Privacy Policy
Skin Rehab 7 Herbert Street, Pontardawe, Swansea SA8 4EA Telephone: +44 7496 730404
Last updated: 2 July 2026
1. Introduction
Skin Rehab ("we", "us", "our") is a nurse-led medical aesthetics clinic based in Pontardawe, Swansea. We are committed to protecting your privacy and handling your personal data lawfully, fairly and transparently.
This policy explains what personal data we collect when you visit our website (www.skin-rehab.co.uk), make a booking, or receive treatment at our clinic; why we collect it; how we protect it; and the rights you have over it.
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Skin Rehab is the data controller for the personal data described in this policy.
2. What information we collect
2.1 Information you give us
Identity and contact details — your name, date of birth, address, telephone number and email address, collected when you book an appointment, contact us, or register as a client.
Health and medical information — your medical history, current medications, allergies, previous treatments, consultation notes, treatment records and consent forms. This is "special category" data and is essential for us to assess your suitability for treatment and to treat you safely.
Photographs — clinical photographs taken before, during and after treatment for your clinical record, and (only with your separate, explicit consent) for use in marketing such as our gallery or social media.
Payment information — details of payments and deposits. Card payments are processed by our payment provider; we do not store full card numbers.
Communications — records of correspondence with us by phone, text, email or social media, including appointment reminders and feedback or reviews you choose to give.
2.2 Information collected automatically
When you use our website, limited technical data (such as IP address, browser type, device information and pages visited) may be collected through cookies and similar technologies by our website platform and embedded services (for example the Google Maps location map and our online booking system). See our Cookie Policy for details and how to manage your preferences.
3. How and why we use your information
We use your personal data to:
provide consultations, treatments and aftercare, and maintain accurate clinical records;
assess your medical suitability for treatments and manage any contraindications or adverse events;
manage bookings, deposits, payments, reminders and cancellations;
respond to your enquiries and provide advice and support before and after treatment;
send you marketing or promotional messages, only where you have agreed to receive them (you can opt out at any time);
meet our legal, regulatory, professional and insurance obligations;
run, secure and improve our website.
Our lawful bases
Purpose Lawful basis Providing treatments and clinical care Performance of a contract; provision of health care (Article 9(2)(h) UK GDPR) and your explicit consent for special category health data Bookings, payments and appointment reminders Performance of a contract Clinical record keeping and insurance Legal obligation and legitimate interests Marketing communications and use of photos in marketing Consent (which you may withdraw at any time) Website operation and security Legitimate interests 4. Who we share your information with
We never sell your personal data. We share it only where necessary, with:
Our online booking and clinic management provider (Aesthetic Nurse Software), which processes your booking and client record data on our behalf;
Our website platform provider, which hosts www.skin-rehab.co.uk;
Payment processors, to take payments and deposits;
Map My Mole / dermatology partners — if you use our mole-mapping service, the images and information you provide are shared with the reporting dermatology service so a consultant can assess them;
Healthcare professionals — for example your GP or an emergency service, where necessary for your care or safety;
Prescribers and pharmacies, where a treatment requires a prescription;
Insurers, legal and regulatory bodies (such as our insurance provider, the Nursing and Midwifery Council or the Information Commissioner's Office), where we are required or permitted to do so.
All third-party processors are required to protect your data and use it only on our instructions. Where any provider processes data outside the UK, we ensure appropriate safeguards are in place (such as UK adequacy regulations or International Data Transfer Agreements / standard contractual clauses).
5. How long we keep your information
Clinical records (medical history, consultation and treatment notes, consent forms, clinical photographs): retained for a minimum of 8 years after your last treatment, in line with healthcare record-keeping and insurance requirements. Records relating to anyone treated under 18 (where applicable) are kept until their 25th birthday.
Booking and payment records: retained for 6 years for accounting and tax purposes.
Marketing data: kept until you unsubscribe or withdraw consent.
Website enquiry data: kept only as long as needed to deal with your enquiry.
When data is no longer required it is securely deleted or destroyed.
6. How we protect your information
We take appropriate technical and organisational measures to protect your data, including secure, access-controlled clinic management software, encrypted connections on our website, and restricting access to your records to those who need it to provide your care. Paper records, where used, are stored securely at the clinic.
7. Your rights
Under UK data protection law you have the right to:
Access — request a copy of the personal data we hold about you;
Rectification — ask us to correct inaccurate or incomplete data;
Erasure — ask us to delete your data (note: we must retain clinical records for the periods described above);
Restriction — ask us to limit how we use your data;
Objection — object to processing based on legitimate interests, and to direct marketing at any time;
Portability — receive certain data in a portable format;
Withdraw consent — where processing is based on consent (for example marketing, or use of your photos in our gallery), you can withdraw it at any time without affecting processing carried out before withdrawal.
To exercise any of these rights, contact us by telephone on +44 7496 730404 or in writing to Skin Rehab, 7 Herbert Street, Pontardawe, Swansea SA8 4EA. We will respond within one month.
8. Marketing
We will only send you marketing (such as offers or news about treatments) if you have opted in, and every message will include a way to opt out. Withdrawing from marketing does not affect appointment-related communications such as booking confirmations and reminders.
9. Children
Our treatments are not provided to anyone under 18, and our website and marketing are not directed at children. We do not knowingly collect personal data from anyone under 18.
10. Cookies
Our website uses cookies and similar technologies. For full details of the cookies used and how to control them, please see our Cookie Policy.
11. Third-party links
Our website contains links to third-party sites and embedded services (including Google Maps, Instagram and our online booking portal). Those services have their own privacy policies, and we are not responsible for their content or practices.
12. Complaints
If you have a concern about how we handle your data, please contact us first so we can try to resolve it. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.
13. Changes to this policy
We may update this policy from time to time. The latest version will always be published on this page with the date of the most recent update.