Privacy Policy

1. Introduction & Who We Are

At Just Gorgeous, we respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and safeguard your data when you visit our website (justgorg.com), book an appointment, or undergo beauty, nail, lash, and aesthetic treatments with us in London, United Kingdom.

For the purposes of the UK Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), the data controller is Just Gorgeous (contact: michaela@justgorg.com).

2. Information We Collect

To provide professional, safe, and tailored beauty and aesthetic treatments, we may collect and process the following categories of information:

• Contact & Identity Details: Full name, email address, telephone number, and home address.
• Health & Consultation Information (Special Category Data): Medical history, allergies, medications, skin conditions, pregnancy status, and patch test records. This information is collected strictly with your explicit consent to ensure treatment safety and suitability.
• Appointment & Treatment Records: Treatment dates, services received (e.g., BIAB nails, lash lifts, vitamin treatments), products and pigment shades used, and practitioner treatment notes.
• Before & After Photography: Photographs taken before and after treatments for client record keeping, insurance compliance, and (only with your explicit opt-in consent) social media or portfolio showcase.
• Financial Information: Payment transactions and deposit records processed securely via PCI-DSS certified payment providers (such as Stripe) or financing partners. We do not store raw card numbers.
• Technical & Website Data: IP address, device type, browser settings, and page interaction data collected via privacy-conscious session cookies.

3. Lawful Basis for Processing Your Data

Under UK GDPR, we process your personal data under the following legal bases:

• Contract Performance: To schedule appointments, manage booking confirmations, provide requested treatments, and deliver customer support.
• Explicit Consent: Required for processing medical and consultation health questionnaires, patch tests, and any optional marketing or photography consent.
• Legal & Insurance Obligations: Maintaining treatment and consultation records as required by UK public liability and aesthetic treatment insurance policies.
• Legitimate Interests: Running our business effectively, ensuring treatment quality, and sending relevant appointment reminders.

4. How We Store & Protect Your Records

All personal and health consultation records are stored securely using password-protected, encrypted systems with access restricted solely to authorized staff. In line with UK aesthetic insurance guidelines and legal statutes of limitation, client consultation cards and treatment histories are securely retained for up to 7 years following your last appointment (or 7 years following a client's 18th birthday if applicable), after which they are securely destroyed.

5. Third-Party Disclosures

We do not sell, rent, or trade your personal information to third-party advertisers or brokers. Your data is only shared with trusted service providers who assist our operations under strict confidentiality agreements, including:

• Our secure online appointment scheduling platform.
• PCI-compliant payment processing providers (e.g., Stripe) and approved treatment finance providers (only upon your request).
• Professional insurers or legal advisors if strictly required for regulatory compliance or claims defense.

6. Cookies & Website Analytics

Our website utilizes necessary session cookies to support secure navigation, form submission, and online scheduling. We do not use intrusive tracking cookies or cross-site advertising trackers. You can adjust cookie preferences through your browser settings at any time.

7. Your Rights Under UK GDPR

Under UK data protection law, you have specific rights regarding your personal information:

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can request correction of any incomplete or inaccurate records.
• Right to Erasure: You can ask us to delete your personal data (except where we are legally or contractually obliged by insurance to retain treatment records).
• Right to Withdraw Consent: Where processing is based on consent (such as promotional marketing or portfolio photos), you can withdraw your consent at any time.
• Right to Complain: You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

If you have any questions regarding this Privacy Policy, wish to update your contact information, or want to exercise your data protection rights, please contact Michaela: