Privacy & Cookie Policy

The controller of your personal data is Elite Aesthetics — an aesthetic medicine clinic run by Magdalena Florczak in Bathgate.
Address: 25 North Bridge Street, Bathgate EH48 4PJ, United Kingdom.
Contact: contact@elite-aesthetics.vip, Instagram @mflorczak_eliteaesthetics or Facebook.

The website and booking system are built and technically operated for the studio by Lange Software Solutions (LSS) of Edinburgh (ICO registration: ZC147184) — acting as our processor under a data processing agreement.

There are two places where you may share health information with us: (1) the optional “Complete your profile” survey on your client account, and (2) applying to be a training model. In both we ask about chronic conditions, pregnancy and breastfeeding, medications and allergies, skin type and an emergency contact, and let you attach photos of the treatment area. These are special category data under Article 9 of the UK GDPR and we treat them differently from everything else.

• Why we collect them: solely to judge whether a given treatment is safe for you.
• Lawful basis: your explicit consent (Art. 9(2)(a) UK GDPR), given through its own tick box — never bundled with other consents. Without the tick we store neither the answers nor the photos.
• Who can see them: only Magdalena Florczak, inside the clinic panel. They are never emailed, never shared with trainees, never passed outside the clinic.
• Photos: stored in private storage with no public access. Location data (EXIF) is stripped before upload. Viewing in the panel uses a link valid for a few minutes, after which it expires.
• How long: up to 24 months from our last contact — removed by an automated job that runs weekly. If you withdraw consent they are deleted immediately.
• Withdrawing consent: in your account — untick the health consent (or, as a model, “Withdraw and delete my data”). Health answers and photos are then deleted, no questions asked.

Consent to before/after photography and its publication (e.g. on social media) is separate and entirely optional — declining does not affect your visit or your application.

• When you contact us (Instagram, Facebook, phone, email): your name, contact details and message — provided voluntarily.
• When you book a visit (via the booking system on this site, the LUCY chat assistant, Instagram or by phone): name, phone, email, the treatment, date and time.
• When you chat with the LUCY assistant: the conversation content is processed to answer you and — if you ask — to place a booking. We also store the questions and answers (not linked to your account) to improve the assistant's replies. Please don't type anything into the chat you don't want to share with us.
• Treatment notes: information needed for the safe delivery of a service (e.g. result of a patch test before laser treatment, known contraindications).
• When you create an account and complete your profile: name, email, phone, and optionally date of birth, gender, skin type and an emergency contact. Health data and photos are covered separately in section 2a.
• When you sign in with Google: we receive your email address and name from your Google account to create or link your account. We do not have access to your Google password.
• When you pay a deposit online: the payment is handled by Stripe. We only see the status and amount — we do not collect or store full card details (they go directly to Stripe).
• Cookies and localStorage: essential only — see section 7. The Google map on the homepage only loads with your consent.

• Responding to enquiries and arranging your appointment — legitimate interests and steps prior to a contract (Art. 6(1)(b)/(f) UK GDPR).
• Performing the treatment and invoicing — performance of a contract (Art. 6(1)(b)).
• Keeping accounting and tax records — legal obligation (Art. 6(1)(c), HMRC).
• Recording contraindications for laser / Keratin treatments — legitimate interests in health and safety (Art. 6(1)(f)); for special category data, explicit consent (Art. 9(2)(a)).
• We do not sell your data, do not share it with advertisers, do not profile you.

• Enquiries that did not result in a visit — 12 months.
• Appointment records and invoices — 6 years (HMRC accounting standard).
• Treatment safety notes — for the duration of our relationship + a reasonable period after, where required by treatment safety standards.
• Cookies — consent record up to 12 months from the last update.

• Vercel — website hosting (US/EU, SCCs / UK IDTA in place).
• Supabase — booking database, client accounts and login (servers in the EU, AWS region eu-north-1 / Stockholm).
• Stripe — deposit and Klarna payment processing (Stripe is an independent controller of payment data; full card details are processed by Stripe, not us).
• Google — “Sign in with Google” (we receive your email and name to create/link your account) and the embedded directions map on the homepage (the map loads only with your consent; Google may then set its own cookies — see Google's privacy policy).
• Anthropic — AI assistant “LUCY” in the chat (US, transient processing, your data is not used to train models).
• Resend — transactional email (US, SCCs).

Each provider operates under arrangements that ensure appropriate safeguards (Standard Contractual Clauses or UK IDTA for transfers outside the UK).

You have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased (except for what we must keep for HMRC — 6 years);
• restrict or object to certain processing;
• data portability;
• withdraw consent at any time where we rely on consent.

Send requests to contact@elite-aesthetics.vip or via the studio's Instagram or Facebook. We respond within one month. You also have the right to complain to the UK supervisory authority — Information Commissioner's Office, ico.org.uk.

We set no cookies of our own on the public website. We use:

• Essential cookies — set by the Supabase Auth session when you sign in to an account (client account or the salon panel). Visitors who don't log in never receive them.
• localStorage (browser storage, not a cookie): remembering your cookie choice (up to 12 months) and the position of the LUCY chat window. This data never leaves your browser.
• Third-party cookies — Google Maps: the embedded map can set Google cookies. That's why it only loads once you click “Accept all” in the banner or “Show map” on the map itself. Without consent the map doesn't load and no Google cookies are set.
• Third-party cookies — Stripe: when you pay a deposit online, Stripe may set its own essential cookies to secure the transaction and prevent fraud. This applies only at the moment of payment.
• Analytics and marketing: we don't use any. If we ever want to, we'll ask for consent via the banner first.

You can change your choice by clearing this site's data in your browser — the banner will appear again on your next visit.

If we update this policy, we will refresh the date at the top. Material changes will be announced on the homepage and — if you have an upcoming booking with us — also by email.