Privacy Policy

Last updated: 15 October 2026.

Who we are

Skin Lab Medispa is a medically led aesthetic clinic with locations in Marylebone, Old Street and Monument, London. Skin Lab Medispa is the data controller for the personal information described in this policy. In this policy, "we", "us" and "our" mean Skin Lab Medispa. You can contact us about your data at info@skinlabmedispa.co.uk or by post at The Light Centre, 4 Baker Street, London W1H 6AZ.

What information we collect

• Contact details: name, email address, phone number, date of birth and address.

• Health information: medical history, medications, allergies, consultation notes, treatment records, consent forms and aftercare notes. This is “special category” data and we treat it with extra care.

• Photographs: treatment photographs taken for your clinical record. We use them publicly only with your separate written consent.

• Booking and payment information: appointments, services booked and payment confirmations. Card details are handled by our payment provider and are not stored by us.

• Website and messaging data: enquiries you send through forms, WhatsApp, email or phone, plus technical data such as your IP address, device and pages visited, collected through cookies (see our Cookie Policy).

How we use it and our lawful basis

PurposeLawful basis

Booking and managing appointmentsPerforming our contract with you

Assessing suitability and providing treatment, keeping clinical recordsProvision of health care (UK GDPR Article 9(2)(h)), and our legitimate interests in safe care

Responding to enquiriesLegitimate interests

Using your photographs publicly (website, social media)Your explicit consent, which you can withdraw at any time

Sending marketing emails or messagesYour consent, or legitimate interests where the law allows it for existing patients

Advertising and analytics cookies (Meta Pixel, Google)Your consent through our cookie banner

Meeting legal, insurance and regulatory obligationsLegal obligation

Who we share it with

We do not sell your data. We share it only with service providers who help us run the clinic, under contract: Wix (website, booking and payments), our payment processor, Meta (advertising and messaging), Google (analytics and advertising), Elfsight (reviews display), WhatsApp (messaging you start), and our insurers, professional advisers and regulators where required. We may also share information with another healthcare professional involved in your care, with your agreement, or where the law requires it.

International transfers

Some providers are based outside the UK, including in the United States. Where this happens we rely on a UK adequacy arrangement or approved safeguards such as the UK International Data Transfer Addendum.

How long we keep it

We keep clinical records for 8 years after your last treatment, as our professional and insurance obligations require. Marketing data is kept until you unsubscribe. Website enquiries that do not lead to treatment are deleted after 12 months.

Your rights

Under UK data protection law you can ask us to: access your data, correct it, erase it (where we are not required to keep it), restrict or object to our use of it, move it to another provider, and withdraw consent at any time. To use any of these rights, email info@skinlabmedispa.co.uk. We will reply within one month.

Keeping your data safe

We use access controls, secure systems and staff confidentiality obligations to protect your information. No system is completely secure, and we will tell you and the ICO about a breach where the law requires.

Under-18s

Our treatments are for adults. We do not knowingly collect data from anyone under 18.

Changes to this policy

We will post any update here and change the date at the top.

Complaints

If you are unhappy with how we use your data, please contact us first at info@skinlabmedispa.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.