Privacy notice.

01Who we are

1. 1.1
   Blushed London is run by Lora Berisha, at Borehamwood and Elstree, Hertfordshire WD6. Lora Berisha is the controller of your personal information under UK data protection law: the UK General Data Protection Regulation and the Data Protection Act 2018.
2. 1.2
   If you have any question about this notice or your information, email blushedlondon@gmail.com.

02What we collect

We collect information from you when you book, fill in your health form, come to your appointment or contact us:

1. 2.1
   Contact details. Your name, email address and mobile number.
2. 2.2
   Booking details. The treatments, patch tests and consultations you book, their dates and times, your answers to the questions when you book, and your appointment history.
3. 2.3
   Your health and consent form. Your answers about your health, medicines, allergies, skin and earlier treatments, and your signature. This is health information, which the law treats as special category data and protects more strictly.
4. 2.4
   Treatment records. Lora’s notes from your appointments, such as the colours used, and photos of the treated area before and after.
5. 2.5
   Payment details. The payments you make and their status. Your card details are held by Stripe. We only see the type of card and its last four digits.
6. 2.6
   Messages. Emails you send us, and enquiries you send through our website.
7. 2.7
   Technical information. When you visit our website, our hosting provider records technical details such as your IP address, your browser and the pages you open, to keep the website working and secure.

03How we use it, and why the law allows it

1. 3.1
   Your health form is read by Lora, and used only to make sure your treatment is safe for you. It is never used for marketing.
2. 3.2
   We never sell your information, and never share it for anyone else’s marketing.

04Who we share it with

Only the providers that run our booking for us, under contract, and only for that work:

1. 4.1
   Coded for Beauty builds and runs our website and booking system, and can access records only to keep it running and to fix problems.
2. 4.2
   Cloudflare hosts our website.
3. 4.3
   Neon stores our booking records, on servers in London.
4. 4.4
   Stripe processes card payments and keeps card details securely.
5. 4.5
   Resend sends our emails.
6. 4.6
   We may also share information with our insurer or professional advisers, or where the law requires it, for example with HMRC.

05Information outside the UK

Some of our providers are based outside the UK, or may access information from outside it. When they do, your information is protected by UK adequacy regulations (for example for the European Economic Area, or for US companies certified under the UK Extension to the EU-US Data Privacy Framework), or by the International Data Transfer Agreement or Addendum approved by the Information Commissioner.

06How long we keep it

1. 6.1
   Client records, including your health and consent forms, treatment notes and photos: 7 years after your last appointment, so we can answer any question or claim about your treatment.
2. 6.2
   Payment and booking records: 6 years after the end of the tax year they belong to, as tax law requires.
3. 6.3
   Website technical records: a few days.
4. 6.4
   After that, they are deleted. If you ask us to stop using a photo, we stop using it and remove it wherever we can.

07Your rights

You have the right to:

1. 7.1
   ask for a copy of the information we hold about you;
2. 7.2
   ask us to correct anything that is wrong or incomplete;
3. 7.3
   ask us to delete your information, unless we need to keep it for the reasons above;
4. 7.4
   ask us to restrict how we use it, or object to our using it;
5. 7.5
   ask for your information in a form you can take to someone else;
6. 7.6
   withdraw your consent at any time, for example to sharing your photos, without affecting what we did before;
7. 7.7
   tell us to stop marketing emails at any time.

08Using your rights, and complaints

1. 8.1
   To use any of your rights, email blushedlondon@gmail.com. It is free, and we reply within one month.
2. 8.2
   If you are unhappy with how we look after your information, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

09Cookies

1. 9.1
   We do not use advertising or analytics cookies, and we do not track you across other websites.
2. 9.2
   When you pay a deposit, Stripe sets cookies on the payment step to prevent fraud. They are strictly necessary to take your payment.
3. 9.3
   Lora’s own booking app, for her and the people who run it, uses a cookie to keep her signed in.

10Security, decisions and changes

1. 10.1
   Your information is sent over encrypted connections, and only the people and providers in this notice can open it.
2. 10.2
   We do not make decisions about you by automated means that have legal or similarly significant effects. Our booking applies simple rules you see when you book, such as the minimum age and patch test timings, and you can always contact Lora.
3. 10.3
   Our treatments are for people aged 18 and over.
4. 10.4
   We may update this notice. The date at the top shows when it last changed.