Privacy Policy

Last updated: July 2026

The Barefaced Edit respects your privacy and is committed to protecting your personal and clinical information.

This Privacy Policy explains what information we collect, why we collect it, how it is used and shared, how long it is retained and the rights available to you under the UK General Data Protection Regulation, the Data Protection Act 2018 and other applicable data-protection legislation.

1. Who we are

The Barefaced Edit is operated by:
The Barefaced Edit Ltd
Company number: 17288690
Registered office: 30 Brunswick Road, Shoreham-by-Sea, BN43 5WB

For the purposes of data-protection law, The Barefaced Edit Ltd is the data controller responsible for deciding how and why your personal information is processed.

Our clinic is based at:
The Barefaced Edit
ShoreRooms
Mariner Point
81B Brighton Road
Shoreham-by-Sea
BN43 6DG

For privacy enquiries, please contact:
Email: hello@thebarefacededit.co.uk

2. Information we may collect

Depending on how you interact with us, we may collect and process the following information.

Identity and contact information
This may include your name, date of birth, address, telephone number, email address, emergency-contact details, and photographic identification where age verification is required.

Appointment and payment information
This may include appointment dates and booking history, booking fees, deposits and payments, invoices and transaction records, cancellation and non-attendance information, and correspondence concerning your booking. We do not ordinarily store complete payment-card details. Payments may be processed by an external payment provider operating under its own privacy and security arrangements.

Medical and clinical information
Health information is special-category personal data and receives additional legal protection. We may collect information about your: current and previous medical conditions, allergies and sensitivities, medication, pregnancy or breastfeeding status, previous aesthetic or injectable treatments, treatment concerns, expectations and goals, clinical assessments, prescriptions and prescribed products, products administered, treatment notes and outcomes, adverse reactions or complications, aftercare and review appointments, and communications relating to your care. You must provide accurate and complete information so that we can assess your suitability and provide treatment safely.

Clinical photographs
Clinical photographs may be taken where they are reasonably required for assessment and treatment planning, recording your condition before treatment, monitoring treatment outcomes, supporting review appointments, and maintaining an accurate clinical record. Clinical photographs held as part of your treatment record are kept confidential. Photographs will not be used on our website, social media, advertising or other promotional material without your separate and explicit consent. You may decline marketing photography without this affecting your treatment.

Website and technical information
When you use our website, we may collect limited technical information such as your IP address, browser and device type, pages visited, the date and time of your visit, referral source, and cookie or analytics information.

Communications
We may retain emails, telephone notes, website enquiries, text messages, social-media messages and other correspondence where this is relevant to your appointment, treatment, complaint or ongoing care.

3. How we obtain your information

We usually obtain personal information directly from you when you submit an enquiry, create a booking, complete a medical or consent form, attend a consultation or treatment, contact us about aftercare, make a payment, or provide consent for marketing communications.

We may also receive relevant information from an independent prescriber involved in your care, a pharmacy supplying medication, another healthcare professional (where authorised or lawful), emergency services, our booking/consent/payment providers, or a person contacting us on your behalf with your authority.

4. Why we use your information

We may use your information to respond to enquiries, arrange and manage appointments, verify your identity or age, assess your medical suitability, plan and provide treatment, obtain an appropriate prescription where required, maintain accurate clinical records, provide aftercare and arrange reviews, identify and manage adverse reactions or complications, communicate important information about your treatment, process payments, refunds and invoices, manage cancellations and missed appointments, investigate and respond to concerns or complaints, comply with professional, legal, insurance and regulatory obligations, establish, exercise or defend legal claims, improve the administration and security of our services, and send marketing where you have consented or where another lawful marketing basis applies.

5. Our lawful bases

Data-protection law requires us to identify an appropriate lawful basis for each way in which we use personal information. Depending on the purpose, we may rely on the following Article 6 lawful bases:

• Contract: Processing may be necessary to arrange an appointment, provide services you have requested, take payment, administer your booking, or take steps at your request before entering into a treatment agreement.
• Legal obligation: We may process information where necessary to comply with legal, tax, accounting, medicines-management, safeguarding or other applicable obligations.
• Legitimate interests: We may rely on our legitimate interests to maintain appropriate business and clinical records, manage and protect the clinic, respond to enquiries and complaints, prevent fraud or misuse, defend legal claims, maintain the security of our systems, and improve our services. We will only rely on legitimate interests where our interests are not overridden by your rights and interests.
• Vital interests: In an emergency, we may use or disclose information where this is necessary to protect your life or the life of another person.
• Consent: We may rely on consent for specific activities, including the promotional use of photographs, certain marketing communications, and optional cookies. You may withdraw consent at any time. Withdrawal will not affect processing that took place lawfully before consent was withdrawn.

6. Health and special-category information

Medical and health information is classed as special-category personal data. In addition to an Article 6 lawful basis, we must identify a separate Article 9 condition before processing this information.

Depending on the circumstances, we may process health information where it is necessary for the provision or management of health treatment or care by, or under the responsibility of, a healthcare professional who is subject to confidentiality obligations; establishing, exercising or defending legal claims; protecting vital interests in an emergency where you are unable to give consent; or another applicable condition permitted by data-protection law.

Where explicit consent is the appropriate Article 9 condition, it will be requested separately. Consent to the processing of information is not the same as consent to receive a clinical treatment.

7. Who we may share information with

We only share information where it is necessary, proportionate and lawful. Information may be shared with:

• An independent prescriber involved in assessing or prescribing for your treatment
• A regulated pharmacy or product supplier where necessary to fulfil a prescription
• Healthcare professionals involved in your care
• Emergency services or your GP where urgent medical assistance is required
• Our booking, consent, record-management, communication and payment providers
• Professional advisers, including accountants, insurers and legal advisers
• IT, website, storage and cybersecurity providers
• Professional bodies, regulators or law-enforcement authorities where disclosure is legally required
• Safeguarding authorities where there is a lawful need to protect a child or adult at risk
• Another organisation involved in the sale, transfer or restructuring of the business, subject to appropriate confidentiality and data-protection safeguards

Independent prescribers and pharmacies may act as separate data controllers for the information they process under their own professional and legal responsibilities. We do not sell your personal or clinical information.

8. Service providers and data processors

We may use external organisations to provide services such as appointment booking, digital consent forms, clinical-record storage, email and text communications, website hosting, cloud storage, payment processing, accountancy, and IT support. Where these organisations process information on our behalf, we require appropriate contractual and security protections. Some providers may also process information as independent data controllers. Their own privacy notices will explain how they use your information.

9. International data transfers

Some technology, cloud, email, booking or payment providers may store or access information outside the United Kingdom. Where personal information is transferred internationally, we will take reasonable steps to ensure that an appropriate legal transfer mechanism and safeguards are in place, such as transfer to a country recognised as providing adequate protection, the use of approved contractual safeguards, or another lawful transfer mechanism. You may contact us for further information about the safeguards used for relevant international transfers.

10. How we protect your information

We use appropriate organisational and technical measures designed to protect information from unauthorised access, accidental loss, inappropriate alteration, misuse, disclosure, and destruction. These measures may include password protection, access controls, secure systems, staff confidentiality obligations, encrypted services where available and procedures for responding to data incidents.

Only people who reasonably require access to your information are permitted to use it. No method of electronic storage or transmission can be guaranteed to be completely secure, but we take proportionate steps to protect the information in our care.

11. How long we retain information

We retain information only for as long as it is reasonably required for the purpose for which it was collected and to meet our legal, professional, insurance and clinical-record obligations.

Clinical records will ordinarily be retained for at least eight years from the date of your last treatment or clinical contact, unless a longer period is required because of the nature of the treatment, an ongoing complaint or legal claim, professional or insurance requirements, safeguarding concerns, or another legal obligation.

Financial and accounting records will generally be retained for the period required by tax and company law.

Marketing information will be retained until you unsubscribe, withdraw consent or we determine that it is no longer appropriate to retain it.

Website and technical information may be held for shorter periods according to the relevant cookie, analytics or security purpose.

At the end of the relevant retention period, information will be securely deleted, anonymised or destroyed where it is no longer required.

12. Marketing communications

We will not send electronic marketing merely because you have attended the clinic. We may send marketing emails or messages where you have actively opted in, or the law allows us to contact an existing customer about similar services and we have provided a clear opportunity to opt out. Every electronic marketing message will contain, or be accompanied by, a straightforward way to unsubscribe.

You may withdraw from marketing at any time by contacting us or using the unsubscribe option provided. Opting out of marketing will not prevent us from sending necessary service messages about appointments, prescriptions, aftercare, safety or payments.

13. Your rights

Depending on the circumstances and the lawful basis being used, you may have the right to:

• Be informed about how your information is used
• Request access to the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of information in certain circumstances
• Request restriction of processing
• Object to processing based on legitimate interests
• Object to direct marketing at any time
• Request the transfer of information you provided to us in a portable format where applicable
• Withdraw consent where processing relies on consent
• Complain to the Information Commissioner’s Office

These rights are not absolute. For example, we may be required to retain clinical records despite a request for deletion where they remain necessary for legal, professional, insurance, patient-safety or legal-claims purposes. We may ask you to provide proof of identity before responding to a rights request.

14. Automated decision-making

We do not currently use personal information to make solely automated decisions that produce legal or similarly significant effects concerning your treatment.

15. Concerns and complaints

We welcome the opportunity to address any concern. Please contact The Barefaced Edit as soon as possible so that we can review what has happened and respond in accordance with our complaints procedure.

Privacy contact: The Barefaced Edit Ltd
Email: hello@thebarefacededit.co.uk
Registered office: 30 Brunswick Road, Shoreham-by-Sea, BN43 5WB
Clinic address: ShoreRooms, Mariner Point, 81B Brighton Road, Shoreham-by-Sea, BN43 6DG

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data-protection matters.
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113

16. Changes to this policy

We may update this Privacy Policy to reflect changes to our services, systems, suppliers or legal obligations. The latest version will be published on our website with the date it was last updated.