This notice explains how Nicole Cortés Skin & Aesthetics uses personal information when you visit this website, contact the studio or book a treatment. The booking platform you choose also acts under its own privacy notice.
1. Who is responsible for your information?
The data controller for information handled directly by the studio is Nicole Cortés Skin & Aesthetics, 23–25 Wharf Street, Greenwich, London SE8 3GG. You can contact the studio at mestizaesthetics@gmail.com or 07378 778797.
2. Information we may collect
- Identity and contact details, such as your name, phone number and email.
- Appointment and transaction details supplied by you or by the booking provider.
- Consultation, treatment, consent and aftercare records that may include health information.
- Messages you send by phone, email, WhatsApp or social media.
- Technical security and access information generated by website hosting.
- Photographs only where there is an appropriate clinical reason or you have given separate permission for a defined use.
3. Why we use it
We use information to respond to enquiries, arrange and manage appointments, assess suitability, provide treatments and aftercare, process payments through approved providers, keep records, meet legal and insurance obligations, protect the studio and improve our service.
4. Our lawful bases
Depending on the activity, we rely on steps taken at your request and performance of a contract, legal obligations, legitimate interests in running and protecting the business, or consent. Health information is special category data. We identify an additional lawful condition before using it and, where appropriate, ask for explicit, specific consent separately from marketing consent.
5. Booking platforms and other recipients
Online bookings are completed on third-party services such as Fresha. If you follow an external link, that provider receives information directly from you and its privacy terms apply. We may also use carefully selected hosting, communications, payment, professional advice, insurance and record-keeping providers. Information is shared only where necessary, with appropriate safeguards.
6. International transfers
Some service providers may process information outside the United Kingdom. Where this happens, we require an approved transfer mechanism or another valid safeguard under UK data protection law.
7. How long information is kept
Information is retained only for as long as needed for the purpose collected, including treatment continuity, legal, tax, insurance and complaint-handling requirements. Retention periods are reviewed and information is securely deleted or anonymised when no longer required.
8. Your rights
Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability or objection, or withdraw consent for future use. Contact us using the details above. You may also complain to the UK Information Commissioner's Office at ico.org.uk.
9. Marketing
Marketing messages are sent only where permitted by law. You can unsubscribe or ask us to stop at any time. Choosing not to receive marketing will not affect treatment communications.
10. Security and changes
Reasonable technical and organisational measures are used to protect information. No online system is completely risk-free. This notice may be updated when our practices, providers or legal duties change; the date at the top will show the latest version.