Privacy policy
Last updated 16 August 2026. The Skin Bros Ltd.
Draft. This page is accurate to how we work but has not yet been reviewed by a solicitor. It will be before the site goes live.
This policy explains what The Skin Bros Ltd does with personal data, why, and what you can ask us to do about it. It covers this website and the clinic.
Who we are
The Skin Bros Ltd, trading as SkinBros, 5 Goodge Place, London W1T 4SD. We are the data controller for the personal data described here. For anything about your data, email privacy@theskinbros.com.
What we collect, and why
When you book
Your name, mobile number and email address, the treatment you have booked and the time of your appointment. We need this to give you the appointment, to send you a confirmation and a reminder, and to let you move or cancel it. The lawful basis is performance of a contract with you.
When you come in
Your medical history, medication, allergies, what a doctor assesses and what is done, plus any clinical photographs. This is special category health data and it is held in our clinical system, not on this website. The lawful basis is Article 6(1)(b) and Article 9(2)(h) of the UK GDPR: the provision of health care and treatment by a professional under a duty of confidentiality.
Clinical photographs are never used for marketing unless you have signed a separate, specific consent form for that exact use, and you can withdraw that consent at any time.
When you use this website
- Advertising identifiers. If you arrive from an advert, the click identifier and any campaign tags in the address are stored in a first-party cookie on this domain so we can tell which of our own adverts brought you here. This is our own operational data about our own advertising and the lawful basis is our legitimate interest in knowing what our advertising costs us. It is not shared with anyone unless you accept advertising cookies.
- Analytics and advertising cookies. Google Analytics, the Google Ads tag and the Meta pixel load only if you accept them. Nothing third-party loads before that. The lawful basis is consent, and you can change your mind at any time from the cookie link in the footer.
- Forms. If you join a waitlist or email us, we keep what you send us in order to reply.
Please do not send medical details or photographs of yourself through a web form or by email. That information belongs on your clinical record.
Who else sees it
- Phorest. Our clinical and booking system. Your appointment and your clinical record are held there. Phorest acts as our processor under a written agreement.
- Payment processing. When you pay, the card details go to our payment provider, not to us. We never see or store a full card number.
- Google and Meta. Only if you accept advertising or analytics cookies, and only in the form those tags collect.
- Our hosting and email providers, in the ordinary course of running the site and sending your confirmation.
- Anyone we are legally required to tell, which is rare and which we would tell you about unless the law prevents it.
We do not sell personal data, and we never will.
Where it is held
Mostly in the UK and the European Economic Area. Where a provider transfers data outside them, it is done under the UK International Data Transfer Agreement or an adequacy decision.
How long we keep it
- Clinical records: for as long as professional guidance requires us to, which for an adult private patient is a number of years after the last appointment.
- Booking and contact details: for as long as you are a patient, and then in line with the clinical record.
- Marketing consent and waitlist emails: until you unsubscribe or ask us to remove you.
- Website analytics: up to 14 months.
- Advertising identifiers: up to 90 days.
Your rights
You can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to processing based on legitimate interests, and ask for it in a portable form. Withdrawing consent stops the thing you consented to but does not undo what was lawful before you withdrew it. Email privacy@theskinbros.com and we will respond within a month.
Some of these rights work differently for clinical records, because there are professional and legal reasons we have to keep them. We will explain if that applies to your request.
If you are not happy with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk, or call them on 0303 123 1113. We would rather you told us first so we can put it right.
Security
Access to the clinical system is restricted to the people who need it, protected by individual accounts, and logged. This website holds no clinical data at all.
Changes
If we change this policy we will change the date at the top. If the change is significant we will say so on the site.