Privacy Policy

Body Confident Aesthetics Academy (“we”, “us”, “our”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website, book a treatment, enrol on a training course, or otherwise interact with our services.

We are a provider of aesthetic treatments and beauty training courses, registered and operating in Sunderland, United Kingdom. Our registered address is 21A Windsor Terrace, Grangetown, Sunderland, SR2 9QF.

This policy applies to all visitors, clients, students, and prospective customers who use our website or engage our services. By accessing our website or booking a treatment or course with us, you consent to the practices described in this policy.

Body Confident Aesthetics Academy is the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This means we are responsible for, and accountable for, deciding how and why your personal data is processed.

If you have any questions about how we handle your personal data, or wish to exercise any of your rights under data protection law, please contact us using the details provided in Section 12 (“Contact Us”) below.

We collect several types of information from and about you depending on how you interact with us:

• Contact details: your full name, email address, telephone number, and postal address.
• Identity details: date of birth and proof of age where required for certain treatments or training enrolment.
• Medical and treatment information: relevant medical history, current medications, allergies, and treatment preferences collected during consultations to ensure safe and appropriate treatment.
• Booking and payment information: appointment details, treatment history, course enrolment records, and payment transaction data (we do not store full card details — payments are processed securely through our third-party payment providers).
• Website usage data: IP address, browser type, device information, pages visited, and referral URLs, collected automatically through cookies and similar technologies.
• Marketing preferences: your consent to receive newsletters, promotional offers, and updates about treatments or training courses.
• Communications: records of any correspondence you have with us via email, telephone, social media, or our contact forms.

We process your personal information for the following lawful purposes:

• Providing aesthetic treatments and beauty services safely and effectively, including conducting pre-treatment consultations and maintaining accurate clinical records.
• Processing bookings, appointments, and course enrolments, and managing our appointment schedule.
• Processing payments and managing financial transactions related to treatments and training courses.
• Communicating with you about your appointments, treatments, course progress, and any changes to our services.
• Sending marketing and promotional communications where you have given us explicit consent to do so.
• Maintaining clinical and training records as required by our insurers, accreditation bodies, and regulatory obligations.
• Responding to your enquiries, feedback, complaints, and requests for information.
• Improving our website, services, treatments, and training courses based on your feedback and usage data.
• Complying with our legal, regulatory, and insurance obligations, including health and safety, and safeguarding requirements.

Under UK GDPR, we rely on one or more of the following legal bases to process your personal data:

• Consent: where you have given us clear, affirmative consent to process your data (for example, for marketing communications or optional data collection).
• Contractual necessity: where processing is necessary to provide a treatment, service, or training course you have requested, or to take steps before entering into a contract with you.
• Legal obligation: where we are required to process your data to comply with a legal or regulatory obligation, such as maintaining clinical records.
• Legitimate interests: where processing is in our legitimate business interests (such as website analytics or service improvement), provided it does not override your rights and freedoms.
• Vital interests: where processing is necessary to protect your health, safety, or wellbeing (for example, in a medical emergency during a treatment).

We do not sell your personal data to any third party. We may share your information with the following categories of recipients where it is necessary to deliver our services:

• Payment processing providers who securely handle card transactions on our behalf.
• Booking and appointment management platforms (such as Fresha) that we use to manage your appointments.
• Accreditation and awarding bodies, where required to verify training course completion and issue certificates.
• Insurance providers, in the event of a claim or as required by our professional indemnity insurance.
• Review and reputation management platforms (such as Reputation Hub) that we use to collect and display verified client reviews.
• IT and website hosting providers that support our digital infrastructure and website operations.
• Regulatory authorities, law enforcement, or government bodies where we are legally required to disclose information.
• Professional advisors, including solicitors and accountants, where their advice requires access to relevant personal data.

All third parties who process your data on our behalf are required to do so in accordance with UK GDPR and our instructions. We do not transfer your personal data outside the UK without appropriate safeguards in place.

Our website uses cookies and similar technologies to operate, improve, and secure our services. Cookies are small text files placed on your device when you visit our website.

We use the following categories of cookies:

• Essential cookies: necessary for the website to function correctly, such as remembering your cookie consent preferences and enabling booking functionality.
• Analytics cookies: help us understand how visitors use our website so we can improve its content and performance.
• Marketing cookies: allow us and our advertising partners to deliver relevant content and measure the effectiveness of campaigns, where you have consented.

You can manage or withdraw your cookie preferences at any time using the cookie consent banner displayed on our website. You may also disable or delete cookies through your browser settings, though this may affect the functionality of certain features.

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

Clinical and treatment records are retained in accordance with our professional obligations and insurance requirements, typically for a minimum period as advised by our insurers and regulatory bodies.

Marketing data is retained until you withdraw your consent or request its deletion, after which it will be removed from our systems within a reasonable timeframe.

When your personal data is no longer required, we will securely delete or anonymise it in accordance with our data retention policy.

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction, or alteration. These measures include secure data storage, access controls, encryption where appropriate, and regular security reviews.

Whilst we strive to use commercially acceptable means to protect your personal data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we will notify you and the relevant authorities in the event of a data breach where required to do so by law.

Under UK GDPR, you have the following rights regarding your personal data:

• The right to be informed about how we use your data (this policy).
• The right of access to your personal data and a copy of it (subject access request).
• The right to rectification if your data is inaccurate or incomplete.
• The right to erasure (“the right to be forgotten”) in certain circumstances.
• The right to restrict or object to our processing of your data.
• The right to data portability — receiving your data in a structured, machine-readable format.
• The right to withdraw consent at any time where we rely on consent as our legal basis.
• The right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe we have mishandled your data.

To exercise any of these rights, please contact us using the details in Section 12. We will respond to your request within one month of receipt, as required by UK GDPR.

Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from children under 18. If you believe we have collected data from a person under 18, please contact us so we can remove it promptly.

If you have any questions about this Privacy Policy, or wish to exercise your data protection rights, please contact us:

Address: 21A Windsor Terrace, Grangetown, Sunderland, SR2 9QF

Email: bodyconfidentaesthetics@gmail.com

Telephone: 07982 814 260

You may also contact the Information Commissioner’s Office (ICO) at ico.org.uk or by telephone on 0303 123 1113.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. We will post any updated version on this page and, where significant changes are made, notify you through our website. We encourage you to review this policy periodically.

This policy was last updated on 22 October 2026.