Privacy Policy

Last updated 17 August 2026

This policy explains what personal information The Skin Lab & Laser collects, why we collect it, how long we keep it and what you can do about it. Some of what we hold is health information, which the law treats more strictly than the rest, that is covered in section 3.

1. Who we are

The Skin Lab & Laser, a limited company registered in England and Wales, company number 17192456, of 69b Sankey Street, Warrington, Cheshire WA1 1SL. We are the data controller for the information described in this policy.

If you have any question about this policy, or want to exercise any of the rights in section 9, contact us on 07398 896462 or at hello@theskinlabandlaser.co.uk.

2. What we collect

When you use the enquiry form

Your name, phone number, email address, the treatment area you are interested in, and your preferred day. We use this to contact you and arrange a patch test. Nothing more.

When you come in for a patch test or treatment

A consultation record. This includes your contact details, date of birth, GP details if you give them, and the health information described in section 3. We also record the laser settings used, the areas treated, the date of each session and any reaction you had.

When you pay us

SumUp processes card payments. We receive confirmation that a payment succeeded and the last four digits of the card. We never see or store your full card number.

When you visit this website

Aggregate statistics through Google Analytics, pages viewed, roughly where in the country you are, what device you used. See section 10 and our cookie policy.

3. Health information

Specifically, we record: your Fitzpatrick skin type; whether you are pregnant or breastfeeding; whether you take any photosensitising medication, including antibiotics and isotretinoin; whether you have epilepsy; any history of cold sores near the treatment area; any tattoos or moles in the treatment area; and recent sun or fake tan exposure.

UK GDPR calls this “special category” data and sets a higher bar for using it. We rely on Article 9(2)(h), processing necessary for the provision of health care or treatment by, or under the responsibility of, a professional subject to an obligation of confidentiality. Everyone who sees your record is bound by that obligation.

You can decline to answer. We will not be able to treat you if you do, because we cannot set the laser safely without knowing.

4. Why we can use it

What	Lawful basis	Why
Enquiry details	Legitimate interests	You asked us to get in touch about a treatment.
Booking and treatment records	Contract	We cannot deliver a treatment you have paid for without them.
Health information	Article 9(2)(h)	Necessary to treat you safely.
Treatment records kept after your course	Legal obligation and legitimate interests	Insurance and the defence of any future claim.
Before-and-after photographs	Consent	See section 5. You can withdraw it at any time.
Website analytics	Consent	See section 10.

5. Photographs

We may ask to photograph the treatment area before your first session and at intervals afterwards. This is clinical record-keeping, it is how we tell whether the treatment is working.

We ask separately, in writing, before using any photograph for anything else, including our website or social media. Consent for clinical photographs and consent for marketing photographs are two different things and we will never treat one as the other. You can withdraw marketing consent at any time by telling us, and we will remove the image from anything we control.

6. Who we share it with

We do not sell your information to anyone, and we do not share it for anyone else’s marketing.

• WordPress, our booking and records system. They process data on our instructions only.
• SumUp, card payments.
• Google, website analytics, if you have consented. See section 10.
• Our accountant, transaction records, not treatment records.

We will also disclose information where the law requires it, or where there is a serious risk to someone’s safety.

7. How long we keep it

Record	Kept for
Enquiries that never became bookings	12 months, then deleted
Treatment records, adults	7 years from your last session
Treatment records, under-18s	Until the client’s 25th birthday
Clinical photographs	With the treatment record, on the same clock
Financial records	6 years, as HMRC requires
Analytics data	14 months in Google Analytics

8. Where it is stored

Our booking and records system stores data. Google Analytics processes data on servers outside the UK, including in the United States. Where information leaves the UK, it is protected by the UK International Data Transfer Addendum or an adequacy decision.

9. Your rights

Under UK GDPR you can ask us to:

• give you a copy of what we hold about you
• correct anything that is wrong
• delete it, though we may have to keep treatment records for the periods in section 7
• restrict what we do with it while a dispute is resolved
• send it to another provider in a portable format
• stop processing based on legitimate interests

You can withdraw consent, for photographs, or for analytics, at any time, without affecting anything done before you withdrew it.

Ask us in writing at hello@theskinlabandlaser.co.uk. We respond within one month and we do not charge.

10. Cookies

We use Google Analytics to understand how people use this site. It sets cookies. We ask before we set them, and the site works normally if you say no.

The full list is in our cookie policy.

11. Complaints

Tell us first, most things are quicker to fix directly. If you are not satisfied, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not need our permission and it does not cost anything.

12. Changes

If we change this policy we update the date at the top. If a change materially affects how we use your health information, we will tell you directly rather than relying on you noticing.