Privacy Policy

Last updated: April 2026

1. Who We Are

Holistic Wellness Retreat ("we", "us", "our") operates the website emeraldderma.co.uk and provides aesthetic treatments from our clinic at 25 Trafalgar Rd, Birkdale, Southport, PR8 2HF. We are committed to protecting your personal data and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

You can contact us regarding data matters at: info@emeraldderma.com | +44 7895 530891

2. Data We Collect

We may collect and process the following personal data:

Name, email address, phone number and postal address
Order and payment information (processed securely via Stripe — we do not store card details)
Health and skin concern information you voluntarily share when booking treatments or using our Skin Concern Finder
Browsing behaviour and device information (via cookies and analytics)
Newsletter subscription preferences
Any communications you send to us (enquiries, contact forms)

3. How We Use Your Data

To process and fulfil your product orders
To manage clinic appointments and treatment bookings
To send transactional emails (order confirmations, shipping updates, appointment reminders)
To send marketing emails and offers where you have given consent (you may unsubscribe at any time)
To improve our website, services and product range
To comply with our legal and regulatory obligations
To prevent fraud and ensure the security of our services

4. Legal Basis for Processing

We process your personal data on the following legal bases:

Contract performance — to fulfil orders and treatment bookings
Legitimate interests — fraud prevention, service improvement, and customer communications relating to your purchases
Consent — for marketing emails and optional analytics cookies
Legal obligation — tax records, accounting, and regulatory compliance

5. Health Data

Where you provide information about your skin type, health conditions or treatment history in connection with clinic services, this constitutes special category data under UK GDPR. We process this data only with your explicit consent and solely for the purpose of providing safe and appropriate treatments. This data is kept strictly confidential and will never be shared with third parties for marketing purposes.

6. Cookies

We use essential cookies to operate the website (e.g. shopping cart, session management) and optional analytics cookies to understand how visitors use our site. You can manage or disable non-essential cookies through your browser settings at any time. Disabling essential cookies may affect the functionality of the website.

7. Data Sharing

We do not sell your personal data. We may share it with:

Payment processors (Stripe) — to securely process transactions
Shipping carriers — to deliver your orders
Email service providers — to send transactional and marketing communications
Legal authorities — where required by law or court order

All third-party processors are contractually obligated to handle your data securely and only for the purposes we specify.

8. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this policy. Order and financial records are retained for 7 years as required by HMRC. Treatment records are retained for a minimum of 8 years in line with clinical best practice. Marketing preferences are retained until you unsubscribe or request deletion.

9. Your Rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you
Rectification of inaccurate or incomplete data
Erasure ("right to be forgotten") where data is no longer necessary
Restriction of processing in certain circumstances
Data portability — to receive your data in a structured format
Object to processing based on legitimate interests or for direct marketing
Withdraw consent at any time where processing is consent-based

To exercise any of these rights, contact us at info@emeraldderma.com. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. All payment transactions are encrypted using SSL/TLS technology.

11. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. The latest version will always be available on this page, along with the date it was last updated.