Privacy policy

At Rejuven8 Beauty & Bronze Co, we respect your privacy and are committed to protecting your personal information. This policy explains how we collect, use, store and share information when you visit our website, contact us, book an appointment or receive a treatment.

1. Who we are

Rejuven8 Beauty & Bronze Co is the trading name of the business operated by Amber Costello.

For the information covered by this policy, Rejuven8 Beauty & Bronze Co is the data controller, meaning it is responsible for deciding how your information is used.

Website: www.rejuven8.io

You can contact us about this policy through the contact details provided on our website.

2. Information we collect

Depending on your enquiry or treatment, we may collect:

• Your name and contact details.
• Appointment details, purchases and payments.
• Consultation forms, treatment preferences, consent records and aftercare notes.
• Relevant health information, including allergies, medication and medical history.
• Treatment photographs, where agreed and appropriate.
• Messages, feedback and complaints.
• Marketing preferences.
• Technical information about your website visit, such as your IP address, browser and cookie preferences.

We collect information directly from you and, where relevant, through booking platforms and payment providers.

3. How and why we use your information

We use your information to:

• Respond to enquiries and manage appointments.
• Assess treatment suitability and provide treatments and aftercare.
• Maintain accurate consultation and treatment records.
• Process payments.
• Send appointment confirmations and service updates.
• Handle feedback, complaints and insurance matters.
• Meet applicable legal and regulatory obligations.
• Send marketing communications where you have agreed to receive them.
• Maintain and protect our website and business systems.

We use the following lawful bases where applicable:

Contract: To arrange and deliver services you request, including bookings and payments.

Legal obligation: To meet applicable legal requirements, including maintaining accounting records.

Legitimate interests: To respond to enquiries, manage complaints, protect our business and establish or defend legal claims, where these interests do not override your rights.

Consent: For optional marketing, promotional photographs and website technologies that require your permission.

Providing information needed for a booking or safe treatment is necessary for us to deliver that service. Without it, we may be unable to proceed.

4. Health information

Health information receives additional protection under data-protection law. We collect only information relevant to assessing suitability, delivering treatment and maintaining appropriate records.

We process relevant health information where necessary to provide treatments safely and maintain appropriate treatment records. We rely on the lawful basis of taking steps at your request before entering into a contract, or performing a contract, together with the applicable special-category condition for health information where required by law.

We will ask for your consent to the treatment itself and will record the information needed to assess whether the treatment is suitable and safe. Consent to treatment is separate from consent to receive marketing or to use photographs for promotional purposes.

Where we rely on your consent, you may withdraw it by contacting us. Withdrawal does not affect processing that took place lawfully beforehand. We will explain any effect this may have on future treatment and whether particular records must still be retained under another applicable legal basis.

5. Treatment photographs

We will explain why any treatment photographs are requested and how they will be used.

Permission to take photographs for your treatment record does not automatically give permission to use them for advertising.

We will ask for separate, optional consent before using identifiable photographs on our website, social media or promotional materials. Refusing promotional use will not affect your treatment.

You can withdraw permission for future promotional use by contacting us.

6. Who we share information with

Where necessary for the purposes described above, we may share relevant information with:

• The practitioner responsible for your treatment.
• Booking and appointment-management providers used by Rejuven8 Beauty & Bronze Co.
• Consultation and consent-record providers used by Rejuven8 Beauty & Bronze Co.
• Payment processors used to process your payment.
• Website, email and secure IT-service providers.
• Professional advisers, insurers and accountants where necessary.
• Regulators, public authorities or emergency services where legally required or otherwise lawfully justified.

We limit sharing to what is necessary. Providers that use information for their own purposes may have separate privacy notices.

7. Marketing

Where you opt in, we may send news, offers and treatment updates through your chosen contact channels.

You can unsubscribe at any time using the link in a marketing message or by contacting us. Opting out of marketing does not stop essential communications about appointments, payments or treatment aftercare.

8. Keeping your information secure

We use appropriate organisational and technical measures to protect personal information against unauthorised access, loss and misuse.

Access is limited to people who need the information for their role. No online system can be guaranteed completely secure.

9. How long we keep information

We retain information only for as long as needed for the purpose it was collected, taking account of applicable legal obligations, treatment-record requirements and the establishment or defence of claims.

We normally retain:

• Consultation records, treatment notes and clinical photographs: For seven years from your last treatment or contact, unless a longer period is required for an ongoing complaint, claim or legal obligation.
• Booking and general enquiry records: For two years from your last contact or appointment.
• Payment and accounting records: For six years after the end of the relevant financial year.
• Marketing records: Until you withdraw your consent or we determine that the information is no longer needed. We may retain a minimal suppression record to respect an unsubscribe request.
• Complaints and claims records: For seven years after the complaint or claim is closed, or longer where necessary for legal proceedings or another legal obligation.

Records may be retained longer where necessary for an ongoing complaint, claim or legal requirement. Information is securely deleted or anonymised when no longer needed.

10. International transfers

Some service providers used to operate our website, manage bookings, process payments, provide email services or store information may process personal information outside the United Kingdom.

Where personal information is transferred outside the UK, we use appropriate safeguards required by applicable data-protection law, such as an adequacy decision, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or another lawful transfer mechanism.

You can contact us through the contact details provided on our website if you would like further information about the safeguards used for a particular transfer.

11. Cookies and website technologies

Our website may use cookies and similar technologies to operate its features and, depending on your choices, measure website use or support advertising.

Where consent is required, these technologies will be used only after you agree. You can manage or withdraw your cookie preferences through the cookie controls available on our website.

We may use strictly necessary cookies to provide website functionality. Optional analytics, advertising and similar cookies will be used only where permitted by applicable law and, where required, with your consent.

12. Your rights

Depending on the circumstances, you may have the right to:

• Request access to your personal information.
• Have inaccurate or incomplete information corrected.
• Request deletion of your information.
• Ask us to restrict how information is used.
• Object to certain uses, including direct marketing.
• Receive certain information in a portable format.
• Withdraw consent where processing relies on it.

These rights are subject to applicable conditions and exceptions. For example, we may need to retain some records despite a deletion request.

To exercise your rights, contact us through the contact details provided on our website. We may need to verify your identity before responding.

13. Privacy concerns and complaints

If you have a concern about how we handle your information, please contact us so we can investigate.

You also have the right to complain to the Information Commissioner’s Office, the UK’s data-protection regulator:

Website: https://ico.org.uk/make-a-complaint/

14. Changes to this policy

We may update this policy when our services, systems or data-handling practices change. The latest version will be available on this page, with its publication date shown above.