Privacy & Cookie Policy

Effective Date: 1st March 2026

​

Clinic Name: Dr JB Skin
Clinic Address: UNTIL, 1 Orchard Street, London, W1H 6HJ
Contact Email: info@drjbskin.com
Contact Telephone: 07774 569396

​

Dr JB Skin ('the Clinic', 'we', 'our', 'us') is committed to protecting your privacy and ensuring that your personal information is handled securely, responsibly and transparently.

​

We process personal data in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

​

This Privacy & Cookie Policy explains how we collect, use, store, share and protect your personal information when you visit our website, contact us, book an appointment, purchase skincare products or receive our treatments and services.

​

​

1. DATA CONTROLLER

Dr JB Skin is responsible for determining how and why your personal information is processed in connection with our services.

​

If you have any questions about this policy or how your personal information is handled, please contact us using the details above.

​

​

2. PERSONAL DATA WE COLLECT

We may collect and process the following categories of personal information.

​

Identity and Contact Information

• Full name

• Date of birth

• Postal address

• Email address

• Telephone number

 

Medical and Skin Health Information

to assess your suitability for treatment and provide safe, appropriate skin and laser services, we may collect:

• Medical history and relevant health conditions

• Current medications and allergies

• Skin type, skin tone and skin concerns

• Previous skin, aesthetic and laser treatments

• History of pigmentation disorders, scarring or other relevant skin conditions

• Consultation notes and treatment records

• Treatment settings and clinical observations

• Clinical photographs

• Consent forms and aftercare records

• Relevant information about lifestyle, sun exposure and skincare routines

 

Health information is classified as special category personal data under UK GDPR and is subject to additional legal protections.

​

Appointment and Payment Information

• Appointment dates and booking history

• Treatments and skincare products purchased

• Payment and transaction records

• Deposits, cancellations and refunds

 

Where payments are processed by third-party providers, we do not necessarily receive or retain your full payment card details.

​

Website and Enquiry Information

When you contact us through our website or submit an enquiry, we may collect:

• Name

• Email address

• Telephone number

• Information included in your enquiry

• Any other information you voluntarily provide

 

Website Usage Information

When you visit our website, certain technical information may be collected, including:

• IP address

• Browser type and version

• Device information

• Pages visited

• Website interaction information

• Cookie preferences

 

The information collected depends on the website technologies and cookies in use.

​

​

3. HOW WE COLLECT YOUR INFORMATION

We collect personal information when you:

• Book an appointment online, by telephone or in person

• Attend a consultation or treatment

• Complete medical history or consent forms

• Contact us by email, telephone or website enquiry form

• Purchase skincare products or treatment packages

• Subscribe to marketing communications

• Provide clinical information or photographs

• Visit and interact with our website

 

We may also receive information from third-party booking, payment or practice management platforms used to provide our services.

​

Where appropriate and lawful, relevant information may be received from other healthcare professionals involved in your care.

​

​

4. HOW WE USE YOUR PERSONAL DATA

We use your personal information to:

Provide Safe and Appropriate Treatments

• Assess suitability for chemical peels, microneedling, BBL HEROic, MOXI laser and other skin treatments

• Review medical history and identify potential contraindications

• Develop individual treatment plans

• Provide treatments safely and appropriately

• Monitor treatment progress and outcomes

• Manage complications and provide aftercare

 

Manage Clinic Operations

• Arrange and manage appointments

• Process payments, deposits and refunds

• Send appointment confirmations and reminders

• Respond to enquiries

• Maintain accurate clinical and administrative records

 

Meet Legal and Professional Obligations

• Maintain treatment and consent records

• Comply with applicable legal and regulatory requirements

• Investigate complaints or concerns

• Establish, exercise or defend legal claims where necessary

 

Improve Our Services

• Improve clinic operations and patient experience

• Maintain website functionality and security

• Understand website performance where permitted

 

Marketing

Where permitted by applicable law, we may send information about treatments, skincare products, clinic news and special offers.

​

​

5. LAWFUL BASIS FOR PROCESSING PERSONAL DATA

Under UK GDPR, we must have a valid lawful basis for processing your personal information.

​

Depending on the purpose, we may rely on:

 

Contractual Necessity - Article 6(1)(b)

Processing necessary to arrange and provide services you have requested, manage appointments and fulfil our contractual obligations.

​

Legal Obligation - Article 6(1)(c)

Processing necessary to comply with applicable legal and regulatory requirements.

​

Legitimate Interests - Article 6(1)(f)

Processing necessary for legitimate business interests, including responding to enquiries, maintaining clinic security, managing operations and improving services, provided these interests are not overridden by your rights and freedoms.

 

Consent - Article 6(1)(a)

Where required, we rely on your consent for activities such as certain marketing communications, optional promotional photography and non-essential website cookies.

​

You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

​

Special Category Health Data

Where we process information about your health, an additional condition under Article 9 UK GDPR is required.

​

Depending on the circumstances and the professional status of those providing care, this may include processing necessary for healthcare purposes under Article 9(2)(h), together with applicable Data Protection Act 2018 requirements.

​

Where that condition is not applicable, we will identify another appropriate legal condition, which may include explicit consent under Article 9(2)(a).

​

Consent to undergo treatment is separate from consent relied upon for processing personal data.

​

​

6. WEBSITE HOSTING AND ONLINE ENQUIRIES - WIX

Our website is hosted and managed using Wix.

​

When you visit our website or submit an enquiry, certain personal information may be processed through Wix, including:

• Name and contact details submitted through website forms

• Information voluntarily included in enquiries

• IP address and device information

• Website usage and interaction information

• Cookie preferences and related consent records

 

This information is used to operate our website, respond to enquiries, maintain website security and improve our services.

​

Where necessary, information submitted through our website may be transferred to our clinic management system to manage enquiries, appointments or patient care.

​

Wix may process personal information using its own infrastructure and approved service providers, subject to applicable data protection safeguards.

​

​

7. ONLINE BOOKINGS AND PATIENT MANAGEMENT - PABAU

Dr JB Skin uses Pabau as its booking, patient management and customer relationship management (CRM) system.

 

Pabau is used to manage information relating to consultations, appointments, treatments and patient communications.

​

Information processed through Pabau may include:

• Patient names and contact details

• Appointment bookings and treatment history

• Medical questionnaires and consultation forms

• Medical history and skin assessments

• Treatment plans and clinical notes

• Chemical peel, microneedling, BBL HEROic and MOXI treatment records

• Clinical photographs

• Consent forms

• Aftercare instructions

• Payment and transaction information

• Patient communications and marketing preferences

 

Pabau processes patient information on behalf of the Clinic in accordance with applicable contractual and data protection requirements.

​

We use this information to provide safe and appropriate treatments, maintain clinical records, manage appointments and communicate with patients.

​

Access to patient information is restricted to authorised personnel with a legitimate need to access it.

​

​

8. MEDICAL RECORDS AND DATA RETENTION

Clinical records are securely managed using Pabau, our electronic clinic management and medical records platform.

​

We maintain appropriate records of consultations, treatments, consent, clinical photographs and aftercare to support patient safety and continuity of care.

​

Medical and treatment records are retained for periods that are necessary and appropriate in accordance with applicable legal, regulatory, professional and clinical requirements.

​

Retention periods may vary depending on the nature of the information, the treatment provided and any relevant legal obligations or claims.

​

We do not retain personal data indefinitely without an appropriate lawful basis.

​

When information is no longer required, it will be securely deleted, anonymised or otherwise disposed of in accordance with our retention procedures.

​

​

9. CLINICAL PHOTOGRAPHY

Clinical photographs may be taken before, during or after treatment for:

• Skin assessment and treatment planning

• Monitoring skin changes and treatment progress

• Evaluating treatment outcomes

• Maintaining accurate clinical records

• Supporting patient safety and continuity of care

 

Clinical photographs collected for these purposes are treated as confidential patient information.

​

Marketing and Promotional Photography

We will not use identifiable clinical photographs for website content, advertising, social media or other promotional purposes without obtaining separate, explicit consent.

​

You are not required to consent to promotional photography to receive treatment.

​

You may withdraw consent for future promotional use by contacting us.

Withdrawal of consent does not necessarily affect uses already lawfully made before withdrawal.

​

​

10. PATIENT COMMUNICATIONS AND MARKETING

We may use Pabau and other authorised communication providers to contact patients.

​

Appointment and Treatment Communications

These may include:

• Appointment confirmations and reminders

• Consultation and medical questionnaire requests

• Treatment preparation instructions

• Aftercare information

• Follow-up appointments

• Important updates relating to your care

 

These communications are sent for legitimate clinical and administrative purposes and are separate from promotional marketing.

​

Marketing Communications

Where permitted by applicable law, we may send information about:

• Skin and laser treatments

• New services and skincare products

• Special offers and promotions

• Clinic news and events

 

Marketing communications may be sent by email, SMS or telephone, subject to applicable UK marketing rules.

​

Where consent is required, we will obtain it before sending marketing communications.

​

In certain circumstances, existing customers may receive marketing about similar products or services under applicable soft opt-in rules, provided the legal requirements are met and a clear opportunity to opt out is offered.

​

You may unsubscribe from marketing communications at any time by:

• Clicking the unsubscribe link in marketing emails

• Following the opt-out instructions in SMS messages

• Contacting info@drjbskin.com

 

Opting out of marketing will not prevent us from sending necessary appointment, treatment or patient safety communications.

​

We do not sell your personal information to third parties.

​

​

11. SHARING YOUR PERSONAL DATA

We may share personal information with trusted third parties where necessary for the operation of the Clinic or provision of our services.

​

These may include:

• Wix - website hosting, forms and technical services

• Pabau - appointment booking, patient records, clinical documentation and CRM functions

• Payment processing providers

• Email and SMS communication providers

• Healthcare professionals involved in your care

• Professional advisers, insurers or legal representatives where appropriate

• Regulatory authorities or public bodies where required by law

 

Where third parties process personal information on our behalf, we take appropriate steps to ensure that suitable contractual and data protection safeguards are in place.

​

We only share information where there is an appropriate lawful basis and where sharing is necessary and proportionate.

​

We do not sell patient information or share it with unrelated third parties for their own marketing purposes without an appropriate lawful basis.

​

​

12. INTERNATIONAL DATA TRANSFERS

Some third-party software, hosting or communication providers may process or store personal information outside the United Kingdom.

​

Where personal data is transferred internationally, we will ensure that an appropriate transfer mechanism or safeguard is in place as required by UK data protection law.

​

These safeguards may include UK adequacy regulations, the UK International Data Transfer Agreement or other legally recognised mechanisms.

​

Further information about relevant international transfers and safeguards may be requested using our contact details.

​

​

13. DATA SECURITY

We take appropriate technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure, loss or destruction.

​

These measures may include:

• Secure electronic record systems

• Appropriate encryption and secure transmission methods

• Restricted user permissions

• Password-protected accounts

• Access controls

• Secure third-party service providers

• Staff confidentiality obligations

• Procedures for managing data security incidents

 

While we take reasonable steps to protect personal data, no electronic system or method of transmission can be guaranteed to be completely secure.

​

Where a personal data breach occurs, we will assess and respond to it in accordance with applicable legal requirements, including notification obligations where relevant.

​

​

14. COOKIES AND WEBSITE TRACKING

Our website is built using Wix and may use cookies and similar technologies to operate correctly, maintain security and improve the visitor experience.

​

Cookies are small text files stored on your device when you visit a website.

​

Types of Cookies:

Strictly Necessary Cookies

• These support essential website functionality, security and the recording of cookie preferences.

• They generally do not require consent under applicable UK cookie rules.

​

Analytics Cookies

• Where enabled, these help us understand website traffic, visitor interactions and website performance.

• Where consent is required by law, these cookies will only be activated after you provide consent.

​

Functional Cookies

• These may support additional website features and remember visitor preferences.

• Where consent is required, they will only be used with your permission.

​

Marketing Cookies

• Where enabled, these may be used to measure advertising performance or support relevant marketing activities.

• These cookies will only be activated where the necessary consent has been obtained.

​

Cookie Consent and Preferences

• Where our website uses non-essential cookies, visitors will be given an appropriate opportunity to accept or reject them before they are placed.

• You may manage your cookie preferences through the cookie consent controls available on our website.

• You may also manage or delete cookies through your browser settings.

• Disabling certain cookies may affect some website functions.

• Some third-party booking tools or embedded services, including Pabau, may use their own cookies. Where applicable, these will be subject to appropriate privacy information and consent requirements.

• Details of the specific cookies used, their providers, purposes and durations will be made available through the website's cookie settings or cookie information panel.

​

​

15. YOUR RIGHTS UNDER UK GDPR

Depending on the circumstances and applicable law, you have the right to:

• Access - Request a copy of the personal information we hold about you.

• Rectification - Request correction of inaccurate or incomplete personal information.

• Erasure - Request deletion of personal information where legally permitted.

• Restriction - Request that processing of your information is restricted in certain circumstances.

• Objection - Object to certain processing activities, including direct marketing.

• Data Portability - Request transfer of certain personal information in a structured, commonly used and machine-readable format.

• Withdraw Consent - Withdraw consent where processing is based on consent.

• Automated Decision-Making - Exercise applicable rights relating to qualifying automated decisions.

 

These rights are not absolute and may be subject to legal exemptions, particularly where medical records must be retained for legitimate clinical or legal purposes.

​

To exercise your rights, please contact:

info@drjbskin.com

We will respond within the timeframes required by applicable data protection law, generally within one month of receiving a valid request, subject to any permitted extensions.

​

​

16. DATA PROTECTION COMPLAINTS

If you have concerns about how we collect, use or protect your personal information, please contact us.

Email: info@drjbskin.com
Telephone: 07774 569396

We aim to acknowledge complaints within two working days and address them promptly and fairly.

​

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

​

Information Commissioner's Office
Website: www.ico.org.uk

You do not need to contact the Clinic before exercising your right to complain to the ICO.

​

​

17. THIRD-PARTY WEBSITES

Our website may contain links to external websites, platforms or services.

​

These third-party websites operate under their own privacy policies and terms.

​

We are not responsible for the privacy practices or content of external websites that we do not control.

​

We encourage you to review the relevant privacy policies before providing personal information.

​

​

18. CHILDREN'S PRIVACY

Our cosmetic skin and laser treatment services are intended for adults aged 18 years and over.

​

We do not knowingly collect children's personal information for the purpose of providing cosmetic treatments to minors.

​

If we become aware that personal information has been collected inappropriately, we will take appropriate steps in accordance with applicable data protection law.

​

​

19. CHANGES TO THIS PRIVACY & COOKIE POLICY

We may update this Privacy & Cookie Policy from time to time to reflect changes in legislation, clinic operations, website technologies or the services we provide.

​

Any updated version will be published on our website with a revised effective date.

​

We encourage visitors and patients to review this policy periodically.