Privacy Policy

Last updated: 26 September 2026

1. Who I am

AT Beauty Institute is operated by Aleksandra Turkiewicz as a sole trader. I am the data controller responsible for deciding how and why your personal information is collected and used.

Business address:
312 Clarence Road
Four Oaks, Sutton Coldfield
B74 4LT

Email: atbeautyinstitute@gmail.com
Telephone: 07547 329700

2. Information I may collect

Depending on how you contact me and which services you use, I may collect:

  • Your name, telephone number, email address and postal address.

  • Appointment and booking information.

  • Details of your enquiries and communications with me.

  • Treatment history, consultation notes and consent records.

  • Relevant medical information, including allergies, medication, pregnancy status and contraindications.

  • Before-and-after photographs, where appropriate.

  • Payment and transaction information.

  • Marketing and communication preferences.

  • Technical website information, including IP address, browser type, device information and cookie data.

Please do not include confidential medical information in the general website contact form. Relevant health information will be collected securely during your consultation when required.

3. How I collect your information

I may collect information:

  • Directly from you through consultations, forms, telephone calls, WhatsApp, SMS or email.

  • Through the AT Beauty Institute website and contact form.

  • Through Timely when you book or manage an appointment.

  • Through GoCardless or another authorised payment provider.

  • Through consent and treatment-record systems.

  • From an independent prescriber or healthcare professional involved in your treatment, where appropriate and lawful.

  • Through website cookies and similar technologies.

4. How and why I use your information

I may use your personal information to:

  • Respond to enquiries.

  • Arrange, confirm and manage appointments.

  • Carry out consultations and assess treatment suitability.

  • Provide treatments safely and maintain accurate records.

  • Deliver appropriate aftercare and respond to concerns.

  • Process payments, memberships, refunds and financial records.

  • Communicate important information about appointments or services.

  • Manage complaints, insurance matters or legal claims.

  • Meet tax, accounting, insurance, legal and regulatory obligations.

  • Protect the security and operation of my website and business.

  • Send marketing messages where you have consented or where otherwise permitted by law.

  • Use treatment photographs for agreed purposes where separate permission has been provided.

5. Lawful reasons for using your information

My lawful bases may include:

  • Contract: when information is necessary to arrange or provide a service you have requested.

  • Steps before entering a contract: when you contact me to discuss a possible treatment or appointment.

  • Legal obligation: when I must retain or disclose information to meet legal, tax or regulatory requirements.

  • Legitimate interests: to manage enquiries, operate my business, maintain security, manage complaints and protect my legal rights.

  • Consent: for optional marketing communications, promotional photographs or other uses where your permission is required.

Health and treatment information is treated as special-category personal data. Where this information is required, I will rely on an appropriate lawful basis and condition, which may include your explicit consent or the establishment, exercise or defence of legal claims.

You may withdraw consent at any time by contacting me. Withdrawal will not affect processing that took place lawfully before consent was withdrawn. In some circumstances, I may be unable to provide a treatment safely without the necessary consultation and health information.

6. Photographs

Before-and-after photographs may be taken as part of your treatment record where appropriate.

Photographs will only be used for promotional, educational, website or social-media purposes when you have provided separate permission. Refusing promotional photography will not affect your ability to receive treatment.

You may withdraw permission for future use by contacting me. However, it may not always be possible to remove material that has already been printed, shared or republished by other people.

7. Who I may share information with

I do not sell your personal information.

Where necessary, information may be shared with trusted service providers, including:

  • Squarespace, which hosts my website and contact forms.

  • Timely, which provides booking and client-management services.

  • GoCardless and other payment providers used to process payments.

  • Email, telephone, SMS and WhatsApp service providers.

  • Consent and treatment-record platforms.

  • Independent prescribers or healthcare professionals involved in your treatment.

  • My accountant, insurer, legal advisers or professional advisers.

  • Technology providers supporting the secure operation of my business.

  • Regulators, law-enforcement organisations or other authorities where disclosure is required by law.

Only information reasonably necessary for the relevant purpose will be shared.

8. International data transfers

Some service providers may store or process information outside the United Kingdom. Where this happens, I will rely on recognised adequacy arrangements or appropriate contractual and organisational safeguards provided under UK data-protection law.

9. How long I keep information

I keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, insurance and professional obligations.

Generally:

  • Enquiries that do not lead to a booking may be retained for up to 12 months after the last communication.

  • Treatment, consultation and consent records are normally retained for up to eight years following your last treatment, unless my insurer or applicable legal requirements require a different period.

  • Financial and tax records are retained for the period required by HMRC.

  • Complaint, insurance and legal-claim information may be retained until the matter and any relevant limitation period have ended.

  • Marketing information is retained until you unsubscribe, withdraw consent or it is no longer required.

  • Promotional photographs may be retained until permission is withdrawn or they are no longer needed.

Information may be securely deleted or anonymised when it is no longer required.

10. How I protect your information

I take reasonable technical and organisational measures to protect personal information against loss, unauthorised access, alteration or disclosure.

Access is limited to me and to trusted providers or professionals who require the information for an authorised purpose. However, no method of electronic transmission or storage can be guaranteed to be completely secure.

11. Marketing communications

I will only send promotional emails, SMS or WhatsApp messages where I have an appropriate lawful reason to do so.

You can unsubscribe or withdraw your marketing consent at any time by using the unsubscribe option in a message or contacting me directly.

Withdrawing from marketing will not stop essential communications relating to your appointments, treatments, payments or aftercare.

12. Cookies and website information

The AT Beauty Institute website may use essential cookies to operate correctly and optional cookies for analytics or other features.

Where required, optional cookies will only be used after you have made a choice through the website’s cookie banner. You can also control cookies through your browser settings.

More information is available in the website’s Cookie Policy and cookie settings.

13. Your data-protection rights

Depending on the circumstances, you may have the right to:

  • Ask for a copy of the personal information I hold about you.

  • Ask for inaccurate information to be corrected.

  • Ask for information to be deleted.

  • Ask for processing to be restricted.

  • Object to certain uses of your information.

  • Withdraw consent where consent is being relied upon.

  • Receive certain information in a portable format.

  • Complain about how your information has been handled.

These rights are not absolute and may be limited where I must retain information for legal, insurance, safety or professional reasons.

To exercise your rights, contact me using the details at the beginning of this policy. I may need to confirm your identity before completing a request.

14. Automated decision-making

I do not use personal information to make solely automated decisions that produce legal or similarly significant effects.

15. Data-protection complaints

If you have a concern about how your personal information has been used, please contact me first so I can investigate it.

I will acknowledge a data-protection complaint within 30 days and will take appropriate steps to investigate and communicate the outcome.

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/

16. Changes to this policy

I may update this Privacy Policy when my services, systems or legal obligations change. The most recent version will always be available on this website, with the date of the latest update shown at the top.