Privacy Policy

Last updated: 1 September 2026

Who we are

Bodiology Sussex ("Bodiology", "we", "us") is an aesthetics clinic run by Darice, offering facials, advanced aesthetics, massages, body contouring treatments, and beauty and aesthetics training courses through the Bodiology Collective Training Academy. Our registered or trading address is [Bodiology Sussex address]. We are the data controller for the personal data described in this policy. If you have any questions, contact us at hello@bodiologysussex.co.uk.

The data we collect

We may collect and process the following:

• Contact details you give us, such as your name, email address and phone number, when you book a consultation or treatment, sign up for updates, or get in touch

• Booking details, including appointment times, treatments booked, and any notes taken during a consultation

• Health and treatment information you share with us before or during a consultation, such as skin history, allergies, medications, and relevant medical conditions, where this is needed to carry out a treatment safely

• Purchase details when you buy a course or product through our shop, including billing information. Card and payment details themselves are handled directly by our payment providers, not stored by us

• Technical data collected automatically when you visit our website, such as browser type, device type, general location and pages visited

Health and treatment information

Some of the information we collect to carry out treatments safely counts as special category data under UK GDPR, such as details of allergies, skin conditions or relevant medical history. We only collect this with your explicit consent, given at the time of your consultation or booking, and we only use it to assess your suitability for a treatment and to carry it out safely. We do not use this information for marketing, and we do not share it beyond what is needed to deliver your treatment.

How we use your data

We use your data to:

• Book, manage and remind you about appointments

• Assess your suitability for treatments and carry them out safely

• Process purchases made through our shop

• Send you marketing about our treatments, courses and offers, where you have agreed to receive it

• Improve our website and understand how it is used

• Meet our legal, tax and accounting obligations

Our lawful basis

We rely on the following lawful bases under UK GDPR:

• Explicit consent, for health and treatment information, and for marketing emails and non essential cookies

• Contract, to book and deliver the treatments or courses you have asked us for

• Legitimate interests, to respond to enquiries, improve our website and safeguard our business

• Legal obligation, to meet tax, accounting and regulatory requirements

Cookies

Our website uses cookies to help it run and to understand how visitors use it. See our Cookie Policy for full details.

Sharing your data

We do not sell your personal data. We may share it with:

• Koprio, our marketing agency, who manage our website, email marketing and social media on our behalf

• Fresha, our booking platform, to manage appointments

• Stripe, Klarna and Clearpay, to process payments and, where you choose a pay later option, to carry out the necessary credit checks

• Framer, who host our website

• Professional advisers such as our accountant, where needed

• Authorities, where we are required to by law

Any third party we work with is required to keep your data secure and only use it for the purposes we specify. Koprio only uses your data to carry out marketing on our behalf, and does not use it for their own purposes or share it with their other clients.

International transfers

Some of the tools we use, such as Framer, Fresha, Stripe and our payment providers, may store or process data outside the UK. Where this happens, we make sure appropriate safeguards are in place, such as standard contractual clauses, to keep your data protected to UK standards.

How long we keep your data

We keep personal data only as long as needed for the purpose it was collected, or as required by law. Health and treatment records are usually kept for as long as you remain a client and for a reasonable period afterwards, in case you return for further treatment. Financial records are kept for at least six years to meet HMRC requirements.

Keeping your data secure

We use appropriate technical and organisational measures to protect your data against loss, misuse or unauthorised access, including keeping client records and booking systems access controlled to those who need it.

Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you

• Ask us to correct inaccurate data

• Ask us to delete your data

• Object to or restrict certain processing

• Ask for your data to be moved to another provider

• Withdraw consent at any time, including consent given for health and treatment information or marketing

To exercise any of these rights, contact us at hello@bodiologysussex.co.uk. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.