Last updated: 31 October 2026
1. Who we are
Vision by H is a trading name of Vision by H Limited, a company registered in England and Wales (company number 16497587), with its registered office at 167-169 Great Portland Street, London, England, W1W 5PF. We provide semi-permanent make-up treatments at 104 Harley Street, London W1G 7JD.
We are the data controller for the personal information described in this policy, and we are registered with the Information Commissioner’s Office (ICO) under registration number ZC003119.
If you have any questions about this policy or your personal information, contact us at admin@visionbyh.studio or on 075 0200 2009.
2. The information we collect
- Enquiries: your name, email address, phone number, the treatment you’re interested in, your message, and any photos or files you choose to upload through our website form.
- Bookings: your name, contact details, appointment details and booking history.
- Consultations and treatments: information about your health that is relevant to your treatment (for example skin conditions, allergies, medication, pregnancy, and medical history), your patch test results, signed consent forms, treatment notes, and the pigments and techniques used.
- Photographs: before, during and after photos of the treated area, taken as part of your treatment record.
- Payments: deposit and payment records. Card details are handled directly by our payment provider; we never see or store your full card number.
- Communications: messages you send us by email, phone, WhatsApp or social media.
- Website use: information collected through cookies and similar technologies, such as your device, browser, pages visited and how you arrived at our site, as explained in section 11.
3. How we use your information and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Responding to your enquiry and arranging your consultation | Steps taken at your request before entering into a contract, and our legitimate interest in responding to enquiries |
| Taking and managing your booking and deposit | Performance of a contract |
| Assessing your suitability and carrying out your treatment safely | Performance of a contract and, for health information, your explicit consent (see section 4) |
| Keeping treatment records and photos | Legal obligation and our legitimate interest in providing safe treatment and defending legal claims |
| Using photos of your results in our marketing | Your consent, given separately and in writing |
| Sending you offers and news by email or message | Your consent, which you can withdraw at any time |
| Measuring and improving our website and advertising | Your consent, given through our cookie banner |
| Protecting our website from spam and abuse | Our legitimate interest in keeping our website secure |
| Meeting tax, accounting and other legal requirements | Legal obligation |
4. Health information
Information about your health is “special category data” under UK GDPR, and we treat it with extra care. We collect it only so we can assess whether a treatment is safe and suitable for you, and we process it with your explicit consent, which you give on your consultation and consent forms. If you do not give this information, we may not be able to treat you.
5. Photographs
Before and after photos form part of your treatment record. We will only use a photo of you on our website, social media or in advertising if you have given separate written consent. You can withdraw that consent at any time; we will then stop using the photo in any new material and remove it from our website and social media channels.
6. Who we share your information with
We never sell your personal information. We share it only with trusted service providers who process it on our behalf and under contract with us:
- Website hosting: WordPress.com (Automattic)
- Online booking and deposits: Setmore and its payment processor
- Email: [email provider, e.g. Google Workspace or Microsoft 365]
- Messaging: WhatsApp (Meta), if you choose to contact us that way
- Website analytics, advertising and spam protection: Google (Google Analytics, Google Ads and reCAPTCHA)
- Professional advisers: our accountants, insurers and legal advisers, where necessary
We may also share information where the law requires it, for example with HMRC or the police, or to establish or defend a legal claim.
7. International transfers
Some of our service providers are based in, or store data in, the United States. Where your information is transferred outside the UK, we rely on adequate safeguards approved under UK law, such as the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Agreement.
8. How long we keep your information
| Information | How long we keep it |
|---|---|
| Enquiries that don’t lead to a booking | 12 months from your last contact |
| Consultation forms, health information, consent forms, treatment notes and treatment photos | 7 years after your last treatment, to meet insurance and legal requirements |
| Payment and accounting records | 6 years after the end of the financial year they relate to |
| Marketing consents | Until you withdraw your consent |
| Photos used in marketing | Until you withdraw your consent |
After these periods, we securely delete or anonymise your information.
9. How we protect your information
We use appropriate technical and organisational measures to protect your information, including password-protected and access-restricted systems, secure booking and payment providers, and secure storage of paper records. Only the people who need your information to provide your treatment can access it.
10. Your rights
Under UK data protection law you have the right to:
- access the personal information we hold about you;
- ask us to correct information that is inaccurate or incomplete;
- ask us to delete your information, where there is no legal reason for us to keep it;
- ask us to restrict how we use your information;
- object to us using your information on the basis of our legitimate interests, and object at any time to direct marketing;
- receive your information in a portable format;
- withdraw your consent at any time, without affecting anything we did before you withdrew it.
To use any of these rights, contact us at booking@visionbyh.studio. We will respond within one month, and there is usually no charge.
11. Cookies
Our website uses cookies and similar technologies. Essential cookies make the website work and do not need your consent. With your consent, we also use:
- Analytics cookies (Google Analytics), to understand how visitors use our website;
- Advertising cookies (Google Ads), to measure how our adverts perform and show them to people who may be interested.
Our website forms are protected by Google reCAPTCHA, which collects information about your device and use of the page to check that you are not a bot; Google’s Privacy Policy and Terms of Service apply.
You can accept or reject non-essential cookies through the banner when you first visit our site, and change your choice at any time through the cookie settings link at the bottom of every page.
12. Children
We do not provide treatments to anyone under 18, and we do not knowingly collect personal information from children.
13. Complaints
If you are unhappy with how we have handled your personal information, please contact us first at booking@visionbyh.studio and we will do our best to resolve it. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, or 0303 123 1113.
14. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top.