Privacy Notice

Who We Are

Glow By Rica is a nurse-led aesthetic clinic based at Suite 115, Phenix Salon, Springwell Square, Derby, DE1 1FB. We offer anti-wrinkle treatments, dermal fillers and skincare treatments.

For the purposes of UK data protection law, Glow By Rica is the "data controller" for the information described below. Treatments are carried out by an NMC-registered nurse, who is bound by a professional duty of confidentiality.

Questions, or to exercise any of your rights: rica@glowbyrica.com

ICO registration: not currently registered. An ICO assessment will be completed when Glow By Rica starts trading.

Information We Collect

If you contact us through this website, we collect the name, email address, phone number, treatment of interest, preferred date and time, and the message you send.

If you book or attend an appointment, we additionally hold:

• Appointment details — treatment, date, time and price
• Your medical history questionnaire, including information about pregnancy, allergies, medication, illnesses, previous treatments and reactions
• Signed consent forms for the treatment you receive, including your date of birth and contact details, your goals and expectations, and your signature
• Treatment records, including the areas treated, the product and amounts used, and clinical notes
• Before and after photographs, where you have agreed to these being taken

Information about your health, and clinical photographs of you, are "special category" data under UK GDPR. We treat them with the additional care that status requires.

Why We Use It, and Our Lawful Basis

• Responding to enquiries and arranging appointments — because it is necessary to take steps at your request before entering into a contract, and for our legitimate interest in running the clinic.
• Assessing your suitability for treatment, treating you safely, and keeping clinical records — because this is necessary for the provision of health care and treatment by a health professional under a duty of confidentiality (UK GDPR Article 9(2)(h)), and to meet our professional and insurance obligations.
• Clinical photographs kept as part of your record — on the same health care basis above.
• Using photographs for training, promotion, our portfolio or website — only where you have given explicit, separate consent on your consent form. You can withdraw that consent at any time by emailing us, and we will stop using the images going forward.

We do not sell your data, and we do not use it for marketing without your explicit consent.

Who Can See It

Your clinical records are accessible only to the practitioner, through a password-protected account secured with two-factor authentication. They are not published, shared or visible anywhere on this website.

We use the following service providers, who process data on our behalf under contract:

• Supabase — securely stores appointment records, consent forms, medical histories and photographs
• Formspree — delivers website contact form submissions to our email
• Vercel — hosts this website and may collect basic server logs including IP addresses
• ImprovMX and Google — deliver and store our clinic email
• Google Fonts — loads fonts for this website; Google may log your IP address. No cookies are set.

We may also share information where we are required to by law, or with your insurer or another healthcare professional where necessary for your care and with your knowledge.

Some of these providers may store or process data outside the UK. Where that happens, the transfer is covered by appropriate safeguards such as the UK International Data Transfer Agreement or Addendum.

How Long We Keep It

Website enquiries that do not lead to an appointment are kept for up to 12 months.

Clinical records - consent forms, medical histories, treatment records and clinical photographs - are kept for 8 years after your last treatment, in line with professional guidance and our insurance requirements. We treat adults aged 18 and over only.

When a retention period ends, records are securely deleted.

How We Protect It

• All data is encrypted in transit and at rest
• Access is restricted to the practitioner's individual account, protected by two-factor authentication
• Photographs are held in private storage and are never accessible from a public web address
• Access rules are enforced at database level, so records cannot be read by anyone who is not signed in as an authorised user

Your Rights

Under UK GDPR you have the right to:

• Ask for a copy of the personal data we hold about you
• Ask us to correct anything inaccurate or incomplete
• Ask us to delete your data, though we may need to keep clinical records for the retention period set out above
• Ask us to restrict how we use your data, or object to our using it
• Ask us to transfer your data to you or another provider
• Withdraw consent at any time where we rely on your consent, such as for promotional use of photographs

To exercise any of these, email rica@glowbyrica.com. We will respond within one month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Cookies and Website Data

This website does not use tracking cookies, analytics or advertising pixels.

We store one small item in your browser's session storage so that the opening animation only plays once per visit. It contains no personal information and is cleared when you close your browser.

The booking calendar on our contact form shows which dates and times are unavailable. It does not reveal any information about other clients.

Changes to This Policy

We may update this privacy policy from time to time. Any changes will be reflected on this page with an updated date.