Your data, held carefully.

Rebel is a beauty and aesthetics studio operating in United Kingdom. For appointments and website enquiries, the studio is the controller of the personal data described here.

You can reach us about privacy at Hayleybarrattbeauty@gmail.com.

When you book: your name, email address and phone number, the treatment and option selected, the appointment time, and any notes you choose to share (for example allergies or skin concerns). We also keep a record of appointment status, cancellations and reschedules.

When you visit: standard server logs needed to operate and protect the website, such as IP address, browser type and requested pages. We do not run advertising trackers or sell data.

If you sign in to the studio dashboard as an administrator, we store your name, email, role and a salted password hash. Session cookies are http-only and expire automatically.

Where you tell us about medication, allergies, pregnancy, medical conditions or previous aesthetic treatment, that is special category data under the UK GDPR. We collect it only because it is necessary to carry out your treatment safely and to keep an accurate clinical record, and we rely on the healthcare and safety provisions that apply to it.

Health notes are visible only to the practitioner and authorised studio administrators. They are never used for marketing or shared with a third party except a provider strictly necessary to run the studio.

To create, confirm and manage your appointment; to send confirmation, reminder and change notifications; to keep accurate business records; to prevent duplicate or fraudulent bookings; and to answer your enquiries.

No card details are collected through the website. Payment is taken at the studio, and card details are never stored on our systems.

We process booking data to perform the service you requested and to meet legitimate business needs such as record-keeping and fraud prevention. Where consent is required — for example for marketing messages or publishing a client photograph — we ask for it separately and you can withdraw it at any time.

Nothing in this policy limits your rights under the UK GDPR and the Data Protection Act 2018, or under any other applicable law. You may complain to the Information Commissioner's Office (ico.org.uk) at any time.

The public website does not set advertising or analytics cookies. A session cookie is set only when a studio administrator signs in, and it is used solely to keep that secure session active.

We use carefully selected service providers to run the studio: Cloudflare for hosting and database infrastructure, and an email provider for transactional notifications. These providers process data on our instructions. Where a provider transfers data outside the UK, appropriate safeguards are used.

We do not sell personal data. We may disclose information where required by law or to protect the safety and rights of the studio, its clients or the public.

Appointment records are retained for as long as needed to run the studio, honour guarantees and meet accounting obligations. Accounting records may be kept longer where tax law requires it. You can ask us to delete data that we are not legally required to keep.

Administrator access is protected by hashed passwords, signed http-only sessions and role checks. Booking requests are validated on the server, rate limited, and protected against duplicate submissions and double-booking.

No system is perfectly secure, but we work to keep the data we hold to the minimum needed and to limit who can access it.

You can ask to see the appointment data we hold about you, correct it, or ask for it to be deleted. Use the private management link shown when you book, or write to us.

If you believe your data has been mishandled, contact us first — we will investigate promptly. You may also have the right to complain to your local data protection authority.

We may update this policy as the studio or its tools change. The review date at the top of the page will always reflect the current version.