MILA BEAUTY · KIRKHAM
Privacy notice.
Draft for owner and legal review, updated 12 November 2026 (private matching and medical declaration revised). Before accepting real bookings, add the business operator's full legal name, correspondence address and a working privacy email address. Confirm this notice with the actual treatments and insurer's requirements.
Who controls your information
Mila Beauty, operated by [insert proprietor/limited company legal name], Kirkham, Lancashire. Privacy contact: [insert contact email]. We are responsible for the use of your personal information.
Bookings and customer details
We use your name, email address, optional telephone number, booked service and appointment details to arrange, manage and communicate about appointments. Our normal UK GDPR Article 6 lawful basis for booking administration is performance of a contract (or steps you ask us to take before entering one). We use essential administrative and security information for legitimate interests or legal obligations where appropriate. We do not sell your information.
Health, consultations and patch tests
When enabled, the optional online consultation form can record allergies, medication information, relevant health or skin conditions, previous reactions and other details you provide. These are particularly sensitive health information. We ask for separate explicit permission to process these answers for treatment safety and consultation, alongside an appropriate Article 6 lawful basis. Providing the information in advance is optional, but if we cannot assess treatment safety we may not be able to proceed. You can instead discuss suitable arrangements with the practitioner. We may need to preserve limited records where there is another valid legal basis and Article 9 condition, such as establishing or defending legal claims. Any such use must be justified separately.
Consultation answers are encrypted within the database before storage. Staff can access them only through the protected owner backroom. A practitioner should confirm or update relevant health information and discuss treatment-specific risks and suitability at each appointment. Records may also include the outcome and date of patch tests, products used, the practitioner's observations and treatment information.
Private recognition and pre-visit checks
For every online appointment we ask whether anything is medically relevant or has changed since your previous visit. The response is recorded against that appointment for private practitioner review. We may check the email address and/or mobile number internally against previous bookings to help identify potential existing client records. A possible match does not confirm identity and is not used to grant a customer access to previous records. Only authorised salon staff can confirm a match, review prior treatment history, and amend salon records after discussing the information with you. If no safe match can be established, the salon handles the appointment as a new client consultation. Neither the match result nor any historic consultation is shown on your public booking page.
For the private medical declaration we request a separate health-data processing acknowledgement, with the lawful basis and special-category condition subject to the salon's final data-protection assessment. When configured, an ordinary customer email acknowledges receipt without sharing health history, while an owner notification prompts a review in the protected backroom. An email about the booking does not replace clinical suitability, informed consent or patch testing.
How long records are kept
We no longer automatically delete all bookings 48 hours after appointments. Pending confirmation of insurer and professional requirements, our provisional treatment/consultation record period is seven calendar years after the appointment, with longer retention only where justified (for example, an unresolved complaint or legal claim). Records of cancellations without treatment, marketing preferences and routine messages are reviewed separately. The website's ordinary message conversations are normally deleted 30 days after last activity. We regularly review what remains necessary and may securely delete or anonymise information sooner when justified. We will publish a final retention schedule before the system is used for live health records.
Daily salon diary email
If the owner enables it, a morning email may summarise that day's appointments, including name, treatment, appointment time and contact details. It does not include your consultation answers. The owner's private mailbox is restricted, should use multi-factor authentication and is subject to a short operational deletion schedule, currently targeted at 30 days. Email copies and Cloudflare service backups may remain outside the live booking database according to their own retention practices.
Your rights
You can ask for access, correction, restriction or erasure where applicable, object to certain uses, and withdraw consent where we rely on it. Withdrawal does not make earlier lawful processing invalid; some information may still need to be kept for a separate justified purpose. Contact the salon using the details above. You can also complain to the Information Commissioner's Office.
Website security and providers
We use Cloudflare for hosting, data storage, protective site checks and access controls, with the site managed by the salon owner. Private booking links are confidential and should not be shared. Customer check-in acknowledgements require a configured transactional email provider. Owner notifications require configured salon email delivery. The salon must disclose the actual provider and any necessary international transfer arrangements before launch.