Legal
Privacy Notice
Last updated 14 September 2026
This notice explains what personal information Brow & Skin collects about you, why, how long it is kept, and what rights you have over it. It is written in plain English deliberately — if anything here is unclear, please ask.
Who is responsible for your information
Brow & Skin is a sole trader business run by Crystal, operating from 370 Goswell Road, London EC1V 7LQ. Brow & Skin is the data controller for the information described here, which means we decide what is collected and how it is used.
- Email: [email protected]
- Phone: 020 3488 7414
What we collect
When you book
- Your name, email address and phone number
- Appointment details and booking history
- Deposit and payment records — card details are handled by our booking and payment providers and are never seen or stored by us
Before treatment — health information
Every client completes a medical history form. This asks about allergies, medication, skin conditions, pregnancy and breastfeeding, previous reactions, and history of keloid scarring or cold sores.
This is special category data under Article 9 of the UK GDPR — the most protected kind. We collect it because some treatments are genuinely unsafe for some people, and we cannot know that without asking. It is used to decide whether a treatment is suitable for you and nothing else.
Photographs
We take before and after photographs of treated areas as part of your clinical record. These are also special category data where you are identifiable.
Clinical photographs and marketing photographs are separate things. Consenting to treatment does not give permission to use your photograph in advertising, on this website or on social media. That requires separate, written, specific consent — and you can withdraw it at any time by emailing us, after which we will stop using the image going forward.
Why we are allowed to use it
| Information | Our lawful basis |
|---|---|
| Name, contact details, appointments, payments | Contract — we need these to provide the treatment you booked |
| Medical history and clinical photographs | Explicit consent (Article 9(2)(a)), given when you complete your form and sign your consultation record |
| Photographs used in advertising | Separate explicit consent, given in writing and withdrawable at any time |
| Records kept after your treatment | Legal obligation and legitimate interests — insurance, and the ability to answer questions about treatment you have had |
Who else sees it
We keep the number of people handling your information as small as possible. Your details may be processed by:
- Acuity Scheduling — our booking system, which holds your appointments and your medical history form
- Treatwell — if you booked through their platform, they hold your booking and contact details under their own privacy policy
- Our payment providers — who process deposits and payments
- Our insurer — only if a claim or complaint is made
We do not sell your information, and we do not share it with anyone for marketing.
How long we keep it
Treatment records, including your medical history and clinical photographs, are kept for at least eight years after your last appointment, in line with UK clinical record-keeping guidance. After that they are securely deleted.
If you withdraw consent for a marketing photograph, we stop using it immediately. The clinical copy in your treatment record is retained for the period above, because it forms part of the record of care.
How it is kept safe
- Booking and medical records are held in Acuity Scheduling, protected by a strong unique password and two-factor authentication
- Photographs are kept in dedicated storage, not in a personal phone camera roll
- Paper consultation forms are stored securely and are not left out in the studio
- Only Crystal has access to client records
Your rights
Under UK data protection law you can ask us to:
- Give you a copy of the information we hold about you
- Correct anything that is wrong or out of date
- Delete it, where we are not required to keep it
- Restrict or object to how we use it
- Withdraw consent at any time — including consent for photographs
- Receive it in a portable format to give to someone else
To do any of these, email [email protected]. We will respond within one month. There is no charge.
Withdrawing consent for your medical history is possible, but it means we can no longer safely treat you, as we would have no record of your suitability.
This website
This site sets no cookies and runs no analytics or tracking of any kind. We do not know who visits it.
Typefaces are loaded from Google Fonts, which means your browser makes a request to Google's servers and your IP address is visible to them as part of that. We do not receive or store it.
Booking links take you to Acuity Scheduling or Treatwell, who operate their own privacy policies once you arrive.
If you are unhappy
Please tell us first — email [email protected] and we will try to put it right.
You also have the right to complain to the Information Commissioner's Office, the UK regulator, at any time: ico.org.uk/make-a-complaint or 0303 123 1113.
Changes to this notice
If this notice changes, the updated version will be posted on this page with a new date at the top.