Privacy Policy

1. Who we are

This site is operated by Simone Sandwith trading as Revival Aesthetics, a private aesthetics studio based at 34b Hunday Court, Workington, CA14 3SL, United Kingdom. For the purposes of the UK GDPR and the Data Protection Act 2018, we are the data controller for any personal data you share with us.

Questions, requests or complaints about how we handle your data can be sent to enquiries@revivalaestheticscumbria.co.uk.

2. What we collect

• Contact details - name, email, phone number and any message you send us via the booking or contact forms.
• Booking information - the treatment you have chosen, appointment date and time, and any notes you provide.
• Health information (special category data) - consultation notes, consent forms and medical questionnaires completed before treatment.
• Loyalty records - treatments received against your loyalty card.
• Technical data - anonymised analytics (page views, device type) via Google Analytics, and standard server logs.

3. Why we use it (lawful basis)

• Contract - to arrange, confirm and deliver the treatment you have booked.
• Legal obligation - to keep clinical records for the retention periods set by professional and insurance requirements.
• Explicit consent - for processing your health information; you sign a consent form before each course of treatment.
• Legitimate interests - to run and improve the clinic, respond to enquiries, and keep our website secure.

4. Who sees your data

Your information stays with Simone Sandwith. We use trusted service providers to run the clinic and website, and share data with them only as needed:

• Our website and booking platform (Lovable / Supabase)
• Our email delivery provider, to send booking confirmations and reminders
• Google Analytics, for anonymised traffic statistics
• Our accountant and, where legally required, HMRC or regulators

We never sell your data and we do not use it for third-party marketing.

5. How long we keep it

• Clinical and consent records - 7 years from your last treatment, in line with professional indemnity guidance.
• Booking and contact records - up to 3 years after your last visit.
• Accounting records - 6 years, as required by HMRC.
• Website analytics - retained in aggregated form only.

6. Your rights

Under the UK GDPR you have the right to:

• Access a copy of the data we hold about you
• Ask us to correct anything that is wrong
• Ask us to delete your data, where we are not required to keep it
• Restrict or object to our use of your data
• Withdraw consent at any time (for health data processing)
• Receive your data in a portable format

To exercise any of these rights, email enquiries@revivalaestheticscumbria.co.uk. We aim to respond within 30 days.

If you are unhappy with our response you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

7. Cookies & analytics

We use a small number of essential cookies to keep the website working, plus Google Analytics to understand how visitors use the site. Analytics data is anonymised and never used to identify you personally. You can block cookies in your browser at any time.

8. Keeping data secure

We use encrypted storage, access controls and secure email providers. Paper consent forms are stored in a locked cabinet at the clinic. In the unlikely event of a data breach affecting your rights, we will notify you and the ICO within 72 hours.

9. Changes

We may update this policy from time to time. The "last updated" date at the top of the page shows the most recent change.