Privacy notice
Version 21/10/2026
Who we are
Adrianne Hunt, trading as House of Rose Aesthetics, is the data controller for the personal information described here. Contact: [[ASK: email]]. Our postal address is 238 Ilchester Crescent, Bristol BS13 7HT.
What we collect and why
To take and manage your booking: your name, email address, mobile number, the treatment and time you chose, whether you have been treated by us before, any practical notes you add, and the records of your consent (age confirmation, booking policy, optional marketing). Legal basis: performance of a contract with you.
You need to give us your name, email address and phone number to book; without them we cannot take your booking.
To take your deposit: card payments are processed by Stripe; we never see or store your card number. We keep the payment reference, the amount paid and any refund. Legal basis: performance of a contract, and our legal obligation to keep financial records.
To contact you about your appointment: confirmation, reminders, changes and cancellations by email. Legal basis: performance of a contract.
To send occasional news and offers: only if you tick the separate marketing box. Any offers we send are only ever for treatments we are allowed to advertise. Legal basis: consent, which you can withdraw at any time by replying to any email or messaging us.
To check reviews before we publish them, we compare the reviewer’s name and date with our booking records. Legal basis: our legitimate interest in publishing only genuine reviews.
To keep the site safe: your IP address is used in memory to limit abuse and is not stored.
Your health information
We do not collect medical information through this website. Your medical history is taken in person at your appointment and kept in your treatment records, separately from the booking system.
We only collect information about your health in person, at your consultation, using [[ASK Q21: paper forms / the name of your consent platform]]. We use it to decide whether a treatment is suitable for you and to treat you with care. Our legal basis is your explicit consent (UK GDPR Article 9(2)(a)), which we ask for separately, in writing. Our lawful basis for using it is to provide the treatment you have asked for (UK GDPR Article 6(1)(b)). Treatment records, including clinical photos, are kept for 10 years after your last appointment. A written copy of your treatment plan is given to you in person, never sent by email.
Photos for your treatment record are part of your health information. We only use a photo for marketing with your separate written consent, which you can withdraw at any time.
Who we share it with
Stripe Payments UK Ltd (card payments, refunds), Brevo (sending our emails to you), Hetzner Online GmbH (the server the booking system runs on, in the EU), Cloudflare where it protects the site, and [[ASK Q21: your consent platform]] (your consultation records). Each acts under a contract that limits what they may do with your data.
Where a prescriber is involved in your care [[ASK Q17]], they are a separate controller for the prescribing consultation. Our insurer receives your information only if there is a claim.
If you message us on Instagram or WhatsApp, Meta processes those messages under its own privacy policy. We only use what you send to answer you and manage your booking.
We do not sell your details or share them with anyone else, except where the law requires it.
International transfers
Some of our providers, such as Stripe and Cloudflare, may process data in the United States. Where they do, the transfer is protected by safeguards recognised under UK law. [[ASK George: confirm the mechanism per processor before publishing]]
How long we keep it
| Information | How long we keep it |
|---|---|
| Bookings that were never paid for or confirmed | Deleted after 7 days. |
| Notes you add to a booking, and our own scheduling notes | Removed 30 days after the appointment. |
| Completed, missed and cancelled bookings | 24 months after the appointment, so we can see your history and handle any query. After that your name, email and phone number are removed from them and only the amounts and dates remain. |
| Waitlist entries | Deleted 90 days after they are added, or as soon as the dates you asked about have passed. |
| Copies of the emails we send you | 90 days. The record that an email was sent is kept for 24 months. |
| Treatment records, including clinical photos | 10 years after your last appointment, kept separately from the booking system in line with the retention periods for aesthetic treatment records and our insurer’s requirements. |
Your rights
You can ask for a copy of the information we hold about you, ask us to correct it, ask us to delete it (we can remove your details from past bookings on request while keeping the financial record), object to or restrict how we use it, and withdraw marketing consent at any time.
You have the right to object to our use of your information where we rely on our legitimate interests, and to object at any time to direct marketing.
We do not make decisions about you by automated means.
Email [[ASK: email]] and we will respond within one month.
Complaints about how we use your information
If you’re unhappy with how we’ve used your information, tell us first at [[ASK: email]]. We’ll acknowledge your complaint within 30 days.
If you are not happy with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Children
We do not knowingly collect information from anyone under 18. A booking made for someone under 18 is cancelled.
Cookies
This website uses no analytics or advertising cookies. See our cookies page for the full list.