PRIVI Studios - Privacy Policy
Last updated:
PRIVI Studios (“PRIVI”, “we”, “us”) operates privistudios.com, privi.skin and the PRIVI Studios clinic, including our skin assessment, bespoke skincare subscription, and in-clinic aesthetic services (the “Services”). This Privacy Policy explains how we collect, use, and share your personal information - including health information you give us as part of your skin assessment or any consultation - when you use the Services.
Please read this carefully, particularly the section on health information, since it’s treated differently from ordinary account or order data.
We are PRIVI Studios, company number 13477653, of 350 Lea Bridge Road, London, E10 7LD. For the purposes of UK data protection law, we are the data controller of your personal information.
Personal information we collect
Contact and account details - your name, address, phone number, email address, username and password.
Payment information - handled directly by our payment processors (see ‘Who we share your information with’ below); we do not store full card details ourselves.
Order and subscription information - what you’ve purchased or subscribed to, delivery details, and your subscription and billing history.
Health and skin information - collected through our online skin assessment and any consultation, including your skin concerns, skin type, medical history, current medications and treatments, allergies, pregnancy or breastfeeding status where relevant, and lifestyle factors (such as sun exposure, sunbed use, alcohol, and diet) that may affect your skin or treatment. This is ‘special category data’ under UK data protection law and is treated with extra care, as set out in the dedicated section below.
Communications - anything you tell us directly, including customer support enquiries and messages to our dermatology/prescribing team.
Device and usage information - information about your device, browser, IP address, and how you interact with our website.
Where we get your information
Directly from you - when you create an account, complete the skin assessment, book or attend a consultation, place an order, or contact us.
Automatically - through your use of our website, including cookies and similar technologies.
From our service providers - including our payment processors, when they process a transaction on our behalf.
How we use your information
To provide the Services - to process your orders and subscription payments, arrange delivery, manage your account, and provide customer support. Legal basis: performance of our contract with you.
To assess and prescribe your treatment - to review your skin assessment, carry out any consultation, and determine and prepare your personalised formulation. Legal basis: see ‘Special category (health) data’ below.
Marketing - to send you marketing or promotional communications, where you’ve agreed to receive them. You can opt out at any time. Legal basis: consent.
Security and fraud prevention - to authenticate your account and protect against fraudulent or unauthorised use. Legal basis: legitimate interests.
Legal reasons - to comply with the law, respond to valid legal requests, or enforce our terms. Legal basis: legal obligation / legitimate interests.
Who we share your information with
We share personal information only where needed to run the Services:
Payment processors - myPOS processes your payment details directly, for both one-off and subscription payments; we do not store your full card number.
Our website platform - our website and subscription system run on WordPress and WooCommerce, which support the technical operation of the Services.
Delivery partners - to get your order to you.
Legal and safety reasons - where required by law, or to protect the rights, property, or safety of PRIVI, our customers, or others.
We do not sell your personal information, and we do not share your health or skin assessment information with any third party for marketing purposes.
Special category (health) data
The information you give us in your skin assessment and any consultation - including your medical history, medications, allergies, and skin condition - is ‘special category data’ under UK GDPR, and we handle it with additional care:
Legal basis. We process this information on the basis of your explicit consent, given when you submit your skin assessment, and because it is necessary for the provision of health care by, or under the responsibility of, a registered healthcare professional.
Who sees it. Your health information is reviewed by our prescriber as part of assessing and prescribing your treatment, and is not used for any other purpose, including marketing.
Retention. We retain your health information for as long as needed to provide your ongoing care and as required by our professional and legal record-keeping obligations, after which it is securely deleted.
Withdrawing consent. You can withdraw your consent to us processing your health information at any time by contacting us, though this may mean we can no longer provide your treatment or subscription.
Security and retention
We take appropriate technical and organisational measures to protect your personal information, but no system is completely secure, and we cannot guarantee perfect security.
How long we keep your information depends on why we hold it: ordinary account and order information is kept for as long as your account is active and as needed to meet our legal and accounting obligations; health information is kept as set out above.
Your rights and choices
Under UK data protection law, you have the right to:
- Access the personal information we hold about you.
- Correct inaccurate information.
- Delete information we hold about you, subject to our legal and professional record-keeping obligations.
- Restrict or object to our processing of your information in certain circumstances.
- Withdraw consent, where we rely on it - including for your health information (see above) and for marketing.
- Receive a copy of your information in a portable format, in certain circumstances.
To exercise any of these rights, contact us using the details below. We may need to verify your identity first. If you’re unhappy with how we’ve handled your request, you have the right to complain to the UK Information Commissioner’s Office (ico.org.uk).
Children’s data
Our Services are for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with their information, please contact us and we will delete it.
International transfers
Some of our service providers, including our payment processors, may process information outside the UK. Where this happens, we rely on legally recognised safeguards, such as the UK’s International Data Transfer Agreement or an adequacy decision, to protect your information.
Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or regulatory reasons. We’ll post the updated policy here and update the ‘Last updated’ date above.
Contact and complaints
If you have questions about this Privacy Policy, or want to exercise any of your rights, please contact us:
- Email: info@privistudios.com
- Post: 350 Lea Bridge Road, London, E10 7LD
If you’re unhappy with how we’ve handled your personal information, you can also complain to the UK Information Commissioner’s Office at ico.org.uk.