Privacy Policy

Lana Beauty & Aesthetics is a beauty, aesthetics and laser clinic in Cardiff. For anything in this policy, you can contact us at bookings@lanaaesthetics.com or by phone on 07824 357953. We are the data controller for the information described below.

We collect only what we need to treat you safely and run your bookings:

• Contact details — your name, email address and phone number, when you book online, create an account, or the clinic sets one up for you.
• Your online account — if you have one, your email and a password. Your password is stored only in scrambled (hashed) form: nobody at the clinic can see it, and we will never ask you for it.
• Bookings — the date, time and treatments you book, and anything you choose to tell us in the booking notes.
• Messages — what you write to us through the contact form, with your name, email and (if you give it) phone number, so we can reply.
• Treatment approvals — after a consultation, which treatments you have been approved for and until when, so you can book them online. The website holds only that approval, never your clinical notes.
• Health & physical information — details about your skin, relevant medical history and patch test results, gathered at your consultation to make sure every treatment is safe and appropriate for you. These are kept in the clinic’s own clinical records, not on this website.
• Payments — the amount, date, what it was for, and Worldpay’s reference. We never receive your card details (see section 4).

• To provide your bookings and treatments — to schedule your appointments with the right practitioner (Lana for beauty and aesthetics, Han for laser), show you your bookings when you sign in, and let you book treatments you have been approved for. This is necessary to provide the service you ask us for.
• To take and record payments — what you pay when you book, and any payment you agree with us in clinic, and to email you booking confirmations, payment requests and receipts. We also keep payment records because tax law requires it.
• To keep your account secure — emails to confirm your address and to reset your password, and a record of account and payment actions so we can investigate problems. This is in our legitimate interest in keeping your information safe.
• Health information is special category data. We use it only to provide safe treatment, and only with the consent you give at your consultation.

We do not use your details for marketing without your explicit consent. The clinic team contacts you directly to confirm appointments.

• We never sell your data. We do not sell, rent or trade your personal or health information to anyone — full stop.
• Worldpay (payments). You pay on Worldpay’s own secure page. Your card details are never entered on, or stored by, our website or administrative systems; Worldpay handles them in line with the Payment Card Industry Data Security Standard (PCI DSS).
• We use a small number of service providers who process data only on our instructions: Supabase (our database and image storage, hosted in the EU — Ireland), Vercel (website hosting), Resend (delivering our emails) and Cloudflare (our domain and email forwarding).
• Inside the clinic, your details are visible only to our staff (Lana and Han), through a secured admin system with individual logins.

Payment and booking records are kept for six years after the end of the relevant tax year, as UK tax law requires.

Your online account is kept while you use it. If you ask us to close it, we remove your name and contact details from your account, bookings and payment records, keeping only what the law requires us to keep (such as amounts and dates).

Messages sent through the contact form are kept for twelve months, then deleted.

Treatment approvals stop working on the date shown in your account, and are then kept only as long as the rest of your booking history.

Consultation and treatment records held in the clinic’s clinical records are kept after your last visit, as insurers and professional guidance require, and no longer than necessary.

All records are held in access-controlled systems, protected by individual logins and encryption in transit. Staff access depends on their role, and account and payment actions are logged.

Under UK data protection law (UK GDPR), you have the right to:

• get a copy of the information we hold about you — if you have an account, you can download it yourself from your account page;
• ask us to correct anything inaccurate;
• ask us to delete your information (subject to the retention obligations described in section 5);
• object to or restrict how we use your information;
• withdraw any consent you have given, at any time;
• complain to the Information Commissioner’s Office (ICO) at ico.org.uk if you believe we have mishandled your data.

To exercise any of these rights, email bookings@lanaaesthetics.com. We respond to all requests within one month.

We use only what the website needs to work: a cookie that keeps you signed in to your account, and your browser’s own storage to remember your booking basket. We do not use advertising or analytics cookies, so there is nothing to opt out of.

Our appointment, cancellation and payment policies are set out in our Terms & Conditions.