StudioTwenty2 Skin Club Privacy Notice
Last updated: 15 October 2026
Your privacy matters to us. This notice explains how we collect, use, store and share your personal information when you enquire about or join a Bronze, Silver or Gold Skin Club membership, complete a consultation or receive treatment.
Who is responsible for your information?
Studio Twenty2 NE ltd, trading as StudioTwenty2, is responsible for deciding how your membership and clinical information is used. This makes us the “data controller”.
Privacy contact: Sasha Gilling-Price
Email: sasha@studio-twenty2.co.uk
Correspondence address: 22 Killiebrigs, Heddon on the wall, NE15 0DD
Please contact us using these details if you have questions about your information or wish to exercise your data protection rights.
What information do we collect?
We collect information relevant to managing your membership and providing safe, appropriate treatment.
This may include:
Your name, date of birth, address, email and telephone number.
Emergency contact details and relevant communication or accessibility needs.
Your membership tier, agreement, payment schedule, appointments, benefits and cancellation history.
Relevant medical conditions, medicines, allergies, pregnancy or breastfeeding information, previous treatments and skin concerns.
Consultation notes, suitability assessments, patch-test results, treatment consent, products used, treatment records and aftercare.
Relevant clinical photographs, where their purpose has been explained and appropriate consent obtained.
Messages, complaints, feedback and your communication preferences.
Electronic signatures, submission dates and signing audit information, which may include IP address or device information, depending on the service used.
Payment references, collection status and refund records.
Health information receives additional protection under data protection law because it is “special category” information.
We ask you to provide accurate information and tell us about relevant changes before each treatment.
Where does this information come from?
Most information comes directly from you through enquiries, forms, consultations, appointments and communications.
We also create clinical records and receive relevant booking, payment and document-signing information from our service providers. Where appropriate and with your permission when required, we may receive information from another treating professional or someone acting on your behalf.
If you provide an emergency contact’s details, please let them know and direct them to this notice.
Why do we use your information?
We use your information to:
Respond to enquiries and arrange membership.
Manage your agreement, appointments, payments and included benefits.
Assess treatment suitability and identify relevant risks or contraindications.
Plan and record treatments, obtain informed consent and provide aftercare.
Contact you about your appointments, membership or safety.
Deal with cancellations, refunds, complaints and legal claims.
Maintain necessary accounting and business records.
Send optional marketing where you have agreed to receive it.
We do not sell your personal information or use your medical history to target advertising.
Our lawful bases
We use different legal bases for different purposes.
Providing your membership and requested services
We rely on contractual necessity under Article 6(1)(b) of the UK GDPR to take steps you request before joining and to administer and deliver your membership.
Health information and clinical records
For health information necessary to assess suitability and provide your requested treatments, we rely on contractual necessity under Article 6(1)(b), together with your explicit consent under Article 9(2)(a).
We collect this explicit consent separately. Reading this notice or signing a membership agreement does not, by itself, provide consent to every use of your health information or to treatment.
Legal obligations
We rely on Article 6(1)(c) where processing is necessary to meet an applicable legal obligation, such as maintaining tax and accounting records.
Security, complaints and legal claims
Where appropriate, we rely on legitimate interests under Article 6(1)(f) to protect our records, investigate concerns and establish or defend legal rights. We balance these interests against your rights.
Where health information is necessary for establishing, exercising or defending legal claims, Article 9(2)(f) may also apply. This does not permit indefinite retention of all medical information.
Optional marketing and publicity
We rely on your consent under Article 6(1)(a). Where publicity would reveal health information, we also obtain appropriate explicit consent.
Serious emergencies
Where necessary to protect life, we may rely on vital interests. For health information, this applies where you are physically or legally unable to give consent and the relevant legal conditions are met.
Do you have to provide information?
We need certain identity, contact and membership details to administer your agreement.
Relevant health information is necessary to assess whether treatment is safe. You can decline to provide it, but we may then be unable to offer a treatment. We will discuss any effect on your membership fairly under your agreement.
Marketing consent and permission to use photographs publicly are optional. Refusing them does not affect your care.
Who may receive your information?
We share only information needed for the relevant purpose.
Fresha
We use Fresha for booking and client administration. Fresha may process information on our behalf and separately for its own services. Its privacy notice is available at:
https://terms.fresha.com/privacy-policy
GoCardless
We use GoCardless to arrange and collect membership payments. Banking details are supplied through its payment process. We receive information needed to manage collections, such as payment references and status.
We do not send GoCardless your medical questionnaire or clinical photographs. Its payer privacy notice is available at:
https://gocardless.com/privacy/payers
Online forms, electronic signatures and record storage
Other necessary recipients
These may include authorised clinic personnel, contracted IT and storage providers, accountants, insurers, legal advisers and relevant authorities where disclosure is lawfully required.
Relevant information may also be shared with treating professionals, emergency services or your emergency contact where necessary and lawful. Being named as an emergency contact does not give someone general access to your medical records.
International transfers
Where a restricted international transfer occurs, we ensure an appropriate legal mechanism applies, such as UK adequacy regulations or suitable contractual safeguards, together with any required assessment.
You can contact us for information about the safeguards relevant to your data.
How do we protect your information?
We use proportionate technical and organisational measures to protect information against unauthorised access, loss or misuse. These include appropriate account and device protection, restricted access, secure storage and confidentiality arrangements.
Please use our approved forms or agreed communication method for medical information. Avoid sending sensitive information in public comments.
No system can guarantee absolute security. If a breach occurs, we assess it and notify the regulator or affected individuals where legally required.
How long do we keep information?
We keep information only for as long as needed for its purpose and any applicable legal requirements. The end of a 12-month membership does not necessarily mean all records can immediately be deleted.
We determine retention using these criteria:
Clinical and consent records: continuity of care, the date of your last treatment, relevant claim periods and applicable professional or insurer requirements, supported by an appropriate lawful basis.
Membership agreements and signing records: administration of the agreement, resolution of disputes and relevant legal claim periods.
Financial records: applicable tax and accounting requirements.
Enquiries and routine correspondence: whether the enquiry remains active and whether the information is needed for an ongoing service or dispute.
Marketing records: whether your consent remains current. We may retain a minimal opt-out record to ensure we respect your preferences.
Relevant records may be kept longer where necessary for an ongoing complaint or legal claim. Records are reviewed and securely deleted or anonymised when no longer needed.
You can ask us about the retention period applying to a particular record.
Marketing and photographs
Appointment reminders, payment updates and necessary aftercare messages are service communications.
Promotional emails and texts are optional. You can withdraw your marketing consent at any time using the unsubscribe option provided or by contacting us.
Clinical photographs and promotional photographs have different purposes. Consent to clinical photography does not authorise publication on our website or social media.
Any proposed publicity use will be explained separately, including where images will appear and how you can withdraw permission.
Withdrawing consent
You may withdraw consent to processing that relies on consent at any time by emailing us or telling Sasha directly.
Withdrawal does not make earlier lawful processing unlawful. If you withdraw consent needed to process relevant health information, we may be unable to continue treatment. We will discuss this with you and address the membership separately under its terms.
Withdrawal does not automatically require deletion of information that remains lawfully necessary for another disclosed purpose, such as a legal claim. We will explain any such retention.
Your rights
Depending on the circumstances, you may have the right to:
Access your personal information.
Correct inaccurate or incomplete information.
Request deletion.
Restrict how information is used.
Receive eligible information in a portable format.
Withdraw consent.
Object to certain processing.
You can object to direct marketing at any time.
You can also object to processing based on legitimate interests for reasons relating to your circumstances. We will consider your request and explain whether a lawful exception allows continued processing.
Contact sasha@studio-twenty2.co.uk to exercise your rights. We may need to verify your identity. We normally respond within one month and explain any lawful extension or restriction.
Automated decisions
StudioTwenty2 does not make solely automated decisions with legal or similarly significant effects about your treatment suitability. A practitioner assesses your suitability.
Routine booking reminders, payment scheduling and electronic signing do not replace clinical judgement. Providers explain their own processing in their privacy notices.
Questions or complaints
Please contact us if you are concerned about how your information has been handled.
You also have the right to complain directly to the Information Commissioner’s Office, the UK data protection regulator:
https://ico.org.uk/make-a-complaint/
Changes to this notice
We update this notice when our practices change and display the latest version on this page.
If we propose a new use of your information, we will explain it before proceeding and obtain fresh consent where required.
