Privacy Policy

Last updated: 7 August 2026

This Privacy Policy explains how Adorabella collects, uses, stores and shares personal information when you visit our website, contact us, book an appointment, receive a consultation or treatment, purchase a product, use a gift card or join a treatment package.

1. Who is responsible for your information

Adorabella is the controller of the personal information described in this policy. We operate from a private, appointment-only studio in Lutterworth, Leicestershire.

Privacy enquiries and requests can be sent to info@adorabellabeauty.co.uk or made by telephone on 07739 632145. A correspondence address will be provided where required for a formal request without publishing the private studio address on this website.

2. Information we may collect

Depending on how you interact with us, we may collect:

• identity and contact information, including your name, date of birth, telephone number, email address and postcode;
• appointment and purchase information, including bookings, attendance, cancellations, treatments, products, packages, gift cards and payment status;
• consultation and treatment information, including relevant medical conditions, medication, allergies, pregnancy or nursing information, previous procedures, contraindications, skin concerns, treatment notes, patch-test records, consent and aftercare;
• photographs where they are reasonably useful for consultation, treatment planning, progress records or separately agreed marketing;
• communications sent by email, telephone, WhatsApp, social media or another contact method;
• marketing preferences and records of consent;
• payment and transaction information supplied through our payment provider, although we do not normally receive or store complete card details; and
• technical website information such as IP address, device, browser, approximate location, pages viewed, referring page and cookie choices.

3. Health information and other sensitive data

Information about health, medication, treatment history and contraindications can be special category data under UK data protection law. We collect only information we reasonably need to consider suitability, obtain informed consent, provide treatment, support aftercare, maintain appropriate records and respond to a concern.

Where required, we rely on your explicit consent to process relevant health information. We may also process limited information where necessary to establish, exercise or defend legal claims or meet another condition permitted by law.

You may withdraw consent for future processing, but this does not make earlier lawful processing invalid. If we cannot use information needed to assess suitability or provide a treatment safely, we may be unable to offer or continue that treatment.

4. Where information comes from

We usually receive information directly from you. We may also receive it from a person purchasing for you, a booking or payment provider, a communication platform you use to contact us, or a professional involved in your care where you have authorised the disclosure or another lawful basis applies.

Please do not provide another person’s information unless you have authority to do so and they understand how it will be used.

5. Why we use information

We may use personal information to:

• respond to an enquiry and recommend an appropriate first step;
• arrange, confirm, remind, change and administer appointments;
• carry out consultations, assess suitability, record consent and provide treatments and aftercare;
• manage purchases, packages, recurring card payments, refunds, gift cards and unpaid amounts;
• check product availability and provide product guidance;
• maintain treatment, financial, insurance and business records;
• protect clients, the practitioner, the studio and our legal rights;
• investigate a concern, reaction, complaint, payment dispute or suspected misuse;
• operate, secure, understand and improve the website and service;
• send requested or consented marketing and measure its effectiveness; and
• meet legal, tax, regulatory, insurance and professional obligations.

6. Lawful bases

The lawful basis depends on the purpose:

• Contract: to take steps at your request, administer a booking or purchase and provide agreed services.
• Legal obligation: to meet applicable tax, accounting, consumer, health and safety, data protection or regulatory duties.
• Legitimate interests: to operate and protect the business, manage appointments, prevent fraud, maintain appropriate records, improve services and establish or defend legal claims, where those interests are not overridden by your rights.
• Consent: for optional marketing, identifiable promotional photographs, certain cookies and processing where consent is the appropriate basis.
• Explicit consent or another lawful special-category condition: for relevant health and treatment information.

7. Marketing

We will send electronic marketing where you have consented or where another lawful permission applies. You can unsubscribe through the method provided in the message or contact us at any time. Withdrawing marketing consent does not affect appointment, safety or service messages.

We do not require agreement to marketing as a condition of treatment.

8. Treatment and marketing photographs

Photographs used for confidential consultation or treatment records are kept with appropriate access controls. Separate permission will be requested before an identifiable image, testimonial or treatment story is used publicly for marketing.

Marketing permission may be withdrawn for future use. Withdrawal cannot always remove material already lawfully printed or distributed, but we will stop new use where reasonably possible.

9. Payments and recurring card payments

Payments may be processed by a specialist payment provider. The provider may act as an independent controller or processor for payment, security, fraud prevention and legal compliance. We normally receive transaction references, payment status and limited card information rather than full card details.

If you choose recurring card payments for a package, we use the payment information and authority needed to administer the agreed schedule, manage failed payments and process cancellation. Please also read our Terms and Conditions.

10. WhatsApp, social media and other platforms

If you contact us through WhatsApp, social media or another platform, that provider also processes information under its own privacy terms. Please avoid sending more medical or sensitive information through social messaging than is necessary. We may transfer relevant details into an appropriate client record and retain the business conversation where needed.

11. Cookies and website information

The website may use essential cookies needed for security, navigation and basic operation. Analytics, advertising or other non-essential cookies will be used only where they are active and the required consent has been obtained.

You can control cookies through the website controls where provided and through your browser. Blocking essential cookies may affect website operation. Any cookie banner or preference tool should provide current details of active non-essential cookies and their duration.

12. Who we may share information with

Where necessary and lawful, information may be shared with:

• booking, payment, website hosting, email, messaging, storage, security and IT service providers;
• accountants, insurers, legal advisers and other professional advisers;
• product or equipment suppliers where needed to investigate a product concern or adverse event;
• a healthcare professional or emergency service where you request this or where disclosure is lawfully necessary to protect vital interests;
• HM Revenue and Customs, regulators, courts, law enforcement or another authority where legally required; and
• a purchaser or successor if the business is sold or reorganised, subject to appropriate confidentiality and data protection requirements.

We do not sell personal information.

13. International processing

Some technology and communication providers may process information outside the United Kingdom. Where this happens, we will use providers and transfer arrangements intended to protect the information as required by UK data protection law, such as adequacy regulations or approved contractual safeguards.

14. How long we keep information

We keep information only for as long as reasonably necessary for the purpose collected, including treatment safety, insurance, tax, complaint and legal requirements. Our working retention periods are:

• consultation, consent, treatment and relevant photograph records: normally seven years after the last treatment, or longer where required for a client under 18, an open concern, insurance or legal proceedings;
• transaction, invoice and tax records: normally six years after the end of the relevant financial year;
• general enquiries that do not lead to a booking: normally up to two years;
• marketing information: until consent is withdrawn, the information is no longer useful or a periodic review shows it should be removed; and
• complaint, incident and legal-claim information: for the time needed to resolve the matter and meet applicable limitation, insurance or legal requirements.

Information may be deleted, anonymised or retained for longer where a legal hold or another justified exception applies. These periods must remain aligned with our insurer, professional obligations and actual systems.

15. Security

We use reasonable organisational and technical measures appropriate to the information, including access controls, device and account security, careful sharing, secure disposal and service-provider checks. No internet or storage system can be guaranteed completely secure.

If a personal data breach creates a risk to people, we will assess, record and report it to the Information Commissioner’s Office and affected individuals where required.

16. Your rights

Depending on the circumstances, you may have the right to:

• be informed about use of your information;
• request access to your personal information;
• ask for inaccurate or incomplete information to be corrected;
• ask for deletion or restriction;
• object to processing based on legitimate interests or direct marketing;
• receive certain information in a portable format;
• withdraw consent for future processing; and
• ask for safeguards around qualifying automated decisions.

These rights are not absolute and an exemption may apply. We may ask for information needed to verify identity. We normally respond within one month and do not charge unless a request is manifestly unfounded, excessive or a lawful fee applies.

17. Children

Where a client is under 18, we may process information about both the client and their parent or legal guardian. We will explain information use in an age-appropriate way and obtain consent or authority required for the treatment and data processing.

18. Complaints

Please contact us first at info@adorabellabeauty.co.uk so that we can try to resolve a privacy concern.

You also have the right to complain to the Information Commissioner’s Office. Current details are available at ico.org.uk/make-a-complaint.

19. Changes to this policy

We may update this policy when our services, systems, providers or legal obligations change. The latest version and update date will be published on this page. A material change will be communicated where appropriate.