Privacy Policy
Last updated: 29 October 2026
Lumi Skin & Laser is committed to protecting our clients' personal information. We process personal data in accordance with applicable UK data protection legislation, including the UK GDPR and the Data Protection Act 2018.
Information we collect
Depending on how you interact with Lumi, the information we hold may include:
- Name
- Date of birth
- Email address
- Telephone number
- Appointment and booking information
- Consultation information
- Skin concerns and treatment goals
- Treatment history and treatment notes
- Relevant medical information
- Medication
- Allergies
- Pregnancy information where relevant to treatment suitability
- Before and after photographs where appropriate
- Communications with Lumi
- Payment and transaction information
- Marketing preferences
- Information submitted through website forms
- Relevant technical website information
Some consultation information may constitute special-category health data. Lumi only collects health information that is relevant to assessing treatment suitability, providing services safely and maintaining appropriate treatment records.
Why we use information
- Managing bookings and appointments
- Providing consultations and treatments
- Assessing contraindications and treatment suitability
- Creating personalised skin and treatment plans
- Maintaining client records
- Communicating about appointments and treatments
- Sending pre-treatment and aftercare information
- Processing payments
- Responding to enquiries
- Maintaining treatment safety
- Meeting insurance, accounting, regulatory and legal obligations
- Marketing where legally permitted
- Improving Lumi's services and website
Personal information will only be processed where an appropriate lawful basis applies. Where special-category information (such as health information) is processed, an appropriate additional condition will also be relied upon.
Clinical photographs
Clinical photographs may be taken to monitor treatment progress and maintain client records. Within the client portal, photographs are visible only to you and your practitioner.
Photographs will not be used publicly — including on social media, the website or in marketing — unless appropriate permission has been obtained from you.
Marketing
You may receive marketing communications where you have opted in or where otherwise legally permitted. You can unsubscribe at any time by using the link in a message or by contacting us.
Appointment reminders, treatment information, safety information and aftercare communications are service communications rather than marketing.
Third-party services
Lumi may use trusted third-party providers to help run the business, including for:
- Booking and client management (our online booking is provided by Ovatu)
- Website hosting
- Email communication
- Payments
- Direct Debit and payment services
- Consultation and consent forms
- Accounting
- IT and data storage
- Website analytics and functionality
These providers only process information as needed to provide their services. Lumi does not sell your personal information.
Data retention
Information is retained only for as long as reasonably necessary for the purpose it was collected, and to meet applicable legal, insurance, accounting and professional obligations.
Security
We use reasonable technical and organisational measures to protect personal information, including restricted access to client records and private storage for photographs and consultation documents.
International data transfers
Some technology providers may process information outside the UK. Where this happens, appropriate safeguards will be used where required.
Your rights
Under UK data protection law you have rights including:
- The right to access your information
- The right to have inaccurate information corrected
- The right to deletion in appropriate circumstances
- The right to restrict processing
- The right to object to processing
- The right to data portability where applicable
- The right to withdraw consent where processing relies upon consent
If you have concerns about how your information is handled, you can raise them with the Information Commissioner's Office (ICO) at ico.org.uk.