Privacy Policy

At The Beautique Beauty Academy, protecting the privacy, security, and confidentiality of our website visitors, clinic clients, and academy students is foundational to our clinical standards. This privacy notice details our explicit processes regarding data collection and processing in strict adherence to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Core Information We Collect

Depending on how you interface with our clinic or educational academy, we collect and process several categories of information:

• Identity & Contact Information: Your full name, telephone numbers, postal addresses, email accounts, and verification data when booking an appointment or course.
• Student & Professional Data: Educational histories, existing beauty certifications, insurance details, unique qualification logs, and coursework records for delegates completing our academy modules.
• Special Category Data (Clinical Records): Comprehensive medical questionnaires, prescription requirements, treatment histories, relevant physiological statuses, and anatomical pre- and post-treatment progress photography (for clinical clients and training models).
• Technical & Analytical Footprints: IP addresses, localized browser specifications, traffic histories, and behavioral journey patterns captured via cookies when traversing our website.

2. Why We Process Your Data (Lawful Basis)

Under the UK GDPR, we must establish explicit legal grounds to process your information. We process data under the following conditions:

2.1 Contractual Performance

Processing is mandatory to execute a contract to which you are party. This covers processing your data to manage course enrollments, issue accredited certificates, process balances, and organize training dates or clinical treatment spaces.

2.2 Special Category Processing (Consent & Medical Auditing)

Because non-surgical aesthetics, dermal fillers, and advanced skin rejuvenation relate directly to physical well-being, processing your detailed medical background and historical physiological attributes falls under Special Category Data. We process this under two distinct pillars:

• Explicit Consent: You provide clear, signed authorization on our clinical intake documentation prior to receiving any care or acting as an academy model.
• Health & Social Care Provisions: Processing is required to maintain professional medical-grade treatment safety records and comply with product liability insurance parameters.

2.3 Legitimate Business Interests

We process basic web behavioral information to secure our systems, analyze layout engagement via automated analytics, and continuously improve our website performance metrics.

3. Third-Party Technical Processing Systems

We never sell, lease, or distribute your personal details to outside marketing brokers. To ensure efficient technical operation and high-performance safety, your data interacts with selected third-party processors detailed below:

• System Protection & Edge Optimization (Cloudflare): Basic routing IP footprints are evaluated at the network edge to prevent structural brute-force exploitation and coordinate firewall protocols.
• Performance Asset Layering (WP Rocket): Local caching architecture maps fundamental performance traits to enhance speed indexing without tracking localized identities.
• Traffic & Behavioral Insight Metrics (Google Analytics): Anonymized behavioral data points are mapped to determine macro-level link performance, asset optimization, and user flows. Individual tracking parameters are fully obfuscated.
• Accreditation Registries (CPD Centres): For training delegates, your registration identity is securely logged with our external CPD accreditation bodies to issue certified qualification records.

4. Information Retention Protocols

We preserve personal attributes only for as long as necessary to fulfill original processing objectives or satisfy statutory requirements:

• Educational Records: Training logs, assessments, and qualification rosters are maintained indefinitely to facilitate historic confirmation requests and verify student records.
• Clinical Consultation & Medical Data: To adhere to UK medical malpractice framework laws, aesthetic profiles, consent sheets, and treatment logs are safely locked down for a mandatory minimum of 7 years following your last active clinic appointment.

5. Your Statutory Data Rights

As a UK citizen, you hold comprehensive rights regarding your digital information under the UK GDPR framework:

• The Right of Access: You can demand a structured digital copy of all personal and medical information we hold about you at any point.
• The Right to Rectification: You can request immediate correction of inaccurate or incomplete information.
• The Right to Erasure ("Right to be Forgotten"): You can request that we delete your personal information, provided it does not conflict with our legal requirement to maintain medical safety records for 7 years.
• The Right to Data Portability: You can request your data be exported in a universally readable format.
• The Right to Withdraw Consent: Where processing is explicitly consent-based, you can revoke that consent at any time.

To exercise any of these protections, please contact our Data Privacy Lead at the email address provided above. We will address all valid requests free of charge within 30 days.

6. Lodging Regulatory Complaints

If you believe we have handled your personal information inappropriately or violated UK GDPR compliance boundaries, you have the right to log a formal complaint with the UK data supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline Tel: 0303 123 1113 • Website: www.ico.org.uk

Document Framework Reference: PRIV-BTA-2026-V1. Last updated: May 2026.