Privacy Policy

Effective Date: 08/08/2025
Last Updated: 30/05/2026

Vision by H Studio (“we”, “our”, “us”) is committed to protecting your privacy and handling your personal information safely, lawfully, and transparently.

This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website, book an appointment, complete a consultation form, receive a treatment, contact us, or interact with us online.

Vision by H Studio operates from:

Vision by H Studio
104 Harley Street
London
W1G 7JD
United Kingdom

Email: admin@visionbyh.studio

We are registered with the Information Commissioner’s Office (ICO).
ICO Registration Number: [Insert ICO registration number]

This policy has been prepared in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), and other applicable UK data protection laws.

---

Vision by H Studio provides beauty, aesthetic, semi-permanent makeup, micropigmentation, microblading, lip blush, eyeliner, ombré brows, and scalp micropigmentation services.

For the purpose of UK data protection law, Vision by H Studio is the “data controller” of the personal information we collect and process. This means we decide how and why your personal data is used.

---

We may collect and process the following types of personal data:

• Full name
• Date of birth
• Address
• Email address
• Phone number
• Emergency contact details, where relevant

• Appointment dates and times
• Treatment history
• Booking preferences
• Cancellation or rescheduling history
• Deposits and payment status

Because our services may involve skin, pigment, needles, aftercare, and suitability checks, we may collect information such as:

• Medical history
• Allergies
• Skin conditions
• Medication information
• Pregnancy or breastfeeding status, where relevant to treatment safety
• Previous cosmetic or aesthetic treatments
• Contraindications
• Patch test results
• Treatment notes
• Consent forms
• Before and after treatment records

Some of this information may be classed as special category data, particularly health-related information. We only collect this where necessary to assess treatment suitability, provide safe services, comply with legal or insurance requirements, and protect your health and wellbeing.

• Payment amount
• Payment method
• Transaction date
• Deposit information
• Refund or cancellation records

We do not normally store full card details. Card payments are processed securely by third-party payment providers.

When you use our website, we may collect:

• IP address
• Browser type
• Device type
• Pages visited
• Time spent on the website
• Referring website
• Cookie and tracking data

Where applicable, we may collect:

• Email marketing preferences
• Consent to receive promotional messages
• Interaction with adverts
• Website behaviour through advertising pixels
• Social media engagement data

We may take before and after photos or videos for treatment records, insurance, training, or marketing purposes.

We will only use identifiable images or videos for marketing, website content, social media, or advertising where you have given clear consent. You can withdraw this consent at any time.

---

We may collect your personal data when you:

• Book an appointment online, by phone, by email, or through a booking platform
• Complete a consultation form
• Complete a consent form
• Attend a treatment
• Make a payment
• Contact us by email, phone, website form, WhatsApp, SMS, or social media
• Subscribe to marketing communications
• Visit or interact with our website
• Interact with our adverts on platforms such as Google, Instagram, or Facebook

---

We use your personal data for the following purposes:

We use your information to manage bookings, carry out consultations, assess treatment suitability, provide treatments, give aftercare advice, manage payments, and maintain client records.

Lawful basis: Contract and legitimate interests.

We use consultation forms, medical information, allergy details, patch test results, and treatment records to ensure treatments are suitable and safe.

Lawful basis: Legal obligation, legitimate interests, and explicit consent where required for special category data.

We may keep records to comply with tax, accounting, insurance, health and safety, legal, or regulatory obligations.

Lawful basis: Legal obligation and legitimate interests.

We process payment details, deposits, invoices, and transaction records for accounting, tax, and business administration purposes.

Lawful basis: Contract and legal obligation.

We may contact you about appointments, reminders, aftercare, treatment follow-ups, policy updates, cancellations, or important service information.

Lawful basis: Contract and legitimate interests.

Where permitted, we may send you offers, updates, promotions, or information about our services. You can unsubscribe or withdraw consent at any time.

Lawful basis: Consent or legitimate interests, depending on the communication method and your relationship with us.

We may use analytics data to understand how people use our website, improve user experience, monitor performance, and develop our services.

Lawful basis: Legitimate interests and consent where required for non-essential cookies.

We may use tools such as Google Ads, Meta Ads, Facebook Pixel, Instagram advertising, or similar platforms to measure ad performance and deliver relevant adverts.

Lawful basis: Consent where required, particularly for tracking cookies and pixels.

---

Some information we collect, such as health information, allergies, medication details, skin conditions, and patch test results, may be classed as special category data under UK GDPR.

We process this information only where necessary and with appropriate safeguards. This may include:

• Assessing whether a treatment is safe and suitable for you
• Recording your consent
• Keeping accurate treatment records
• Meeting insurance requirements
• Responding to legal claims or complaints
• Protecting your health and safety

We do not use special category data for marketing purposes.

---

Our website may use cookies and similar technologies.

Cookies may be used for:

These are required for the website to function properly and cannot usually be disabled.

These help us understand how visitors use our website, such as which pages are visited and how long users spend on the site.

These may be used to show relevant adverts, measure advertising performance, and support retargeting campaigns through platforms such as Google Ads and Meta Ads.

Where required by law, non-essential cookies will only be used with your consent. You can manage or withdraw cookie consent through our cookie banner or your browser settings.

---

We only share personal data where necessary, lawful, and proportionate.

We may share your data with:

• Booking systems, such as Setmore or any replacement booking provider
• Payment providers, such as Stripe, PayPal, card processors, or banks
• Email and communication providers, such as Gmail, Mailchimp, SMS, or WhatsApp Business tools
• Website hosting and website management providers
• Analytics providers, such as Google Analytics
• Advertising platforms, such as Google Ads and Meta Ads
• Professional advisers, such as accountants, legal advisers, insurers, or business consultants
• IT and cybersecurity support providers
• Regulators, authorities, courts, HMRC, or law enforcement where legally required

Where third parties process personal data on our behalf, we require them to handle it securely and only in accordance with our instructions and applicable data protection laws.

We do not sell your personal data.

---

Some service providers we use may process or store data outside the United Kingdom.

Where personal data is transferred internationally, we will take steps to ensure appropriate safeguards are in place. This may include using providers covered by UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or other lawful transfer mechanisms.

---

We only keep personal data for as long as necessary for the purpose it was collected, including legal, insurance, accounting, and regulatory requirements.

Typical retention periods include:

• Consultation forms, consent forms, treatment records, medical notes, and patch test records: usually up to 6 years after your last appointment, or longer where required for insurance, legal claims, safeguarding, or regulatory purposes.
• Booking records and appointment history: up to 6 years.
• Payment, invoice, accounting, and tax records: usually 6 years, or as required by HMRC and accounting rules.
• Marketing data: until you unsubscribe, withdraw consent, or we no longer need the data for marketing purposes.
• Website analytics data: retained according to the relevant analytics and cookie settings.
• Photos and videos for marketing: until you withdraw consent or until the content is no longer required.
• Complaint or dispute records: for as long as necessary to handle the matter and protect our legal position.

When data is no longer needed, we will securely delete, anonymise, or archive it.

---

We take appropriate technical and organisational measures to protect personal data from unauthorised access, loss, misuse, alteration, or disclosure.

These measures may include:

• Password-protected systems
• Secure booking and payment platforms
• Limited access to client records
• Confidential treatment records
• Secure storage of consultation and consent forms
• Secure email and communication practices
• Regular review of data handling procedures
• Use of reputable third-party service providers

However, no system can be guaranteed to be completely secure. If we become aware of a data breach that may affect your rights or freedoms, we will take appropriate action and notify the ICO and affected individuals where legally required.

---

Under UK GDPR, you have rights over your personal data. These may include:

• The right to access the personal data we hold about you
• The right to correct inaccurate or incomplete data
• The right to request deletion of your data
• The right to restrict how we process your data
• The right to object to certain processing
• The right to data portability
• The right to withdraw consent where processing is based on consent
• The right to object to direct marketing at any time
• The right to lodge a complaint with the Information Commissioner’s Office

Some rights may be limited where we need to keep certain information for legal, insurance, tax, or regulatory reasons.

To exercise your rights, contact us at:

admin@visionbyh.studio

We may need to verify your identity before responding to a request.

---

We may send you marketing communications where you have consented or where we are legally allowed to do so.

You can opt out at any time by:

• Clicking “unsubscribe” in our emails
• Contacting us at admin@visionbyh.studio
• Adjusting your preferences where available

We will not send you marketing messages if you have opted out.

---

Before and after photos may be taken as part of your treatment record.

We may use images for internal records, training, insurance, or treatment monitoring where appropriate.

We will only use identifiable photos or videos for marketing, advertising, website content, portfolio use, or social media where you have given clear consent.

You can withdraw consent for future use at any time by contacting us. Please note that if content has already been published, we will take reasonable steps to remove it from platforms we control, but we may not be able to remove copies that have already been shared, saved, or reposted by others.

---

Our treatments are intended for adults. We do not knowingly collect personal data from children for marketing purposes.

Where services are requested for a person under 18, we may require consent from a parent or legal guardian and may collect limited information necessary to assess suitability and provide safe services.

---

Our website may contain links to third-party websites, booking platforms, payment providers, social media pages, or external services.

We are not responsible for the privacy practices, content, or security of third-party websites. You should read their privacy policies before providing any personal information.

---

If you have concerns about how we handle your personal data, please contact us first so we can try to resolve the issue.

Email: admin@visionbyh.studio
Address: Vision by H Studio, 104 Harley Street, London W1G 7JD

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom

Website: ico.org.uk

---

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, technology, or business operations.

The latest version will always be available on our website. The “Last Updated” date at the top of this policy will show when it was most recently changed.