Privacy notice

Who is responsible for your information?

Zoë Marise Laidlaw, trading as Sapphire Aesthetic Studio is the data controller: the person responsible for deciding how your personal information is used.

Sapphire is a sole-trader aesthetics and skincare business based in Bedlington, Northumberland. In this notice, “we”, “us” and “our” mean Sapphire Aesthetic Studio.

Website: sapphireaestheticstudio.co.uk
Email us

The information we may use

Depending on how you interact with Sapphire, we may process:

• Your name and contact details, including your email address and mobile number.
• Appointment and booking information, correspondence and enquiries.
• Consultation and treatment information.
• Relevant health information, including medical history, medications, allergies, contraindications and other information needed to assess suitability and provide treatment safely.
• Consent and treatment records, including treatment photographs or videos.
• Payment and transaction information, such as amounts, payment status and transaction references.
• Your marketing preferences.
• Technical information generated when you access the website, such as your IP address and browser/request information.

We do not receive or store your full payment-card or bank-account details.

How we use your information

We may use your information to:

• Respond personally to enquiries by email or text, and arrange consultations and appointments.
• Assess whether treatment is suitable for you and provide it safely.
• Maintain consultation, consent, treatment and aftercare records.
• Communicate with you about appointments and aftercare.
• Process and administer payments.
• Deal with complaints, queries and potential legal claims.
• Maintain the security and operation of our website and business systems.
• Send direct marketing where your recorded marketing preference or permission allows this.
• Use client photographs for marketing only where separate appropriate permission has been obtained.

Our reasons in law for using information

Data-protection law requires a lawful basis for using personal information. Where appropriate, we rely on:

• Contract: to take steps you request before providing a service, or to provide and administer an agreed service.
• Legitimate interests: for proportionate business administration, security, record management and establishing, exercising or defending legal claims. We balance these interests against your rights and interests.
• Legal obligation: where we must process or retain information to comply with applicable law.
• Consent: where genuine choice is appropriate, including optional marketing activities.

Health information is special category personal data and receives additional protection. We rely on explicit consent for relevant health and medical information where required.

Where treatment records containing health information need to be retained or used to establish, exercise or defend legal claims, we may also rely on the applicable special-category legal-claims condition.

Booking and client records

We use Timely for online booking and client management. Timely may process appointment details, client contact information, consultation and health information, consent information, treatment records and associated client information on our behalf.

Timely is not contacted merely because you browse the Sapphire website. Its booking service loads only after you actively choose a BOOK or consultation booking option.

Payments

Depending on the payment method you choose, payment information may be processed by Square, Clearpay or Klarna. These providers process information under their own privacy policies.

Website enquiries and personal replies

Our business email is hosted using Microsoft 365 / Exchange Online.

The “Ask Zoë a Question” form asks for your first name, email address, mobile number and question. All four fields are required. It also includes the page or concern you came from, so you do not need to select a treatment.

Zoë uses this information to respond personally by email or text. Email replies can sometimes go to junk folders. Your mobile number is used for personal replies about your enquiry; submitting this form does not sign you up for marketing, automated text messages or telephone callbacks.

We use this information to take steps at your request before providing a service, or for our legitimate interest in answering general questions. Please do not include medical history, medication, other medical details or photographs in the form. Relevant health information is discussed separately through our consultation process.

Cloudflare processes the enquiry form and delivers it to our Microsoft 365 business inbox. It receives the four form fields and the page or concern you came from. Submissions use HTTPS. The Sapphire website does not keep an enquiry database or save your unsent question in browser storage.

The form uses Cloudflare Turnstile to help prevent spam. It loads only when you choose “Start spam check” and processes technical information about your browser and device. The form checks the result on the server before attempting delivery.

Our form handler does not write your question, contact details or spam-check tokens to application logs or analytics. Cloudflare and Microsoft process service and security information needed to operate their services, including email delivery. Read the Cloudflare privacy policy and Turnstile privacy information.

Personal text replies are handled through Zoë’s messaging service and the relevant mobile networks. These replies concern your enquiry only.

If you choose an email link instead, it opens your own email application.

Website information and cookies

Our website uses Cloudflare infrastructure. Cloudflare may process technical information necessary to deliver, protect and operate the website, including IP addresses and HTTP/request information.

Sapphire has no Google Analytics, Google Tag Manager or Meta/Facebook Pixel implementation on this website. There is no newsletter signup, live chat, website account registration or visitor file-upload facility. Form processing by Cloudflare is described above.

Timely does not load, and no Timely cookie or browser storage is created by this website, before you choose booking. Once you activate booking, Timely’s platform uses booking and security technologies.

When you choose to use the booking service, Timely may use cookies and other technologies needed to provide, secure and operate its booking platform. Timely may also use third-party services within its own platform. These are operated by Timely rather than by the Sapphire website.

Sapphire does not control Timely’s own platform technologies.

Marketing and photographs

We send direct marketing only where your recorded marketing preference or permission allows it. You can opt out of future marketing communications at any time by emailing us.

Marketing or publication of client photographs is a separate, optional purpose. Consent to treatment, or photographs needed for clinical records, does not automatically give permission for marketing use.

Where you have appropriately agreed to marketing use of your photographs, we may publish them through Sapphire Aesthetic Studio’s social media presence, including Facebook and Instagram. Meta operates those platforms and processes information under its own privacy arrangements.

How long we keep information

General enquiries: up to 12 months after the last meaningful contact, unless relevant information becomes part of a client record or there is another legitimate or legal reason to retain it for longer.

This includes enquiry emails and personal text correspondence held by Sapphire. The website does not maintain a separate submission archive.

Consultation, client and treatment records: 7 years from your last treatment or consultation. This includes relevant health information, consent information and treatment photographs forming part of the treatment record.

Records may be retained for longer where reasonably necessary in connection with an actual or anticipated complaint, legal claim or other legal obligation.

Marketing photographs: marketing copies are retained only while we have a genuine purpose for using them and appropriate permission remains applicable. We review their continued retention and use periodically. A fixed seven-year period does not apply to marketing copies.

Sharing your information

We do not sell your personal information. We only share information where necessary to provide our services, run the business, meet our legal obligations or where you have asked us to do so.

This may include service providers such as Timely for appointment booking and client records; Square, Clearpay and Klarna for payments; Microsoft for business email; Cloudflare for enquiry delivery and Turnstile spam protection; messaging providers and mobile networks for personal text replies; and other professional or regulatory services where necessary.

Where another organisation processes your information for its own purposes, its own privacy policy will also apply.

Protecting your information

We take reasonable organisational and technical measures to protect personal information and restrict unauthorised access.

Processing outside the UK

We use third-party technology providers whose services and subprocessors may involve processing outside the UK. Where personal information is transferred internationally, applicable safeguards required by UK data-protection law are used.

You can contact us for information about the safeguards that apply.

Your rights

Depending on the circumstances, you may have the right to:

• Access your personal information.
• Have inaccurate information corrected.
• Ask for information to be deleted where this right applies.
• Ask us to restrict how we use your information.
• Object to certain processing.
• Receive and transfer your information in a portable format where applicable.
• Withdraw consent where processing relies on consent.

Your right to object: you can object to certain uses of your information, including processing based on legitimate interests, depending on your circumstances. You can opt out of direct marketing at any time.

Withdrawing consent does not affect processing already lawfully carried out. It does not necessarily require us to delete information that we have another lawful reason to retain.

To make a request or withdraw consent, email us.

Questions and complaints

If you have questions about how Sapphire uses your information, you can email us.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data-protection regulator. You do not have to contact Sapphire before exercising your right to complain to the ICO.