Who we are
Sculpt Skin Spa is a premium aesthetics & wellness medspa business based in London SE1 4BA. This Privacy Policy explains how we collect, use, store and protect personal information when you visit our website, contact us, book an appointment, purchase services or products, attend the spa, join a membership, participate in offers, or otherwise interact with us.
For the purposes of UK data protection law, Sculpt Skin Spa is the data controller for personal information we decide to collect and use about our clients, website visitors, suppliers, partners and prospective clients.
Business name: Sculpt Skin Spa LTD.
Trading name: Sculpt Skin Spa.
Company number: 15977709
Address: 19 Page’s Walk, London SE1 4SB.
Website: www.sculptskinspa.com.
Privacy contact email: info@sculptskinspa.com
ICO registration number: ZC205024
If you have any questions about this Privacy Policy or how we use your personal information, please contact us using the details above.
Scope of this Privacy Policy
- our website and online forms;
- our booking, appointment and payment systems, including Vagaro and Treatwell;
- consultation forms, consent forms, treatment records, patch test records and client notes;
- email, telephone, SMS, social media and other client communications;
- in-spa visits, purchases, memberships, offers, events and promotions;
- photographs, videos, reviews and testimonials where applicable; and
- supplier, partner, hotel, gym, co-working, affiliate and influencer communications.
The personal information we collect
We may collect and use the following categories of personal information, depending on how you interact with us:
|
Category
|
Examples
|
|---|---|
|
Identity and contact details
|
Name, address, email address, telephone number, date of birth, emergency contact, customer profile details and contact preferences.
|
|
Booking and appointment data
|
Appointment dates, service history, therapist/provider allocation, booking notes, cancellations, no-show records, deposits, package usage and membership status.
|
|
Payment and transaction data
|
Payments, deposits, refunds, invoices, receipts, voucher or gift-card purchases, membership or package payments, and limited card/payment information processed through Vagaro and payment processors.
|
|
Consultation and treatment data
|
Skin concerns, skin type, treatment goals, allergies, sensitivities, medication information, pregnancy or breastfeeding status, contraindications, medical history relevant to treatment suitability, patch test records, consent forms, treatment notes, aftercare advice and progress records.
|
|
Special category data
|
Health-related information and, where relevant, images or treatment notes that reveal information about health, skin conditions or treatment suitability. This is handled with additional care.
|
|
Photographs and images
|
Before-and-after photos, treatment-progress images, skin-analysis images, consultation images, testimonial images, social media content and CCTV footage where applicable.
|
|
Marketing preferences
|
Consent records, subscription preferences, opt-outs, campaign responses, discount-code use, referral information and competition entries.
|
|
Website and technical data
|
IP address, device information, browser type, website usage, cookie identifiers, analytics data, security logs and information collected through plugins or embedded booking tools.
|
|
Communications
|
Emails, texts, SMS messages, telephone notes, social media messages, complaints, reviews, survey responses and client service requests.
|
|
Supplier and partner data
|
Business contact details, role, organisation, correspondence, contract records, payment details and due diligence information.
|
Special category health and treatment information
Some information we collect may be special category data under UK GDPR because it relates to health, treatment suitability, medical history, allergies, medication, pregnancy, breastfeeding, contraindications, skin conditions, treatment risks or similar matters.
We only collect special category information where it is relevant to providing safe, suitable and effective services, recording treatment decisions, meeting insurance or legal obligations, responding to concerns, or protecting the wellbeing of clients and staff.
Where we rely on consent or explicit consent, you can withdraw that consent at any time. Withdrawal of consent will not affect processing already carried out lawfully before withdrawal. If the information is necessary for us to provide a requested treatment safely, we may be unable to provide that treatment without it.
We keep treatment and health-related records more securely and restrict access to staff or service providers who need the information to deliver services, manage risks, provide aftercare, respond to complaints or meet business/legal obligations.
How we collect personal information
We collect personal information from you directly and from the systems you use to interact with us. This may include:
- when you complete a consultation form, consent form or patch test record;
- when you create or update a profile, book/amend an appointment, pay a deposit, leave a review, join a membership, buy a package or interact with Sculpt Skin Spa through Vagaro or Vagaro Connect;
- when you book an appointment, submit booking details, reschedule, cancel, leave a review or interact with Sculpt Skin Spa through Treatwell, Treatwell Connect, the Treatwell marketplace, app, website or booking widget;
- when you contact us by phone, email, SMS, social media or in person;
- when you attend an appointment, consultation, event, open day or promotional activity;
- when you provide feedback, reviews, testimonials, survey responses, photos or videos;
- when our website, WordPress hosting, plugins, analytics, security tools or cookie technologies collect technical information;
- from third parties where you have authorised them to share information with us, such as referral partners, hotels, gyms, co-working spaces or gift-card purchasers; and
- from public or professional sources where necessary for supplier, partner, influencer or affiliate due diligence.
Why we use personal information and our lawful bases
|
Purpose
|
Personal information used
|
UK GDPR lawful basis
|
|---|---|---|
|
Responding to enquiries
|
Name, contact details, message content, service interests
|
Legitimate interests and Contract
|
|
Managing bookings and appointments
|
Contact details, appointment details, service history, cancellation/no-show records, booking platform identifiers, Vagaro booking data, Treatwell booking data and communications relating to bookings.
|
Contract
|
|
Providing consultations and treatments
|
Consultation forms, treatment notes, allergies, medication, contraindications, skin concerns, consent forms, patch tests, aftercare records
|
Contract
|
|
Taking payments, deposits and memberships
|
Transaction information, payment status, invoices, refunds, membership/package details, deposits, payment method information and platform payment records where payment is processed through Vagaro and/or another payment provider used by Sculpt Skin Spa. Treatwell payment functionality may be available through the Treatwell platform, but Sculpt Skin Spa does not currently use Treatwell for taking payments.
|
Contract
|
|
Appointment reminders and service messages
|
Name, contact details, appointment details, booking status
|
Contract and legitimate interests:
|
|
Aftercare and treatment follow-up
|
Contact details, treatment details, aftercare instructions, feedback, progress notes
|
Contract and legitimate interests:
|
|
Direct marketing
|
Contact details, marketing preferences, service interests, campaign responses
|
Consent
|
|
Reviews, testimonials and social media content
|
Name, image, testimonial, treatment experience, social media handle
|
Consent
|
|
Website operation and security
|
IP address, device data, logs, cookies, WordPress plugin data, security events
|
Consent
|
|
Analytics and service improvement
|
Website usage, aggregated analytics, booking trends, feedback
|
Legitimate interests
|
|
Complaints and disputes
|
Client records, communications, treatment notes, photos, payments, staff records, complaint correspondence
|
Legitimate interests
|
|
Legal, insurance and regulatory compliance
|
Records required for tax, accounting, insurance, health and safety, legal claims, complaints and regulatory obligations
|
Legal obligation
|
Booking Platforms: Vagaro, Treatwell, payments and client profiles
When you book or pay through Vagaro, your personal information may be processed by Vagaro and its payment processing partners. Sculpt Skin Spa does not intend to directly store full card numbers outside authorised payment systems. Payment card information, deposits, stored-card features, recurring payments, membership payments, package payments and no-show or cancellation fees should be handled through Vagaro and its payment infrastructure where enabled.
Please review Vagaro’s own privacy information for details of how Vagaro processes information through its platform. Sculpt Skin Spa remains responsible for explaining how we use personal information for our own services and business purposes.
We also use Treatwell as a booking and marketplace platform. When you book or interact with Sculpt Skin Spa through Treatwell, Treatwell may collect and process information such as your name, contact details, appointment details, booking history, cancellation or rescheduling information, reviews, platform account details and communications relating to your booking.
Treatwell may process some information for its own platform, marketplace, account, booking, communication, review, security and legal purposes. Sculpt Skin Spa will process booking information received through Treatwell so that we can manage appointments, prepare for your treatment, provide services, communicate with you about your booking, keep appropriate business records and meet our legal, insurance and safeguarding obligations.
Treatwell payment functionality may be available through the Treatwell platform, when making appointments. Where payment is made through a third-party booking or payment platform, that platform and its payment providers may process payment information in accordance with their own terms and privacy information. Sculpt Skin Spa does not directly store full payment card numbers outside authorised payment systems.
WordPress website, forms, cookies and tracking technologies
Our website is built using WordPress. When you visit our website, information may be collected through hosting logs, WordPress functionality, security tools, contact forms, booking widgets and links, embedded content, analytics tools, cookies, pixels, scripts, tags or similar technologies.
We use necessary technologies to operate the website, protect it from abuse, remember basic settings and enable services you request, such as submitting a form or making a booking. These are usually required for the website to work properly.
We may also use analytics or similar technologies to understand how the website is used and to improve the service. Where the law allows certain low-risk statistical technologies without explicit consent, we will still provide clear information and a simple way to object where required.
We will ask for consent before using non-essential cookies or tracking technologies where consent is required. This includes advertising cookies, retargeting pixels, social media tracking technologies, cross-site tracking, cross-device tracking or technologies used for online advertising purposes.
Our cookie banner or cookie settings tool should provide further information about the categories of cookies and tracking technologies used on our website. Sculpt Skin Spa should keep a current cookie register covering plugins, analytics, security tools, booking widgets and marketing pixels.
Direct marketing and promotional communications
We may send clients and prospective clients marketing communications about our services, offers, memberships, packages, events, product recommendations, seasonal campaigns, referral incentives and relevant business updates.
We will only send electronic marketing where we have the appropriate permission or another lawful route under applicable privacy and electronic communications rules. You can unsubscribe or opt out of marketing at any time by using the unsubscribe link, replying STOP where available, changing your Vagaro preferences where available, or contacting us directly.
Where you book through Treatwell, Treatwell may send booking confirmations, reminders, review requests, service messages or platform communications in accordance with its own privacy information and user preferences. Sculpt Skin Spa is responsible for its own direct marketing and will only send marketing communications where it has an appropriate lawful basis and, where required, consent.
We may still send non-marketing service messages, such as appointment confirmations, appointment reminders, booking changes, payment receipts, aftercare information, safety notices and important updates about services you have booked.
We do not sell client personal information to third parties for their own marketing.
Photos, videos, testimonials and social media
We may take photographs or videos for treatment records, treatment planning, progress monitoring, insurance records, complaints handling or service quality. These images may form part of your confidential client record.
We will not use identifiable photos, videos, reviews or testimonials for marketing, social media, website content, advertisements, training materials or case studies unless we have appropriate permission. Marketing consent should be separate from treatment consent. You may withdraw marketing consent at any time, although content already published or shared may not always be fully removable from third-party platforms or archives.
Where photos, videos or testimonials reveal health, skin condition, treatment details or other sensitive information, we will treat them with additional care and seek explicit consent where required.
CCTV, premises safety and incident records
CCTV is operated and managed by the building landlord who is the data controller for CCTV captured. Sculpt Skin Spa does not control or routinely access CCTV footage. Any requests relating to CCTV footage, including subject access requests should be directed to the building landlord.
Children and young people
We may process information about children or young people where a treatment, consultation, patch test, parental consent process or safeguarding/safety matter requires it.
Where a client is under 18, we may require parent or guardian involvement and consent before providing certain services. We will explain what information we need, why we need it and how it will be used. We will use age-appropriate explanations where necessary.
Who we share personal information with
We may share personal information where necessary with trusted third parties who help us operate the business, provide services, meet legal obligations or protect our rights. This may include:
- Vagaro, and related booking, payment, reminder, form, membership and client-management services;
- Treatwell and related marketplace, booking, appointment, review, client communication and platform services;
- Payment processors, banks, card networks and fraud-prevention services, including those used by Vagaro, Treatwell and any other payment systems Sculpt Skin Spa actively enables.
- WordPress website hosting, maintenance, plugin, security, analytics and form providers;
- Email, SMS, telephone, social media, newsletter and marketing platform providers;
- accountants, bookkeepers, insurers, legal advisers, data protection advisers and professional consultants;
- product, treatment, device, training or insurance partners where necessary for service delivery, warranty, safety, training, complaint investigation or product support;
- hotels, gyms, co-working spaces, affiliates, influencers, UGC creators or referral partners where necessary to manage partnerships, referral codes, bookings or campaigns;
- regulators, public authorities, courts, law enforcement, tax authorities or other bodies where required or permitted by law;
- prospective buyers, investors or advisers if we reorganise, sell or transfer part of our business, subject to appropriate confidentiality and data protection safeguards.
We only share information where we have a lawful reason to do so. Where suppliers process personal information on our behalf, we expect appropriate contractual and security safeguards to be in place.
International transfers
Some of our suppliers, platforms, plugins or service providers may process personal information outside the UK. This may happen where technology providers, payment processors, marketing platforms, cloud services or support teams are based outside the UK or use international infrastructure.
How we protect personal information
We use appropriate organisational and technical measures to protect personal information. These may include secure systems, password controls, access restrictions, staff confidentiality, locked storage, secure disposal, supplier due diligence, data minimisation, staff guidance, system updates, malware protection, secure payment processing and incident response procedures.
Because some treatment information may be sensitive, access to client consultation records, treatment notes, photos and complaints should be limited to those who need the information for service delivery, aftercare, safety, complaints, insurance or legal purposes.
No website, platform or method of electronic communication is completely secure. We therefore encourage clients not to send highly sensitive treatment or health information through informal channels such as social media DMs unless we specifically ask for it and explain how it should be sent.
How long we keep personal information
We keep personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing services, keeping accurate client records, meeting legal and accounting obligations, dealing with complaints, supporting insurance requirements and protecting our legal rights. Should you require further information on this, please contact us on info@sculptskinspa.com.
Your data protection rights
Depending on the circumstances, you may have the following rights under UK data protection law:
- the right to be informed about how we use your personal information;
- the right of access to your personal information;
- the right to ask us to correct inaccurate or incomplete information;
- the right to ask us to erase personal information in certain circumstances;
- the right to ask us to restrict processing in certain circumstances;
- the right to object to processing in certain circumstances, including some direct marketing;
- the right to data portability in certain circumstances;
- the right to withdraw consent where we rely on consent or explicit consent;
- rights relating to automated decision-making, where applicable; and
- the right to complain to us and to the Information Commissioner’s Office.
Some rights are not absolute. For example, we may need to keep certain information for legal, insurance, accounting, complaint handling or legitimate business reasons.
Data protection complaints
If you are concerned about how we use your personal information, please contact us first so we can review and respond to your concern.
If you are concerned about how we use your personal information, please contact us first so we can review and respond to your concern.
You can submit a data protection complaint by emailing info@scultpskinspa.com or writing to Sculpt Skin Spa, Page’s Walk, London, SE1 4SB. Please include your name, contact details, a summary of the concern, the personal information or processing activity involved, and what you would like us to review.
We will acknowledge receipt of a data protection complaint within 30 days and respond without undue delay after we have investigated. If we need more information from you, we will let you know. We will explain the outcome of our review and any steps we have taken or propose to take.
If you are not satisfied with our response, you may complain to the Information Commissioner’s Office. ICO contact details are available at www.ico.org.uk.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, systems, suppliers, legal obligations or business operations. The latest version will be made available on our website. Where a change is significant, we may take additional steps to bring it to your attention.