Privacy Policy

1. Who We Are

This website is operated by Ink and Lift Studio, a private semi-permanent makeup and brow studio in Cambridge, UK, run by Eilish Duignan ("we", "us", "our"). We are the data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Contact: [email protected] · Cambridge, UK

2. What Personal Data We Collect

• Contact & booking details — name, email address, phone number, and appointment preferences, collected via our booking and contact forms.
• Consultation & treatment information — the treatments you've had, dates of appointments, and notes relevant to your care.
• Health information — details you disclose about relevant medical conditions, allergies, medications, or pregnancy/breastfeeding status, so we can assess whether a treatment is safe for you. This is "special category data" under UK GDPR and is treated with extra care, as set out below.
• Photographs — before-and-after images taken with your consent, for our records and, separately, for marketing (only where you've agreed).
• Website usage data — such as pages visited, if we use analytics or cookies (see Section 7).

We do not directly collect or store your full payment card details; these are handled by our booking and payment platform provider.

3. How We Use Your Data, and Our Legal Basis

• To manage your booking, consultation and treatment — necessary to perform our contract with you.
• To assess your medical/health information for treatment safety — your explicit consent, as required for special category data under Article 9 UK GDPR.
• To contact you about your appointment, aftercare, or to respond to enquiries — contract / legitimate interest.
• To use before-and-after photos in marketing — your explicit, separate consent, which you may withdraw at any time.
• To keep appropriate treatment and consultation records — legal obligation, including any applicable local authority licensing requirements for special treatments.
• To improve our website — consent, where cookies or analytics are used.

4. Special Category (Health) Data

Because some treatments require us to understand your health background, we may process health-related information as "special category data". We only do this with your explicit consent, collected at consultation, and only use it to assess treatment suitability and keep you safe. We do not share this information other than as described in Section 5, and we keep it only for as long as necessary (see Section 8).

5. Who We Share Data With

We may share personal data with trusted third-party service providers who help us run our booking system, website, payments and client communications, under appropriate data processing agreements. We do not sell your personal data to third parties. We may also disclose information where required by law.

6. Cookies

Our website may use cookies or similar technologies to help it function correctly and, where enabled, to understand how visitors use the site. You can control or disable cookies through your browser settings; doing so may affect some website functionality.

7. How Long We Keep Your Data

We keep personal and treatment/health data for as long as necessary to provide our services, maintain appropriate treatment records, and meet any legal, insurance or local authority licensing requirements, after which it is securely deleted or anonymised.

8. Keeping Your Data Secure

We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or disclosure.

9. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Ask us to correct inaccurate data
• Ask us to delete your data, in certain circumstances
• Ask us to restrict or object to certain processing
• Request a copy of your data in a portable format
• Withdraw consent at any time, where we rely on consent
• Complain to the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been mishandled

To exercise any of these rights, please contact us at [email protected].

10. Children

Our services are for adults aged 18 and over only (see our Terms & Conditions). We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or the law. The latest version will always be available on this page.

12. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us at [email protected] or via our contact page.