Privacy notice

Who we are

This website is run by Stevie Varney, trading as Stevie's Aesthetics — a sole trader providing nurse-led aesthetic treatments. We are the “data controller” for the information described in this notice, which means we decide how and why it is used.

You can reach us at steviesaesthetics@gmail.com, on +44 7983 128891, or by post at Crystal Rose, 20 High Street, Needham Market, Ipswich, Suffolk, IP6 8AP.

What this notice covers

This notice covers the information collected through this website. Appointments themselves are booked and managed on Fresha, and anything you are asked during a consultation or treatment is handled separately — see “Booking and treatment records” below.

What we collect

When you send an enquiry through this website, we collect only what is needed to reply to you:

• Your name — so we know who we're replying to.
• Your contact details — an email address or a phone number — whichever you prefer we use.
• Your town or postcode — for at-home appointment requests, because it determines whether we can travel to you.
• What you're interested in — the treatment, how many people it's for, when you're free, and anything you choose to write in the message box.
• Your IP address — used at the moment you submit the form to limit spam and abuse, and passed to our bot-protection provider for the same purpose. It is not stored with your enquiry or used to identify you.

What we deliberately don't collect

The enquiry form does not ask for medical history, medication details, or photographs, and we ask you not to include them. Health information needs to be handled with more care than a website contact form allows, so we cover it properly when confirming your appointment.

If you do include health details in the message box, we will treat them in confidence and use them only to respond to you. This website does not use tracking that builds a profile of you, and no decisions about you are made automatically.

Why we're allowed to use it

Data protection law requires us to have a lawful basis for using your information. For replying to an enquiry, our basis is that you have asked us to take steps with a view to booking an appointment. For keeping the form free of spam and abuse, our basis is our legitimate interest in protecting the website and the people who use it.

For optional analytics, our basis is your consent, which you give or withdraw yourself — see our cookie notice. Ticking the box on the enquiry form is not the lawful basis; it confirms you have read this notice and are happy for us to reply.

How your enquiry reaches us

Enquiries are not saved into a database on this website and are not published anywhere. The form sends your message straight to Stevie as an email, and it is read and answered from there. If our systems log a problem sending it, they record only the error — never the contents of your enquiry.

Who else is involved

We use a small number of established providers to run the website and get your enquiry to us. They act on our instructions and may not use your information for their own purposes. We never sell your information, and we don't share it for advertising.

• Cloudflare — hosts the website, delivers its images, protects the enquiry form from bots, and delivers your enquiry to us by email.
• Google — provides the mailbox the enquiry arrives in.
• PostHog — provides optional website analytics, on European servers, and only if you have agreed to it.
• Fresha — runs the booking system. If you follow a booking link you are on Fresha's own platform, and Fresha handles your information under its own privacy policy as well as ours.

Information sent outside the UK

Some of these providers are based outside the UK or store data on servers elsewhere. Where that happens, the transfer is covered by safeguards approved for use under UK data protection law, so your information keeps essentially the same protection it has here.

How long we keep it

If your enquiry doesn't lead to an appointment, we delete it within 12 months. If you go on to become a client, the records created for your treatment are kept separately under the rules that apply to health records, and for longer than 12 months — we'll explain that when you book.

You can ask us to delete your enquiry sooner, and we will unless we're required to keep it.

Booking and treatment records

Booking an appointment, attending a consultation and receiving treatment all involve information this website never sees — including the health information needed to check a treatment is safe and suitable for you. That is collected separately: by Fresha when you book, and by Stevie through secure consultation and consent forms before your treatment. You'll be given the relevant details at the point it's collected, and those records are kept under the rules that apply to health records rather than the 12-month period described above.

Keeping it secure

The website is served entirely over an encrypted connection, the enquiry form is protected against automated abuse, and access to the mailbox your enquiry arrives in is limited to Stevie. No system can be guaranteed completely secure, but we take reasonable steps to protect what you send us.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of the information we hold about you;
• have inaccurate information corrected;
• ask us to delete your information;
• ask us to restrict how we use it;
• object to our using it for our legitimate interests;
• ask us to transfer it to you or another provider, where that applies; and
• withdraw your consent to analytics at any time, without it affecting anything done beforehand.

How to exercise your rights

Email us at steviesaesthetics@gmail.com and tell us what you'd like us to do. We don't charge for this, and we'll respond within one month. We may need to check who you are before acting on a request.

Complaints

If you're unhappy with how we've handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.

Changes to this notice

If we change how we use your information, we'll update this page and the date at the top of it.