Privacy policy

1. Who we are (data controller)

• Company name: Smooth Peach LTD
• Company registration number: 17148684
• Registered address: 18 Brooks Warren, Cranbrook, Devon EX5 7AJ
• Contact email: info@smoothpeach.com

2. The information we collect

• Contact and identity details: full name, date of birth, home address, email address, telephone number and emergency contact details.
• Health data (special category): medical history, current prescriptions and light-sensitising medication, Fitzpatrick skin type, tanning history, allergies, pregnancy status and any reactions to treatment.
• Treatment records: session dates, energy settings used, areas treated, practitioner notes and clinical before and after photographs.
• Financial data: payment transaction details and receipts. We never store full card numbers; payments are processed securely by third-party providers.
• Technical and marketing data: IP addresses, website analytics and marketing preferences, where they apply.

3. Our lawful basis for processing

• Contract (Article 6(1)(b)): to schedule appointments, manage bookings, take payments and deliver our services.
• Explicit consent (Article 6(1)(a) and Article 9(2)(a)): to take and use promotional or marketing photographs, send direct marketing, and process your health data to check your suitability for treatment.
• Legal and insurance obligations (Article 6(1)(c) and Article 9(2)(h)): to meet health and safety regulations, keep proper medical notes and satisfy our professional indemnity insurers.

4. How we use your data

We use your information only to:

• check your suitability for treatment and carry out safe patch tests
• deliver treatments tailored to you and monitor how your skin responds
• send appointment reminders, confirmations and essential pre- and aftercare advice
• meet our medical liability insurance conditions and defend legal claims
• respond to complaints and enquiries.

The questions on our booking page

The two health questions before you book online are answered in your browser. They are not sent to us or stored on our website, and only decide whether you can book online or should email us first.

5. Sharing your data

We do not sell, rent or trade your personal information. We only share it with trusted third parties where this is strictly necessary to deliver our services:

• Booking: Google Calendar
• Payments: Stripe and Tide
• Professional advisers and insurers: our insurers, legal advisers or regulators, where the law requires it or in the event of a claim.

6. How long we keep it

• Adult clinical records: in line with standard UK aesthetic insurance and medical record requirements, consultation forms, treatment notes and patch test records are kept for at least 7 years after your last treatment session.
• General enquiries: messages and enquiries from people who are not clients are deleted after 12 months.

7. Storage and security

• Digital consultation forms and notes are stored on encrypted, password-protected systems with multi-factor authentication.
• Any paper records are kept locked away and only authorised staff can access them.
• Clinical photographs are stored in your private record and are never published or shared without your separate, explicit written consent.

8. Your rights

Under UK data protection law, your rights include:

• Access: asking for a copy of your personal data.
• Rectification: asking us to correct inaccurate or incomplete details.
• Erasure: asking us to delete your data, subject to our legal and insurance duty to keep clinical notes for 7 years.
• Withdrawing consent: withdrawing consent for marketing or promotional photographs at any time.

To use any of these rights, email us at info@smoothpeach.com.

9. Complaints

If you are worried about how we handle your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113