Privacy Policy

Straday Studio is the data controller responsible for deciding how and why your personal information is used.

Website: www.stradaystudio.co.uk
Email: hello@stradaystudio.co.uk
Telephone: 07951 528560

In this policy, “Straday Studio”, “we”, “us” and “our” mean Straday Studio and the practitioners working on its behalf.

Where a practitioner is independently responsible for deciding how your information is used, that practitioner may also be a separate data controller and should provide you with their own privacy information where necessary.

The information we collect depends on how you interact with us and the services you use.

Identity and contact information

This may include:

• your name;
• title;
• date of birth;
• postal address;
• email address;
• telephone number;
• emergency contact information;
• the name and contact details of a parent, guardian or authorised representative where appropriate; and
• information needed to confirm your identity.

Appointment and client information

This may include:

• appointments you request, book, change or cancel;
• treatments and services you have received;
• consultation information;
• treatment preferences and goals;
• appointment confirmations and reminders;
• cancellations, non-attendance and deposits;
• aftercare communications;
• feedback and reviews;
• complaints and concerns; and
• correspondence relating to your appointment or treatment.

Payment and transaction information

This may include:

• treatments or services purchased;
• amounts paid;
• deposits;
• refunds;
• outstanding balances;
• payment dates;
• transaction references; and
• information required for accounting and tax purposes.

Payments may be processed by a bank, card processor, booking provider or other independent payment service.

We do not normally receive or retain your complete debit or credit card details.

Health and medical information

To assess whether a treatment is appropriate and safe, we may collect information about your health, including:

• your medical history;
• current or previous medical conditions;
• allergies and sensitivities;
• medications and supplements;
• pregnancy or breastfeeding information;
• previous cosmetic, medical or surgical treatments;
• previous reactions, complications or adverse events;
• contraindications;
• skin type and skin concerns;
• consultation and assessment notes;
• consent forms;
• treatment plans;
• treatment records;
• products or medicines used;
• product names and batch numbers;
• aftercare information;
• treatment outcomes; and
• complications, reactions or follow-up care.

Health information is classed as special-category personal data and receives additional legal protection.

You do not have to provide information that is irrelevant to your treatment. However, we may be unable to provide a consultation or treatment safely if you do not provide the health and suitability information we reasonably require.

Photographs and videos

We may take photographs or videos before, during or after a consultation or treatment.

These may be used to:

• assess your suitability for treatment;
• document your starting point;
• plan your treatment;
• record the treatment provided;
• monitor your progress and results;
• provide follow-up care;
• obtain appropriate professional advice;
• investigate an adverse event or complaint;
• support insurance or legal matters; and
• maintain an accurate clinical record.

Clinical photographs form part of your confidential client or treatment record.

We will ask for separate and specific permission before using identifiable photographs or videos for:

• our website;
• social media;
• advertising;
• promotional materials;
• educational content;
• treatment portfolios; or
• before-and-after marketing.

You can decline promotional photography without affecting the service or treatment you receive.

You can withdraw promotional consent at any time by contacting us. Withdrawal will apply to future use. It may not always be possible to retrieve printed materials or content that was lawfully published or distributed before your consent was withdrawn.

Website and technical information

When you use our website, we may collect:

• your IP address;
• browser type;
• device type;
• operating system;
• approximate location;
• pages viewed;
• links selected;
• time spent on the website;
• referring website or search engine;
• website errors;
• cookie preferences; and
• information about how you navigate and use the website.

Enquiries and communications

We may keep information you provide when contacting us through:

• our website;
• email;
• telephone;
• text message;
• WhatsApp;
• Instagram;
• Facebook;
• online booking services; or
• another communication platform.

Please avoid including detailed medical information in public social-media comments or other public messages. We may ask you to continue the conversation privately or through a more secure system.

Mailing-list information

When you join our mailing list, we may collect:

• your name;
• your email address;
• your marketing preferences;
• the date and method by which you subscribed;
• a record of your consent;
• whether an email was successfully delivered;
• whether you opened an email;
• whether you selected a link; and
• whether you unsubscribed.

We may collect personal information:

• directly from you;
• through our website;
• through an online booking or consent platform;
• during a consultation or appointment;
• through consent forms and medical questionnaires;
• through email, telephone, WhatsApp, text or social media;
• from a parent, guardian or authorised representative;
• from a prescriber, pharmacy, healthcare professional or treatment provider where appropriate;
• through payment providers;
• from publicly available sources where it is fair and lawful to do so; and
• automatically through cookies and similar website technologies.

Where another person provides us with information about you, we will only use it where there is an appropriate and lawful reason to do so.

We may use your information to:

• respond to enquiries;
• help you choose an appropriate service;
• create and manage your client account;
• arrange and manage appointments;
• confirm, change or cancel bookings;
• send appointment reminders;
• provide consultations, treatments and services;
• assess whether a treatment is safe and suitable;
• identify contraindications or potential risks;
• obtain informed consent;
• create and maintain accurate treatment records;
• provide appropriate aftercare and follow-up;
• contact you about a treatment reaction, complication or safety matter;
• communicate with a prescriber, pharmacy or healthcare professional where appropriate;
• process payments, deposits and refunds;
• keep accounting and tax records;
• manage complaints, concerns and insurance matters;
• establish, exercise or defend legal claims;
• meet our legal, professional, regulatory and insurance responsibilities;
• protect clients, practitioners and the business;
• maintain the security of our website, accounts and systems;
• prevent fraud, misuse or unauthorised access;
• understand how our website is used;
• improve our website, treatments and services;
• send mailing-list communications where permitted; and
• manage the administration and operation of Straday Studio.

We will not use your personal information for a purpose that is incompatible with the reason it was originally collected unless the new use is permitted by law.

Data-protection law requires us to have a lawful reason for using personal information.

The lawful basis we use will depend on the information and the reason it is being processed.

Contract

We may use your information where it is necessary to:

• take steps at your request before you book;
• arrange or manage your appointment;
• provide the treatment or service you requested;
• process your payment;
• provide aftercare; or
• fulfil our agreement with you.

Legal obligation

We may use your information where necessary to meet legal responsibilities, including:

• accounting and tax requirements;
• responding to lawful requests;
• maintaining records required by law; and
• cooperating with regulators, courts or law-enforcement authorities.

Legitimate interests

We may use information where it is reasonably necessary for our legitimate business interests and those interests do not unfairly override your rights.

These interests may include:

• responding to enquiries;
• managing appointments and client relationships;
• maintaining accurate records;
• improving our services;
• protecting client and practitioner safety;
• protecting the business;
• preventing fraud or misuse;
• maintaining website and account security;
• handling complaints;
• recovering money owed; and
• establishing, exercising or defending legal claims.

Where we rely on legitimate interests, we consider the necessity of the processing and its possible effect on you.

Consent

We may rely on your consent for activities including:

• adding you to our mailing list;
• sending certain marketing communications;
• using non-essential cookies or similar technologies where consent is required;
• using identifiable photographs or videos for promotional purposes; and
• processing certain sensitive information where explicit consent is the appropriate legal condition.

You can withdraw your consent at any time.

Withdrawing consent does not affect processing that took place lawfully before consent was withdrawn.

Vital interests

In an emergency, we may use or share information where it is necessary to protect your life or another person’s life.

Information concerning your health is special-category personal data.

We must have both:

• a lawful basis for processing under data-protection law; and
• an additional legal condition permitting us to use special-category information.

Depending on the circumstances, we may rely on:

• your explicit consent;
• processing necessary for the provision or management of treatment or care by, or under the responsibility of, an appropriately registered healthcare professional who is subject to confidentiality obligations;
• processing necessary to establish, exercise or defend legal claims;
• processing necessary to protect someone’s vital interests where they are unable to give consent; or
• another condition permitted by UK data-protection law.

We only collect health information that is relevant to:

• treatment safety;
• suitability assessments;
• informed consent;
• treatment planning;
• aftercare;
• complication management;
• professional record keeping;
• insurance requirements; and
• legal responsibilities.

We do not use information about your health, medical history or previous treatments to target marketing communications unless you have given separate, explicit permission for that specific use.

Some information is required so that we can:

• respond to your request;
• enter into an agreement with you;
• assess whether a treatment is safe;
• obtain informed consent;
• provide treatment or aftercare;
• process a payment; or
• comply with legal and professional responsibilities.

Where information is necessary, failing to provide it may mean that we cannot:

• accept or confirm your booking;
• recommend a treatment;
• provide a consultation;
• safely carry out a treatment; or
• continue providing a service.

Joining our mailing list and agreeing to promotional photography are entirely optional.

Our website currently links to FACES Consent for online booking and treatment-related administration.

FACES Consent may be used for:

• client accounts;
• appointment bookings;
• medical questionnaires;
• treatment consent forms;
• treatment records;
• clinical photographs;
• aftercare forms;
• payment information; and
• appointment communications.

When you use FACES Consent, your information may be processed by both Straday Studio and Faces Consent Limited.

Straday Studio is responsible for how it uses your booking, health and treatment information. Faces Consent Limited also processes information according to its own privacy policy and its responsibilities as a service provider.

FACES Consent may share booking and consent information with the relevant practitioner responsible for providing your treatment.

You should read the privacy information displayed by FACES Consent when using its website, booking page or application.

You can choose to join the Straday Studio mailing list to receive:

• studio news;
• treatment and service updates;
• information about new treatments;
• skincare advice;
• educational content;
• appointment availability;
• introductory offers;
• special offers and promotions;
• events or competitions; and
• other relevant Straday Studio updates.

Joining the mailing list is optional.

You will not be automatically added to our mailing list simply because you:

• make an enquiry;
• book or attend an appointment;
• complete a consultation or consent form;
• purchase a treatment;
• provide medical information; or
• contact us through social media.

Our lawful basis for sending mailing-list emails is normally your consent.

When you sign up, we may use an email-marketing provider to:

• securely store your name and email address;
• send communications;
• manage subscriptions;
• record consent;
• monitor email delivery;
• understand whether messages are opened;
• understand which links are selected; and
• manage unsubscribe requests.

These providers process information on our behalf under appropriate contractual arrangements.

We do not sell, rent or provide our mailing list to another business for its own marketing.

We do not use your health information or treatment history to decide which marketing to send you unless you have given separate, explicit consent for that use.

Unsubscribing

You can unsubscribe at any time by:

• selecting the unsubscribe link in a marketing email;
• replying to an email and asking to be removed; or
• contacting hello@stradaystudio.co.uk.

Withdrawing your marketing consent will not affect the lawfulness of messages sent before you unsubscribed.

After you unsubscribe, we may keep your email address on a limited suppression or “do not contact” list. This helps us respect your request and prevents you from being added to the mailing list again by mistake.

Unsubscribing from marketing will not prevent us from sending essential communications about:

• an existing enquiry;
• an appointment;
• a payment;
• a treatment;
• a product-safety issue;
• aftercare;
• a complication; or
• another matter relating directly to a service you requested.

Marketing emails will identify Straday Studio and provide a clear method of unsubscribing.

Our website uses cookies and similar technologies.

Cookies are small files or pieces of information that may be stored on or accessed from your device when you visit a website.

They may be used to:

• make the website function correctly;
• maintain website security;
• remember your preferences;
• understand how people use the website;
• measure website performance;
• identify technical problems; and
• support marketing where permitted.

Essential cookies

Essential cookies are necessary for the website to operate, remain secure or provide a service you have requested.

These cookies may not require consent.

Analytics cookies

We use Google Analytics or similar analytics services to understand:

• how visitors find the website;
• which pages are viewed;
• how visitors move around the website;
• how long visitors spend on pages;
• which devices or browsers are used; and
• whether visitors encounter technical problems.

Where consent is legally required, analytics technologies will only be used after you have made an appropriate choice through our cookie controls.

Where a legal exception applies to a statistical or analytics technology, we will provide clear information and a simple way for you to object.

Marketing cookies

Marketing and advertising cookies will only be used where we have an appropriate legal basis and any required consent.

You can manage cookie preferences through:

• the cookie controls displayed on our website;
• your browser settings; and
• relevant provider opt-out settings.

Blocking certain cookies may affect how the website operates.

We only share personal information where it is necessary, proportionate and lawful.

We may share information with:

• authorised Straday Studio practitioners;
• staff or contractors who need the information to perform their role;
• Faces Consent Limited;
• Squarespace, which provides our website platform;
• website-hosting and IT providers;
• email and communication providers;
• email-marketing providers;
• Google Analytics or other analytics providers;
• banks and payment processors;
• accountants and bookkeepers;
• insurers and insurance advisers;
• legal and professional advisers;
• prescribing professionals;
• pharmacies;
• medical-product suppliers;
• healthcare professionals;
• emergency services;
• regulators and professional bodies;
• fraud-prevention and security providers;
• courts, law-enforcement agencies and public authorities where required; and
• a purchaser, successor or adviser if Straday Studio is sold, transferred or reorganised.

Where another organisation is independently responsible for its use of your information, it will act as a separate data controller and should provide its own privacy information.

Service providers acting on our behalf are only permitted to use information according to our instructions, their contractual responsibilities and applicable law.

We do not sell your personal information.

We do not share your health information with advertisers.

Some service providers may store, process or access personal information outside the United Kingdom.

This may include providers of:

• website services;
• cloud storage;
• analytics;
• email;
• communications;
• social media; and
• marketing technology.

Where information is transferred outside the UK, we take reasonable steps to ensure an appropriate level of protection.

Safeguards may include:

• transferring information to a country recognised as providing adequate protection;
• using approved contractual safeguards;
• using the UK International Data Transfer Agreement;
• using the UK Addendum to approved standard contractual clauses;
• carrying out an appropriate transfer-risk assessment; or
• using another transfer mechanism permitted by law.

FACES Consent currently states that information held within its system is stored in secure UK data centres. Other providers, including Squarespace and Google, may operate internationally.

We only retain personal information for as long as it is needed for:

• the purpose for which it was collected;
• safe treatment and aftercare;
• professional and clinical record keeping;
• insurance requirements;
• accounting and tax requirements;
• complaint handling;
• legal claims; and
• other legal or regulatory responsibilities.

Our normal retention approach is as follows.

Enquiries

General enquiries that do not lead to an appointment or treatment are normally kept for up to two years after the last meaningful contact.

They may be kept longer where necessary to manage a complaint, dispute, safeguarding matter or legal issue.

Appointment and client administration

Appointment and client-administration information is kept for as long as necessary to manage the client relationship and meet related legal, accounting, insurance and professional responsibilities.

Adult clinical and treatment records

Adult consultation, consent and treatment records are normally retained for at least eight years after the last consultation or treatment.

Records may be kept for longer where required by:

• an insurer;
• a professional or regulatory body;
• the type of treatment provided;
• an ongoing complaint or complication; or
• a potential legal claim.

Records relating to children and young people

Where we lawfully provide a service to someone under 18, relevant records may normally be retained until their 25th birthday, or their 26th birthday where treatment ended when they were 17.

A longer period may apply where required by law, insurance, professional guidance or safeguarding responsibilities.

Photographs and videos

Clinical photographs and videos are normally retained for the same period as the related consultation or treatment record.

Promotional photographs are kept until:

• consent is withdrawn;
• they are no longer required;
• the relevant campaign or material is no longer used; or
• another lawful reason for retaining them no longer applies.

Financial records

Financial, transaction and accounting information is normally retained for at least six years after the end of the relevant financial or accounting period.

Complaints, complications and legal matters

Information relating to a complaint, complication, adverse event, insurance matter or legal issue will be retained for as long as reasonably necessary to:

• investigate and resolve the matter;
• comply with insurance requirements;
• meet professional obligations; and
• establish, exercise or defend legal claims.

Mailing-list information

Mailing-list information is retained until:

• you unsubscribe;
• you withdraw consent;
• we stop operating the mailing list; or
• the information is no longer required.

Limited suppression information may be retained for as long as necessary to make sure we continue to respect your request not to receive marketing.

Website analytics

Analytics information is retained according to the settings applied within the relevant analytics service and only for as long as reasonably necessary to understand and improve website performance.

When personal information is no longer required, it will be securely:

• deleted;
• destroyed; or
• anonymised so that it can no longer identify you.

We may be unable to delete certain treatment, financial or legal records immediately where we are required or permitted to retain them.

We use appropriate technical and organisational measures designed to protect personal information from:

• accidental loss;
• unauthorised access;
• inappropriate disclosure;
• misuse;
• alteration; and
• destruction.

Measures may include:

• password-protected accounts;
• access controls;
• multi-factor authentication where available;
• encrypted systems;
• secure booking and record-management services;
• device security;
• confidentiality requirements;
• regular software updates;
• secure backups;
• controlled access to records;
• secure disposal procedures; and
• limiting access to people who genuinely need the information.

No online or electronic system can guarantee absolute security. However, we take reasonable and proportionate steps to protect the information we hold.

Your rights may depend on the type of information, the lawful basis used and the circumstances of the processing.

You may have the following rights.

Right to be informed

You have the right to be told how and why your personal information is collected and used.

Right of access

You can ask us to confirm whether we hold personal information about you and request a copy of that information.

Right to rectification

You can ask us to correct inaccurate information or complete information that is incomplete.

Clinical records will not normally be altered in a way that removes the original entry. Where appropriate, a correction or note may be added so that the record remains accurate and complete.

Right to erasure

You can ask us to delete personal information in certain circumstances.

This right is not absolute. We may need to retain information for:

• treatment and aftercare;
• client safety;
• professional record keeping;
• insurance;
• accounting or tax requirements;
• complaints; or
• legal claims.

Right to restrict processing

You can ask us to limit how your information is used in certain circumstances.

Right to object

You can object to certain processing based on legitimate interests.

You have an absolute right to object to your personal information being used for direct marketing.

Right to data portability

In certain circumstances, you can ask us to provide information you supplied in a structured, commonly used and machine-readable format or transfer it to another organisation.

Right to withdraw consent

Where processing is based on consent, you can withdraw that consent at any time.

Rights relating to automated decision-making

You may have rights where an important decision is made about you solely through automated processing.

Straday Studio does not currently make treatment or suitability decisions solely through automated decision-making.

Exercising your rights

To exercise a data-protection right, contact:

Email: hello@stradaystudio.co.uk
Telephone: 07951 528560
Post: Straday Studio, 144 Highlands Road, Fareham, PO15 5PS

We may need to ask for information to confirm your identity.

We will normally respond without undue delay and within one month. The response period may be extended where permitted by law, for example where a request is particularly complex.

There is normally no charge for exercising your rights. A reasonable fee may be charged, or a request may be refused, where a request is manifestly unfounded or excessive.

You have the right to complain if you are concerned about how we have collected or used your personal information.

You can submit a data-protection complaint by:

• emailing hello@stradaystudio.co.uk;
• telephoning 07951 528560; or
• writing to Straday Studio, 144 Highlands Road, Fareham, PO15 5PS.

Please include:

• your name and contact details;
• a description of your concern;
• relevant dates;
• details of any previous communications; and
• the outcome you are seeking, where possible.

We will:

• provide a clear way for you to make a complaint;
• acknowledge your complaint within 30 days;
• take appropriate steps to investigate;
• keep you informed where necessary; and
• tell you the outcome without undue delay.

We would appreciate the opportunity to investigate and resolve your concern directly.

You also have the right to complain to the UK data-protection regulator:

Telephone: 0303 123 1113
Website: www.ico.org.uk

You do not need to contact us before approaching the Information Commissioner’s Office.

Our website and mailing list are not directed at children.

We do not knowingly collect personal information directly from children for marketing purposes.

Where a beauty or skincare service may lawfully be provided to someone under 18, we may collect information relating to:

• the young person;
• their parent or guardian;
• parental responsibility;
• consent;
• health and suitability; and
• the service provided.

We may need to verify age, identity and parental responsibility.

Certain treatments are not available to anyone under 18, regardless of parental consent.

We take additional care when using children’s information and will not use it for marketing without appropriate lawful permission.

Our website may contain links to external services, including:

• FACES Consent;
• Instagram;
• Facebook;
• Google;
• payment services; and
• other third-party websites.

When you follow an external link or communicate with us through another platform, that provider may collect and use your information according to its own privacy policy.

We are not responsible for the privacy practices, security or content of independently operated websites and platforms.

We may update this Privacy Policy where:

• our services change;
• our premises or contact details change;
• we introduce a new booking, marketing or technology provider;
• our information practices change;
• professional or insurance requirements change; or
• data-protection law or guidance changes.

The latest version will be published on our website and the date at the top of the policy will be updated.

Where a change significantly affects how we use existing client information, we will take reasonable steps to bring the change to the attention of those affected.

For questions about this policy or how we use your personal information, contact:

Website: www.stradaystudio.co.uk
Email: hello@stradaystudio.co.uk
Telephone: 07951 528560