This is sample content for a demonstration website. It is not legal advice and should be reviewed and adapted before use on a live site.
Who we are
Halcyon Beauty & Wellbeing (“we”, “us”, “our”) is committed to protecting your personal information. This policy explains what we collect when you use our website, book a treatment or contact us, how we use it and the choices you have.
Halcyon is the data controller for the personal information described in this policy. You can contact us at [EMAIL ADDRESS] or by post at [BUSINESS ADDRESS].
The information we collect
We collect information you give us directly, such as when you book an appointment, complete our contact form, email us or call us. This may include:
- your name, email address and telephone number
- your date of birth, where needed to check a treatment is suitable
- your appointment history and treatment preferences
- details you choose to include in your message
We also collect limited technical information automatically when you visit our website, such as your IP address, browser type and the pages you view. This is gathered through cookies (see below).
Health information
Before some treatments we ask you to complete a short consultation form. This may include information about your health, such as allergies, skin conditions, medication or pregnancy, so we can make sure a treatment is safe and suitable for you.
Health information is a special category of personal data. We only collect what we need, we ask for your explicit consent before recording it, we keep it securely and only the therapists treating you can see it. You can withdraw your consent at any time, although we may then be unable to offer certain treatments.
How we use your information
We use your personal information to:
- manage your bookings and send appointment confirmations and reminders
- check that treatments are safe and suitable for you
- provide the treatments you ask us for and keep records of them
- process payments and gift vouchers
- meet our legal and insurance obligations
- improve our website and understand how visitors use it
We will only send you offers and news by email or text if you have agreed to receive them, and you can unsubscribe at any time.
Our legal basis
Under UK data protection law we must have a lawful reason for using your information. We rely on:
- Contract: where we need your information to book and provide your treatment
- Explicit consent: for the health information on your consultation form
- Legal obligation: where the law requires us to keep certain records
- Legitimate interests: where we need to respond to enquiries and run our business effectively
- Consent: for marketing messages and non-essential cookies
Sharing your information
We do not sell your personal information. We only share it where necessary with trusted providers who help us run our business, such as our online booking system, payment provider, email and accounting software, or where we are required to by law. Anyone we share information with must keep it secure and use it only for the purpose we specify.
How long we keep it
We keep your booking and treatment records for as long as you are a client and for up to [six years] after your last appointment, as required by our insurers. Enquiries that do not lead to a booking are deleted after [12 months].
Keeping your information safe
We use appropriate technical and organisational measures to protect your personal information from loss, misuse or unauthorised access. Paper consultation forms are stored securely and digital records are password protected.
Cookies
Our website uses a small number of cookies. Essential cookies help the site and online booking work properly. Analytics cookies help us understand how visitors use the site so we can improve it. You can control or delete cookies through your browser settings at any time.
Your rights
You have the right to:
- ask for a copy of the personal information we hold about you
- ask us to correct information that is wrong or incomplete
- ask us to delete your information, where we have no legal reason to keep it
- object to or restrict how we use your information
- withdraw your consent at any time, where we rely on consent
To make a request, please contact us at [EMAIL ADDRESS]. We will respond within one month.
Complaints
If you are unhappy with how we have handled your information, please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.
Changes to this policy
We may update this policy from time to time. The latest version will always be available on this page.
Last updated: [DATE]