Privacy policy

Last updated:
1 September 2026

Arcane Skin respects your privacy and is committed to protecting your personal information.

This policy explains how Arcane Skin collects, uses, stores and protects your personal information when you visit our website, contact us, book an appointment, attend a treatment or otherwise interact with us.

1. Who we are

Arcane Skin is a skin and aesthetics business based in Cheltenham.

For the purposes of applicable data protection legislation, Arcane Skin is the data controller responsible for your personal information.

2. Information we collect

Depending on how you interact with Arcane Skin, we may collect:

Contact and booking information

  • Name

  • Email address

  • Telephone number

  • Appointment details

  • Booking and cancellation history

  • Payment-related information where necessary to process your booking

Consultation and treatment information

Where necessary to assess your suitability for treatment and provide safe and appropriate services, we may collect information including:

  • Relevant medical history

  • Allergies and sensitivities

  • Current medication

  • Skin conditions and concerns

  • Previous treatments

  • Current skincare products and routines

  • Treatment history

  • Relevant contraindications

  • Treatment notes and observations

  • Information about reactions or adverse events

Some of this information may constitute special category health information under UK data protection law. We will only collect and use information that is relevant and necessary for the services we provide.

Photographs

With your appropriate permission, we may take photographs to:

  • Record your treatment and skin progress;

  • Compare results over time; and/or

  • Use before-and-after images for Arcane Skin’s marketing or educational content.

Treatment-record photographs and marketing photographs will be treated as separate purposes. Marketing use will not be assumed simply because a treatment photograph has been taken.

Website information

When you use our website, we may collect technical information such as:

  • IP address

  • Browser and device information

  • Pages visited

  • How you interact with our website

  • Cookie and similar technology information

The information collected depends on the website services and technologies in use.

3. How we use your information

We may use your information to:

  • Respond to enquiries;

  • Manage appointments;

  • Provide consultations and treatments;

  • Assess treatment suitability and contraindications;

  • Maintain accurate treatment records;

  • Provide appropriate aftercare;

  • Contact you regarding your appointment;

  • Process payments;

  • Manage cancellations and refunds;

  • Respond to complaints;

  • Improve our services;

  • Maintain business and financial records;

  • Meet legal, regulatory and insurance requirements;

  • Protect the health and safety of clients and others;

  • Send marketing communications where you have provided the appropriate permission or where another lawful basis permits us to do so; and

  • Operate, secure and improve our website.

We will not use your personal information for purposes that are incompatible with those explained to you.

4. Our lawful bases

Depending on the circumstances, we may process your information because:

  • It is necessary to take steps at your request before entering into a contract;

  • It is necessary to perform our contract with you;

  • We have a legitimate interest in operating and improving Arcane Skin, maintaining appropriate business records and protecting our business;

  • We have a legal obligation to process or retain certain information; or

  • You have given consent where consent is the appropriate lawful basis.

Where we rely on consent, you can withdraw that consent at any time. Withdrawing consent does not affect processing that took place before withdrawal.

5. Health and treatment information

Information relating to your health, medication, allergies, skin conditions and treatment history may be necessary to determine whether a treatment is appropriate and to provide it safely.

We will only request information that is relevant to the services we provide and will handle it with appropriate confidentiality and security.

Providing relevant consultation information is important for your safety. If you do not provide information that is necessary to assess treatment suitability, we may need to postpone or decline treatment.

6. Who we share information with

We may share relevant information with trusted third parties where necessary to operate Arcane Skin, such as:

  • Booking and appointment-management providers;

  • Payment providers;

  • Website and hosting providers;

  • Email and communication providers;

  • Professional advisers;

  • Insurers;

  • IT and security providers; and

  • Professional, regulatory or legal bodies where we are required or permitted to do so.

We do not sell your personal information.

Where third-party providers process information on our behalf, we take appropriate steps to ensure that your information is handled in accordance with applicable data protection requirements.

7. Marketing

We may contact you about Arcane Skin services, offers, education or other marketing communications where we have a lawful basis to do so.

Where marketing consent is required, you will be asked to actively opt in. You can withdraw your marketing consent at any time.

You can unsubscribe from marketing emails using the unsubscribe facility provided or by contacting us.

8. Photographs and social media

We will only use identifiable client photographs for marketing or educational purposes where we have the appropriate permission to do so.

Agreeing to treatment does not automatically mean that you agree to your photographs being used for marketing.

You can withdraw permission for future marketing use by contacting us. Withdrawal will not affect lawful use that took place before withdrawal.

9. How long we keep your information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, taking into account:

  • The nature of the information;

  • The purpose for which it is being used;

  • Legal and regulatory requirements;

  • Insurance requirements;

  • Accounting and tax requirements;

  • The need to deal with complaints, disputes or potential claims; and

  • Our legitimate business interests.

Different types of information may therefore be retained for different periods.

When information is no longer required, it will be securely deleted or otherwise disposed of.

We retain client consultation and treatment records for seven years following your last treatment, after which they are securely deleted unless we have a legitimate reason or legal obligation to retain them for longer.

10. Keeping your information secure

We take reasonable technical and organisational measures to protect your personal information against unauthorised access, loss, misuse, alteration or disclosure.

However, no electronic transmission or storage system can be guaranteed to be completely secure.

11. Your rights

Depending on the circumstances, you may have rights under data protection law including the right to:

  • Request access to your personal information;

  • Ask us to correct inaccurate or incomplete information;

  • Ask us to erase information where there is no lawful reason for us to continue processing it;

  • Ask us to restrict processing;

  • Object to certain processing;

  • Request portability of certain information; and

  • Withdraw consent where consent is our lawful basis.

These rights are subject to legal exceptions and may not apply in every circumstance.

To exercise a right, contact us using the details above.

12. Complaints about data protection

If you are unhappy with the way we have handled your personal information, please contact Arcane Skin first so that we can try to resolve your concern. Please see our separate Complaints procedure.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology, legal requirements or the way we process information.

The latest version will be published on this page.