Your data, handled carefully

This policy explains what personal information NAS Beauty by Nadya collects about you, why it is collected, how long it is kept and what rights you have over it. It applies to enquiries, bookings, treatments and anything shared with us online or in clinic.

NAS Beauty by Nadya (trading name of Nadya Al-Dibaj) is the data controller for the information described here.

Clinic address: Soo Yoga, Sol Central, Marefair, Northampton NN1 1SR Phone: 07875 545008 Email: nasbeauty.nadya@gmail.com

For any data protection question — access, correction, deletion or a photo takedown — contact Nadya using the details above and mark your message “Data protection”.

• Name, phone number, email address and date of birth
• Medical and treatment history, including medications, allergies and relevant health conditions
• Consultation notes, consent forms and aftercare records
• Payment information: card payments are taken by Stripe, which processes your card details and returns only a payment reference and outcome to us. We never see or store full card numbers.
• Before-and-after photographs, only where you have given explicit written consent
• Appointment records: bookings, deposits, reschedules, cancellations and attendance
• Messages you send us, and delivery records for booking texts and emails

• Booking, deposits and payment records — necessary for the performance of our contract with you (Article 6(1)(b)).
• Medical history, consultation notes and treatment records — these are special category health data. We rely on your explicit consent (Article 9(2)(a)), alongside Article 6(1)(a), and process them so treatment can be carried out safely.
• Before-and-after photographs and published reviews — your explicit consent (Article 9(2)(a) / Article 6(1)(a)), which you can withdraw at any time.
• Appointment reminders and confirmations by text or email — necessary to deliver the appointment you booked (Article 6(1)(b)).
• Keeping records after treatment, and handling any complaint or insurance matter — our legitimate interests and our legal obligations (Article 6(1)(c) and 6(1)(f)).

• Medical records, consultation notes and consent forms: 8 years from your last appointment (adult clients), in line with standard industry and insurer guidance.
• Appointment and booking records: 7 years, so bookings, deposits and refunds can be reconciled.
• Payment records: 7 years, to meet HMRC and accounting requirements. Card data itself is held by Stripe, not by us.
• Before-and-after photographs: kept until you withdraw consent, and in any case no longer than 8 years from your last appointment.
• Enquiries that do not lead to a booking: 12 months.
• Text and email delivery records: 12 months.

When a retention period ends, records are securely deleted or destroyed.

You have the right to:

• Access — ask for a copy of the personal data we hold about you.
• Correction — have inaccurate or incomplete information put right.
• Deletion — ask us to erase your data, where we are not required to keep it (for example, medical records we must retain for insurance and legal reasons).
• Restriction — ask us to pause processing while a concern is looked into.
• Objection — object to processing we carry out under legitimate interests.
• Withdraw consent at any time — including asking us to take down a published photograph or review. Withdrawing consent does not affect processing carried out before you withdrew it.
• Portability — receive certain data in a portable format.

To exercise any of these, contact Nadya using the details above. We will respond within one month.

If you are unhappy with how your personal data has been handled, please speak to Nadya first so it can be put right.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint, or 0303 123 1113.

We do not sell your data. We share it only with the providers needed to run the clinic:

• Stripe Payments Europe, Ltd. — processes card payments and deposit refunds; receives your name, email and card details entered on their secure payment form.
• Brevo (Sendinblue) — sends booking confirmation and reminder text messages; receives your phone number, name and appointment details.
• Our website and database hosting providers — store booking and client records securely on our behalf under written data processing terms.
• Insurers, legal advisers or regulators — only where we are required to share information, for example to defend or investigate a complaint.

Some of our providers, including Stripe, may process personal data outside the UK and EEA. Where that happens, the transfer is covered by appropriate safeguards — UK adequacy regulations or the International Data Transfer Agreement / standard contractual clauses — so your data keeps the same level of protection as it has in the UK.