Panache Medi Spa respects your privacy. This policy explains what personal data we collect through this website and in clinic, why we collect it, who we share it with, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
Panache Medi Spa Limited (company number 09046594, registered in England and Wales), 32 Green Lane, Northwood, England, HA6 2QB, is the data controller for the personal data described in this policy. You can contact us about anything in this policy by email at info@panachemedispa.co.uk or by phone on 01923 833600.
2. What personal data we collect
Through this website
- Enquiry form: your name, phone number, email address and the message you send us.
- Online booking: when you book through our booking system, provided by Phorest, you give your name, contact details and the appointment you want. Phorest processes this on our behalf and under its own privacy policy.
- Direct contact: anything you share with us by phone, email, WhatsApp or social media.
- Technical data: cookies and similar technologies, described in our Cookie Policy. Non-essential cookies and third-party embeds are only set with your consent.
In clinic
Before a treatment we complete a consultation and record information about your skin, medical history, medications, allergies and treatment goals, together with consent forms and, where you agree, clinical photographs. Health information is special category data. We collect it with your explicit consent and because it is necessary to provide aesthetic treatments safely. This website does not collect health information; please do not include it in the enquiry form.
3. Why we use your data and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Answering your enquiry | Legitimate interests (responding to you) and taking steps at your request before a contract |
| Booking, delivering and following up treatments | Performance of a contract; explicit consent and provision of health care for health data |
| Keeping clinical records | Legal obligation and legitimate interests (safety, insurance, professional standards) |
| Appointment reminders and aftercare messages | Performance of a contract |
| Marketing emails, texts or messages about offers and events | Consent, which you can withdraw at any time |
| Using clinical photographs in marketing or before and after galleries | Separate explicit written consent, which you can withdraw at any time |
| Running and securing this website | Legitimate interests |
| Accounting, tax and complying with the law | Legal obligation |
4. Who we share your data with
We never sell your data. We share it only with service providers who help us run the clinic and this website, under contracts that protect your data:
- Phorest, our salon management and online booking system.
- Hostinger, which hosts this website.
- Email and messaging providers we use to reply to you and send reminders. If we use a customer relationship or marketing platform to manage messages, it will act as our processor.
- Google, if you accept functional cookies, for the map on our contact page and for the fonts used on this site.
- Professional advisers, insurers and regulators where required.
Some of these providers store data outside the UK, for example in the United States. Where that happens we rely on the UK International Data Transfer Agreement or Addendum, or on adequacy regulations, so your data has equivalent protection.
5. How long we keep your data
- Website enquiries: up to 12 months after our last contact, unless you become a client.
- Client and clinical records: in line with professional and insurance guidance for aesthetic practice, normally 8 years after your last treatment, or longer where the law requires.
- Marketing consent: until you withdraw it, or after 2 years without contact.
- Accounting records: 6 years, as required by HMRC.
6. Your rights
Under UK GDPR you have the right to:
- access a copy of the personal data we hold about you;
- ask us to correct data that is inaccurate or incomplete;
- ask us to delete your data, where we no longer need it;
- restrict or object to how we use it;
- receive your data in a portable format;
- withdraw consent at any time, where consent is our lawful basis. This does not affect anything done before you withdrew it.
To exercise any of these rights, email info@panachemedispa.co.uk. We will respond within one month. We may ask you to confirm your identity first. If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve any concern first.
7. Security
This website is served over HTTPS. Clinical records are held in access-controlled systems and only staff who need them to care for you can see them. We review our suppliers' security measures and limit what we collect to what we need.
8. Children
Our treatments are for adults. We do not knowingly collect data from anyone under 18 through this website. Consultations for anyone under 18 require a parent or guardian.
9. Links to other websites
This site links to third-party sites such as our booking system and social media. Their privacy policies, not ours, apply once you leave our site.
10. Changes to this policy
We may update this policy from time to time. The date at the top shows when it last changed. Significant changes will be highlighted on this page.