Privacy Policy

ELN Laser Hair & Tattoo Removal
Last updated: 01 October 2026

This Privacy Policy explains how ELN Laser Hair & Tattoo Removal collects, uses, stores and protects your personal information when you visit this website, contact me, make a booking or have treatment with me.

I am committed to handling your information responsibly and in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data-protection laws.

Who I am

ELN Laser Hair & Tattoo Removal is run by Emma Nixon, trading as a sole trader.

I am the data controller for your personal information. This means I decide how and why your information is used and I am responsible for keeping it safe.

Business address:
ELN Laser Hair & Tattoo Removal
Radiant
88 High Street
Heathfield
East Sussex
TN21 8JD

Email: info@eln-hrs.com
Telephone: 07814 552 542
ICO registration reference: [to add]

Information I collect

The information I collect depends on how you interact with me and the services you receive:

Enquiries and contact

When you contact me through my website contact form, email, telephone, Facebook, Instagram or another social-media channel, I may collect:

Your name
Your email address
Your telephone number
Your social-media profile name or account details
The contents of your message or enquiry
Any other information you choose to provide

Please avoid sending sensitive medical information through social-media messaging where possible. I may ask you to provide this information through a consultation form or another more appropriate route.

Newsletter and marketing

If you sign up to receive my newsletter, updates, offers or marketing communications, I collect:

Your name, if provided
Your email address
Your marketing preferences
Records of your consent and unsubscribe requests

Bookings and treatment records

When you book or receive treatment, I may collect:

Your name, address, email address and telephone number
Your date of birth
Appointment, booking and cancellation history
Details of the treatment you have booked or received
Payment status, payment amount, date and transaction reference
Correspondence relating to your booking or treatment
Consultation forms, patch-test results, treatment settings and treatment notes

I do not store full card details, card security codes or other sensitive payment-card information. If you pay by card or online, payment information is processed securely by the relevant payment service provider. I do not store full card details or card security codes.

Health and consultation information

To assess whether a treatment is safe and suitable, I may collect health information, including:

Medical history
Current or previous medical conditions
Medication
Allergies
Skin type and skin conditions
Previous treatment history
Pregnancy or breastfeeding information, where relevant
Information about the area being treated
Information relevant to laser hair removal or tattoo removal suitability

Health information is known as special category personal data under UK data-protection law. I take extra care when handling this information.

Photographs

I may ask to take before-and-after photographs of the treatment area.

Photographs may be used for one of two separate purposes:

As part of your treatment record, to monitor progress, support treatment planning and maintain an accurate record of the treatment provided.
For marketing purposes, including my website, social-media accounts, printed materials or promotional content.

I will ask for separate permission before using any photograph for marketing. You can refuse marketing-photo consent without this affecting your treatment.

I will not publish images showing your face, identifying features, tattoos that could identify you, or other identifiable information unless you have specifically agreed to this.

Website information

When you visit my website, my website platform and service providers may automatically collect certain technical information, including:

IP address
Browser type and device information
Operating system
Pages visited
Date and time of visits
How you use or interact with the website
Cookie and similar-technology information

Please see the Cookies section below for more information.

Why I use your information

I use your personal information only where I have a valid legal reason to do so.

Replying to enquiries

I use your name, contact details and enquiry information to respond to messages and answer questions. My legal basis is my legitimate interests in responding to enquiries and running my business.

Bookings, reminders and appointments

I use your contact details, booking information and appointment history to manage bookings, send appointment reminders, deal with cancellations and provide the services you have requested. My legal basis is performance of a contract.

Providing treatment and maintaining treatment records

I use consultation forms, treatment details, patch-test results, treatment settings and treatment notes to provide treatment safely and maintain accurate records. My legal basis is performance of a contract and my legitimate interests in running my business, maintaining appropriate records and protecting my legal rights.

Checking that treatment is safe and suitable

I use your medical history, medication, allergies, skin information and other health details to assess suitability, identify risks or contraindications, and provide treatment safely. I rely on your explicit consent to process this special category health information.

Clinical photographs

Where photographs are taken as part of your treatment record, I use them to monitor progress, support treatment planning and keep an accurate record of treatment provided. I rely on your explicit consent and, where necessary, my legitimate interests in maintaining records for insurance purposes or legal claims.

Marketing photographs

I use before-and-after photographs on my website, social media or other marketing materials only if you have given separate, explicit consent. You can refuse or withdraw this consent without affecting your treatment.

Newsletter, offers and marketing

I use your email address to send newsletters, offers and marketing communications only where you have agreed to receive them. My legal basis is consent. You can unsubscribe at any time.

Payments and financial records

If you make a payment, I may keep a record of the payment amount, date, payment method and invoice or receipt reference for accounting and business-record purposes. My legal basis is compliance with legal obligations, including tax and accounting requirements.

Complaints, insurance and legal claims

I may use relevant client, treatment, payment and correspondence records to investigate and respond to complaints, deal with insurance matters, and establish, exercise or defend legal claims. My legal basis is my legitimate interests and, where applicable, the establishment, exercise or defence of legal claims.

Website security and improvement

I use technical information and cookie data to keep the website secure, make it work properly and, where you consent, understand how visitors use it. My legal basis is legitimate interests for essential website functions and consent for non-essential cookies.

My legitimate interests

Where I rely on legitimate interests, these include:

Running, managing and improving my business
Responding to client enquiries
Maintaining accurate treatment and business records
Keeping the website secure
Preventing misuse, fraud or inappropriate use of services
Handling complaints, insurance matters and legal claims
Protecting my legal rights and the safety of clients

I have considered your rights and interests before relying on legitimate interests. I will not use this basis where your rights or interests override my own.

Health information and explicit consent

Health information requires additional protection under UK data-protection law.

I rely on your explicit consent to collect and use health information to assess treatment suitability, identify risks or contraindications, carry out treatment safely and maintain appropriate treatment records.

You can withdraw your consent at any time by contacting me using the details above. However:

I may be unable to provide or continue treatment if I do not have the information needed to assess its safety and suitability.
Withdrawal of consent will not affect processing already carried out before it was withdrawn.
I may need to retain certain treatment records, including relevant health information, where necessary for insurance, legal claims or other legal obligations.

Who I share your information with

I never sell your personal information.

I only share information with trusted providers and professional advisers where this is necessary to run my business, provide treatment, comply with legal obligations or protect my legal rights.

These may include:

Wix — website hosting, website contact forms and newsletter services
Eselram — online booking, client records, consultation forms and treatment records
My payment provider — processing payments securely
My email provider — managing emails and correspondence
Meta, including Facebook and Instagram — where you contact me through these platforms or where you have agreed to marketing use of photographs
My accountant — accounting, tax and business records
HM Revenue & Customs — where required for tax or legal purposes
My insurer, legal advisers or other professional advisers — where needed in relation to a complaint, insurance matter or legal claim
IT, website or software support providers — where necessary to maintain secure and functioning business systems

I may also share information where I am required to do so by law, by a court order, or where necessary to protect the health, safety or vital interests of you or another person.

International transfers

Some of my service providers may store or process personal information outside the United Kingdom.

Where this happens, I will ensure that appropriate safeguards are in place to protect your information. These may include:

A UK adequacy regulation
The UK International Data Transfer Agreement
The UK Addendum to the European Commission’s Standard Contractual Clauses
Another transfer safeguard recognised under UK data-protection law

You can contact me if you would like more information about the safeguards used for a particular provider.

How long I keep your information

I keep your personal information only for as long as reasonably necessary for the purpose it was collected, unless a longer period is required for tax, insurance, legal or regulatory reasons.

Enquiries that do not lead to a booking
I keep these for up to 12 months.

Client, consultation and treatment records
This includes consultation forms, health information, patch-test records, treatment notes and treatment settings. I keep these for seven years after your last treatment, or longer where required by my insurer or to deal with a legal claim.

Clinical photographs
If photographs form part of your treatment record, I keep them for seven years after your last treatment, or longer where required for insurance purposes or a legal claim.

Marketing photographs
I keep marketing photographs until you withdraw consent or until I no longer need them for the agreed marketing purpose.

Newsletter and marketing information
I keep this information until you unsubscribe or withdraw your consent.

Financial and accounting records
I keep these for the period required by HMRC and applicable tax law.

Complaints, insurance and legal-claim records
I keep these for as long as necessary to investigate, manage or defend the matter and meet relevant legal limitation periods.

When information is no longer needed, I will securely delete it, anonymise it or shred it.

Photographs and withdrawal of consent

If you have given permission for your before-and-after photographs to be used for marketing, you can withdraw this consent at any time.

If you withdraw consent:

I will stop using your photographs for future marketing.
I will remove photographs from channels under my control, such as my website and social-media accounts, as soon as reasonably practicable.
I may not be able to remove photographs that have already been copied, shared or reposted by other people or platforms outside my control.
I may keep photographs that form part of your treatment record where necessary for insurance purposes, legal claims or record-keeping obligations.

How I keep your information safe

I take appropriate steps to protect your personal information from loss, misuse, unauthorised access, alteration or disclosure.

These measures include:

Storing paper records in a locked cabinet
Password-protecting digital systems and devices
Limiting access to client records
Using reputable service providers for booking, records and website services
Keeping software, devices and passwords under review
Securely deleting or shredding records when they are no longer required

Only I, and authorised providers where necessary to support my business, have access to your client information.

Your rights

Under UK data-protection law, you have rights over your personal information. These include the right to:

Ask for a copy of the information I hold about you
Ask me to correct inaccurate or incomplete information
Ask me to delete your information in certain circumstances
Ask me to restrict how I use your information in certain circumstances
Object to processing based on legitimate interests
Withdraw consent at any time, including consent for newsletters, marketing and promotional photographs
Ask for your information to be sent to you or another provider in a usable format, where this right applies
Object to direct marketing at any time

These rights are not absolute and may not apply in every situation. For example, I may need to keep some information to comply with tax, insurance or legal obligations, or to establish, exercise or defend legal claims.

To exercise any of your rights, please email info@eln-hrs.com.

I will normally respond within one month. There is usually no charge for making a request, although I may charge a reasonable fee or refuse a request if it is clearly unfounded or excessive.

Is providing information compulsory?

You do not have to provide information for marketing, newsletters or promotional photographs.

However, if you choose not to provide the contact, consultation or health information needed to assess treatment suitability and provide treatment safely, I may be unable to offer or continue treatment.

Automated decision-making

I do not use automated decision-making or profiling that has legal or similarly significant effects on you.

Cookies

My website uses cookies and similar technologies.

Some cookies are necessary for the website to work properly. Other cookies may help me understand how visitors use the website, improve its performance or support marketing activity.

Where required, I will ask for your consent before placing non-essential cookies on your device. You can choose which non-essential cookies to accept through the cookie banner shown when you visit the website.

You can also block or delete cookies through your browser settings. Please note that blocking essential cookies may affect how the website works.

For more detailed information about the cookies used on this website, including their purpose, provider and duration, please see my Cookie Policy: [insert link to Cookie Policy].

Complaints

If you have concerns about how I have handled your personal information, please contact me first:

Email: info@eln-hrs.com
Telephone: 07814 552 542

I will do my best to resolve your concern.

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Website: www.ico.org.uk
Telephone: 0303 123 1113

Changes to this policy

I may update this Privacy Policy from time to time to reflect changes to my business, services, systems or legal obligations.

The most current version will always be available on this website. The date at the top of this policy shows when it was last updated.