who We Share Your Data With

We do not sell your personal data. We share it only with trusted third-party service providers who help us operate our business:

• Supabase — secure database hosting (EU servers, GDPR compliant)
• Stripe — payment processing (PCI DSS compliant, does not share your card details with us)
• Klaviyo — email marketing platform (only if you have subscribed to our mailing list)
• Vercel — website hosting (EU servers available)
• Google — authentication service if you sign in with Google
• Resend — transactional email delivery

All third-party providers are contractually required to protect your data and may only use it for the specific purpose we have engaged them for.

6. Data Storage and Security

Your data is stored securely on Supabase servers located within the European Union (EU West — Ireland), ensuring compliance with UK GDPR data transfer requirements.

We implement the following security measures:

• Row Level Security (RLS) — you can only access your own data
• SSL/TLS encryption for all data in transit
• Encrypted database storage
• Secure authentication via Google OAuth
• Role-based access controls limiting staff access to client data

7. How Long We Keep Your Data

• Client records and treatment history — retained for 7 years from your last appointment, in line with standard clinical record-keeping requirements
• Marketing email subscribers — until you unsubscribe or request deletion
• Enquiry form submissions — 2 years from submission
• Payment records — 7 years for tax and accounting purposes
• Website analytics — 26 months

8. Your Rights

Under UK GDPR you have the following rights:

• Right to access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your personal data ("right to be forgotten")
• Right to restrict processing — request that we limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at emmalillybourdeaux@gmail.com. We will respond within 30 days.

9. Cookies

Our website uses minimal cookies necessary for the site to function:

• Authentication cookies — to keep you logged in to your client portal (session cookies, deleted when you close your browser or sign out)
• Analytics cookies — anonymised data to understand how visitors use our site

We do not use advertising or tracking cookies. You can control cookies through your browser settings.

10. Children's Privacy

Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by displaying a prominent notice on our website. The date at the top of this policy indicates when it was last updated.

12. How to Complain

If you are unhappy with how we handle your personal data, you have the right to complain to the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would appreciate the opportunity to address your concerns before you contact the ICO, so please contact us first at emmalillybourdeaux@gmail.com.