Privacy policy.

• We collect only what we need to arrange and carry out your treatments safely.
• Health details from your consultation form are used only to keep your treatment safe, and only with your consent.
• We never sell your information, and we don’t send marketing messages.
• A photo of your treatment goes online only with your permission.
• You can ask to see, correct or delete your information at any time.

The law only lets us use your information when we have a lawful reason, called a “lawful basis”. The last column gives ours, from Articles 6 and 9 of the UK GDPR.

Some treatments are only safe if we know about allergies, skin or eye conditions, medication or previous reactions. You tell us on a paper consultation form, and you sign or tick to agree to us using that information.

• We use it only to decide whether a treatment is safe for you, and how to carry it out.
• We don’t share it with anyone.
• Consultation forms and patch-test records are kept only on paper, locked away. They are never put in our booking system.
• You can withdraw your consent at any time by telling Megan. We may then be unable to carry out treatments that need it.

We may photograph your finished treatment to show our work on Instagram and this website. We only do this with your permission, which we ask for by message or with a tick on your consultation form, so there is a record of it. Saying no makes no difference to your treatment.

You can change your mind at any time by messaging or emailing us. We will then take the photo down from our website and Instagram. We can’t recall copies that other people have already shared or saved.

If you message us on WhatsApp, Instagram or Facebook Messenger, Meta, the company that runs those apps, also handles your messages under its own privacy policy. Texts and calls go through our mobile network, and emails through Microsoft (see who we share it with). Messages are kept on Megan’s phone and in the apps themselves.

We never sell your information. We share it only with the services that help us run ONE EIGHT, and only what each one needs.

Until we set up our own booking system, our appointments are kept in a Salon Iris account we share with Pure Beauty, the salon at Porchways House where our treatment room is. Pure Beauty’s team can see the appointment details kept there.

We may also share information when the law requires it, for example with HMRC.

Some of these services store or handle information outside the UK. When they do, UK law requires a safeguard so your information stays protected to the same standard.

We keep information only as long as we need it, then delete or shred it.

• Paper records are kept locked away.
• Only Megan can see consultation forms and treatment notes. Appointment details in the shared booking system can also be seen by Pure Beauty.
• Our email and booking system are business accounts protected by passwords.
• If something goes wrong with your information and it puts you at high risk, we will tell you.

You can ask us to:

• give you a copy of the information we hold about you;
• correct anything that’s wrong or incomplete;
• delete your information;
• limit how we use it;
• stop using it where we rely on our legitimate interests;
• give it to you, or to another business, in a format a computer can read.

Where we rely on your consent (health information, photos and Google Analytics), you can withdraw it at any time. That doesn’t affect anything we did before.

To ask, email [email protected] or tell Megan. It’s free. We reply within one month. If a request is complex, we may need up to two more months, and we’ll tell you why. We may ask you to confirm who you are first.

Some rights have limits. For example, we may need to keep treatment records in case of a legal claim, or payment records for our accounts, even if you ask us to delete them. If so, we’ll explain.

If you’re unhappy with how we’ve handled your information, please tell us first at [email protected], so we can try to put it right. We’ll acknowledge your complaint within 30 days, usually much sooner. Then we’ll look into it and tell you the outcome.

You can also complain to the UK regulator, the Information Commission (known as the ICO), at any time. You don’t have to come to us first.

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113 (Monday to Friday, 9am to 5pm)
• Post: Information Commission’s Office, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester M1 7BL

We’ll update this page whenever something changes, and change the date at the top.