Privacy Policy

1. Who We Are

Eve Electrolysis is a specialist permanent hair removal clinic based in London, United Kingdom. We are the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Eve Electrolysis is a trading name of Eve Electrolysis Limited, a company registered in England and Wales (company number 17276790), registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ. We are registered with the Information Commissioner’s Office (ICO reference ZC256551). To contact us about your data: 07309 050334

2. Data We Collect

We collect and process the following categories of personal data:

• Identity data: name, preferred pronouns, date of birth where required for medical assessment
• Contact data: email address, telephone number
• Health data: medical history, contraindications, skin and hair assessment notes (Special Category data under UK GDPR)
• Appointment data: booking history, treatment records, consultation notes
• Technical data: IP address, browser type, pages visited (via cookies, with your consent)
• Communications data: records of emails or messages you send us

3. How We Use Your Data

• To provide and manage your electrolysis treatments and appointments
• To maintain your clinical records as required by professional practice standards
• To contact you about your appointments, aftercare, and follow-up
• To comply with our legal and professional obligations
• To improve our website and services (with your consent, via cookies)

4. Legal Basis for Processing

We process your data on the following legal bases:

• Contract: to provide the services you have booked
• Legal obligation: to maintain clinical records and comply with professional standards
• Legitimate interests: to manage our business and communicate with clients
• Explicit consent: for processing Special Category health data and for non-essential cookies

5. Special Category Data (Health Information)

Your health and medical information is Special Category data under UK GDPR. We process this only with your explicit consent and solely for the purpose of providing safe and appropriate treatment. This data is held securely and is never shared with third parties without your consent, except where required by law.

6. Data Sharing

We do not sell your personal data. We may share your data with:

• WhatsApp (Meta Platforms), when you contact us to arrange an appointment
• Your GP or relevant healthcare provider, only with your explicit consent
• Regulatory or legal authorities where required by law
• Our professional indemnity insurer, where relevant to a clinical matter
• Fresha, our booking and client-records platform, which securely stores your appointment, consultation and treatment records
• JotForm, which we use to collect your online consultation and consent form

Some of these providers process data outside the UK; in particular, JotForm and WhatsApp (Meta Platforms) are based in the United States. Where your personal data is transferred internationally, we ensure it is protected by appropriate safeguards as required by UK GDPR, such as Standard Contractual Clauses or an equivalent adequacy mechanism.

7. Data Retention

We retain client records for a minimum of 7 years following your last appointment, in accordance with professional standards. Contact and booking data is retained for 3 years. You may request deletion of non-clinical data at any time, subject to our legal obligations.

8. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Request erasure of your data (subject to legal obligations)
• Restrict or object to processing
• Data portability
• Withdraw consent at any time (without affecting prior processing)
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, contact us at 07309 050334. We will respond without undue delay, and normally within one calendar month.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. All staff with access to client data are bound by confidentiality obligations.

10. Changes to This Policy

We may update this policy from time to time. The current version will always be available on this page. Significant changes will be communicated to active clients by email.

11. Contact

For any questions about this policy or your data: 07309 050334