Privacy Policy

Last updated: 21 October 2026

I’m Chané Haigh, owner of Zuré Skin Clinic in Addlestone, Surrey. Looking after your personal information is part of looking after you. This policy explains what I collect, why I need it and the choices you have.

I’m responsible for how your information is used (the ‘data controller’). If you have any questions, email hello@zureskinclinic.com.

What information I collect

When you enquire, book or visit, I may collect your name, contact details, address, date of birth, appointment details, messages and payment records.

For treatments, I also ask about your skin, skincare routine, previous treatments and relevant health information, including medication and allergies. Your record may include consultation answers, consent, treatment notes, products used, aftercare and clinical photographs.

Most information comes from you. Booking and payment providers also send appointment and transaction updates. The website may collect your IP address, browser, device and visit information, depending on your cookie choices.

Please use the consultation forms for health information rather than social media or the general website enquiry form.

Why I need your information

I use it to answer enquiries, manage appointments, assess suitability, provide treatments and aftercare, take payments and keep records.

The legal reasons for these uses are:

• Our contract: arranging and providing the services you request.

• Legal obligations: keeping financial and tax records.

• Legitimate interests: running the clinic safely, maintaining reliable records, protecting information and dealing with complaints or claims, while considering your rights.

• Your consent: optional marketing and promotional use of your images.

Health information needs extra protection. I ask for your explicit consent to use the information needed to assess suitability and provide treatment, alongside our contract. This is separate from agreeing to the treatment or marketing.

You can decline or withdraw this permission by emailing me. Without information needed to treat you safely, I may be unable to offer or continue treatment. Withdrawal does not change what was lawfully done beforehand. Relevant health records may still be kept or used where necessary for legal claims, with an appropriate lawful basis.

Photographs and marketing

With your permission, clinical photographs help document your skin and progress. These are part of your confidential treatment record.

I will ask separately before using photographs, videos or identifiable testimonials for marketing. This is entirely optional and saying no will not affect your treatment. Where images reveal health information, I ask for your explicit permission to share that information too.

You can withdraw marketing permission by emailing me. I will stop future use and remove material from channels I control where reasonably possible, although I cannot retrieve copies independently shared by others.

Marketing emails and messages are also optional. You can unsubscribe or email me at any time. Appointment reminders and aftercare are separate service messages. I do not sell your information.

Who helps me look after your information

I use:

• Acuity Scheduling (part of Squarespace) for bookings, consultation forms, appointment records and service communications. Online payments, where enabled, are handled by the payment provider shown at checkout.

• Faces Consent for consultation, consent and client records already held there.

• SumUp for in-person payments.

• Squarespace for the website and enquiry forms.

• Google Workspace for email and administration, and the clinic’s Google Drive for storing clinical photographs and supporting client records.

• Apple iCloud Photos where images taken on my phone are synchronised or backed up.

Providers receive information needed for their services. Some act on my instructions; others, including payment providers, have their own legal responsibilities and privacy notices.

I may also share relevant information with insurers, professional advisers or authorities where necessary for legal obligations or claims. Clinical records are not routinely shared with other practitioners without an appropriate lawful basis.

Storage and security

Appointment details and consultation answers are kept in Acuity Scheduling. Existing records may also remain in Faces Consent. I take clinical photographs on my phone and transfer them to the clinic’s Google Drive, organised by client and treatment date. My photo-storage process includes checking that the originals have transferred correctly before removing unnecessary phone copies. Photos may also sync to iCloud Photos depending on the phone’s settings; I am responsible for managing access and deletion across these locations. Clinical photographs are kept privately as part of your treatment record, with separate permission required for marketing use. No online storage system is completely secure.

Some providers process information outside the UK, including in the United States. Overseas transfers require an applicable UK adequacy arrangement or appropriate safeguards, such as approved contractual clauses with the UK Addendum. Contact me for details or a copy of relevant safeguards.

How long I keep information

• Treatment records and clinical photographs: normally five years after your last treatment. My insurance requires at least five years from treatment; for clients under 18, at least five years after their eighteenth birthday. Records needed for a complaint or claim may be kept longer where justified.

• Financial records: at least five years after the 31 January Self Assessment submission deadline for the relevant tax year, or longer if required.

• Enquiries that do not lead to treatment: normally up to 12 months after resolution.

• Marketing details: until you unsubscribe or they are no longer needed. I may keep a minimal record of an opt-out so I can respect it. Marketing images are reviewed and removed when no longer needed or following withdrawal, subject to the limits above.

Information no longer needed is deleted or anonymised. Provider backups may retain copies until overwritten, without routine use.

Cookies and other websites

Squarespace uses essential cookies for functions such as security and remembering preferences. With your permission, optional analytics cookies help me understand website visits.

Choose Accept all, Decline all or Manage cookies on the banner. You can change your choice using Cookie Preferences. Rejecting optional cookies will not stop you browsing. Browser settings also let you manage cookies, although blocking essential ones can affect the website.

For cookie descriptions and durations, see Squarespace’s guide: https://support.squarespace.com/hc/en-us/articles/360001264507-The-cookies-Squarespace-uses.

The Acuity booking service embedded in this website may also use cookies or similar technologies. Squarespace/Acuity, Faces and other services accessed through links have their own privacy and cookie notices.

Your choices and rights

Depending on the circumstances, you can ask for a copy of your information, corrections, deletion, restrictions on its use or a portable copy. You can withdraw consent at any time.

You can object to uses based on legitimate interests. You can always object to direct marketing, and I will stop using your information for that purpose.

Some rights have limits, for example where records are needed for tax or legal claims. I will explain these if relevant. Email hello@zureskinclinic.com to make a request; I may need to confirm your identity.

Questions or concerns

Please email hello@zureskinclinic.com if you would like to discuss how your information is used. You can also complain directly to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/.

I may update this policy as the clinic or its systems change. The latest version and date will be shown here.