At Liverpool Skin Lab, Your Privacy Matters.

Privacy Policy

Last Updated: 11 October 2026

Welcome to Liverpool Skin Lab (operating from 88 Rodney Street, Liverpool). We are committed to protecting the privacy, confidentiality, and security of our patients' personal and medical information [Health]. This Privacy Policy explains how we collect, store, use, and protect your data in strict compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the technical standards of UK Cyber Essentials.

The Data Controller for this practice is Dr Carmen Ranjith (MBChB, PGCert).

1. The Types of Data We Collect

Because we operate a specialised medical dermatology and clinical aesthetics practice, we collect two distinct categories of information [Health]:

  • Personal Identification Data: Your name, date of birth, home address, email address, mobile number, and emergency contact details.

  • Special Category Medical Data: In accordance with UK GDPR Article 9(2)(h), we collect and process sensitive health information necessary for medical diagnostics and clinical treatments. This includes your medical history, current prescription medications, clinical skin mapping logs, signed pre-treatment consent forms, and high-resolution pre- and post-treatment clinical photography [Health].

2. How We Collect Your Data

We collect data using fully secure, electronic methods to guarantee data integrity:

  • When you complete our online intake forms, skin risk assessments, or medical questionnaires via our encrypted clinical platform, Splose.

  • When you book an appointment or pay a deposit via our website.

  • During face-to-face clinical consultations and medical skin reviews at our 88 Rodney Street base.

3. How We Use Your Data

Your data is utilised strictly to provide safe, elite clinical care:

  • To accurately diagnose skin conditions and formulate bespoke, non-injectable medical dermatology prescription plans.

  • To coordinate your appointment bookings, send text/email reminders, and manage clinical schedules through our software pipeline.

  • To process payments, refunds, and secure your fully redeemable £50 consultation deposit.

4. Technical Security & Data Storage (UK Cyber Essentials Standard)

We enforce an absolute zero-tolerance policy for data vulnerability. Your information is protected by industry-leading digital architecture:

  • Decoupled Pipelines: We do not host or store your financial credit card details or medical records on our raw website servers.

  • Clinical Encryption: All patient notes, intake data, and tracking photos are securely encrypted and managed inside Splose, a dedicated medical software provider.

  • Financial Safety: All transaction data is processed using Stripe, a Level 1 PCI-Compliant payment platform.

  • System Perimeters: Every system terminal used by Liverpool Skin Lab enforces mandatory Multi-Factor Authentication (MFA), end-to-end data encryption, and automatic security patching to mirror UK Cyber Essentials benchmarks.

5. Data Sharing Restrictions

We will never sell, lease, or distribute your personal or medical data to third-party marketing companies. Your data is only shared under strict clinical or legal boundaries:

  • With professional medical laboratories or compounding pharmacies if required to mix bespoke prescription skincare lines for your journey.

  • With our medical indemnity organisation (MDO) or legal advisors in the rare event of a clinical review.

  • If we are legally compelled to do so by a court of law or public health authority.

6. The 8-Year Medical Retention Lock

Under UK GDPR guidelines, individuals generally hold a "Right to be Forgotten" (data erasure). However, under the UK clinical governance framework, professional indemnity regulations, and medical record-keeping laws, all medical notes, clinical consent profiles, and treatment histories must be legally archived for a minimum of 8 years following your last treatment.

You can request removal of personal contact data, but core clinical charts will be securely locked down until this 8-year statutory period expires, after which they are permanently cross-shredded and digitally wiped.

7. Your Statutory Rights

Under UK data protection law, you retain the following rights regarding your profile:

  • The Right of Access: You can request a digital copy of all personal and medical records we hold for you at any time, completely free of charge.

  • The Right to Rectification: You can request that we immediately correct any inaccurate or incomplete personal contact details.

  • The Right to Complain: If you believe your data has been handled incorrectly, you have the statutory right to log a formal complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection.

8. Contact Information

If you have any questions regarding this policy or wish to exercise your data rights, please contact our Data Protection Officer directly:

Privacy Policy.

People working at a white table with a laptop, notebook, glasses of water, and decorative vases and flowers in a minimalist room with wood paneling.