Last updated: 21 June 2026
1. Who We Are
Opal Aesthetics is a sole-trader aesthetics business operated by Jovanne Anderson, based in Wootton, Bedfordshire. We provide aesthetic treatments in clients' homes and from our private studio.
If you have any questions about this policy or how we handle your data, please contact us:
2. What Data We Collect
We collect personal data only when you actively provide it or where it is necessary to operate our website. This includes:
- Contact form submissions — your name, email address, phone number (optional), and the message you send us.
- Booking data — when you book via our online booking system (FacesConsent), your name, contact details and health information are collected by FacesConsent on our behalf. Please review the FacesConsent privacy policy for details of how they process your data.
- Analytics data — if you accept cookies, we collect anonymised usage data via Google Analytics 4 (GA4), including pages visited, time on site, and approximate location (country/region level). No personally identifiable information is collected via GA4.
3. How We Use Your Data
We use the data we collect for the following purposes:
- To respond to your enquiries sent via the contact form
- To manage your treatment bookings and appointments
- To understand how visitors use our website so we can improve it (analytics, with your consent only)
We do not use your data for automated decision-making or profiling, and we do not send marketing emails without your explicit consent.
4. Legal Basis for Processing
We process your personal data on the following legal bases under UK GDPR:
- Legitimate interests — responding to contact form enquiries and managing appointments.
- Consent — analytics cookies via Google Analytics 4. You can withdraw consent at any time by adjusting your cookie preferences.
- Contract — where processing is necessary to fulfil a treatment booking.
5. Cookies
Our website uses a cookie consent banner in line with PECR. Cookies are categorised as follows:
- Strictly necessary cookies — these are required for the website to function (e.g. remembering your cookie preference). These are set regardless of consent.
- Analytics cookies — set by Google Analytics 4 only if you accept cookies. These help us understand how visitors use the site. No personally identifiable data is collected.
You can change your cookie preference at any time by clicking "Cookie settings" in the footer of any page, or by clearing your browser cookies and reloading the page.
6. Who We Share Your Data With
We do not sell your personal data. We may share it with the following third parties only where necessary:
- FacesConsent — our online booking and consent management platform. Data is stored and processed by FacesConsent in accordance with their privacy policy.
- Google Analytics — anonymised website usage data, only with your consent. Google processes this data in accordance with their privacy policy.
- SiteGround — our website hosting provider. Contact form submissions are transmitted via our server hosted by SiteGround (UK/EU).
All third parties we use are required to keep your data secure and are only permitted to use it for the specific purposes we describe.
7. Data Retention
We retain personal data for as long as is necessary for the purpose it was collected:
- Contact form enquiries are retained for up to 12 months, then deleted.
- Booking and health records are retained for a minimum of 8 years in line with NHS and clinical practice guidance.
- Analytics data is retained by Google Analytics for 14 months (our default retention setting).
8. Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:
- Right of access — you can request a copy of the data we hold about you.
- Right to rectification — you can ask us to correct inaccurate data.
- Right to erasure — you can ask us to delete your data where there is no lawful reason for us to continue holding it.
- Right to restrict processing — you can ask us to restrict how we use your data in certain circumstances.
- Right to data portability — you can request your data in a portable format.
- Right to object — you can object to processing based on legitimate interests.
- Right to withdraw consent — where processing is based on consent (e.g. analytics cookies), you can withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, please contact us at hello@opalaesthetics.uk. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).
9. Security
We take appropriate technical and organisational measures to protect your personal data. Our website uses HTTPS with HSTS, and contact form submissions are transmitted securely via SMTP with authentication. We do not store payment card details.
10. Changes to This Policy
We may update this privacy policy from time to time. The date at the top of this page shows when it was last revised. We recommend checking this page periodically.