Privacy policy
Last updated: October 2026
This Privacy Policy explains how HEXIE BEAUTY LIMITED, trading as HEXIE Beauty, collects, uses, shares, stores and protects personal information. It covers the HEXIE Beauty website, online orders, treatment enquiries and bookings, consultations, skincare purchases, The Skin Decoded Method™, its client portal, Google Forms and related interactions through official communication channels.
The policy should be read alongside the Terms of Service, Contact Information and Client Care. Please supply only information relevant to the purpose of the form or message. Treatment and Method information may be especially sensitive.
On this page
- Data controller and privacy contact
- Information collected and how it reaches HEXIE Beauty
- How information is used and the lawful bases
- Health information, suitability and confidential images
- The Skin Decoded Method™ and private portal records
- Service providers, third-party platforms and disclosure
- Enquiries, social media, reviews and direct marketing
- Cookies, local storage and website technologies
- Security, international transfers and retention
- Your rights, data requests, complaints and changes
Data controller and privacy contact
HEXIE BEAUTY LIMITED
Trading as HEXIE Beauty
Company number: 15016177
Registered in England and Wales
Registered office: 9 Newbank Chase, Chadderton, Oldham, OL9 0LE, United Kingdom
The registered office is for statutory and formal correspondence. It is not the London clinic, a walk-in address, a skincare collection point or an automatic returns address.
HEXIE BEAUTY LIMITED is the data controller for personal information it decides how and why to use in operating HEXIE Beauty, except where a third party acts as an independent controller for its own activities. The website is hexiebeauty.co.uk.
For a privacy request, use the website chat or contact facility available through Client Care, send a private message to an official HEXIE Beauty social-media account, or continue an existing SMS or WhatsApp conversation if you already have one. Please label the request as a privacy or data-protection enquiry and avoid posting confidential information in public comments.
Information collected and how it reaches HEXIE Beauty
Website, enquiries and purchases
We may collect names, contact details, delivery and billing addresses, order numbers, purchases, payments and refund records, booking information, customer account identifiers, correspondence, support conversations, complaint records and preferences. Depending on the systems used, technical information may include IP address, device, browser, website activity, cookies and security event logs.
Consultations and treatments
Relevant consultation information can include skin concerns, goals, routines, past procedures, allergies, medical history, conditions, medication, pregnancy or breastfeeding information where relevant, client consent records, treatment notes, adverse reactions, appointment history and clinical photographs or short videos where appropriate. Some of this information is sensitive health data.
The Skin Decoded Method™
The Method may involve purchases and portal permissions, video lesson progress, Skin Discovery Consultation answers, skin images and other supporting uploads, skincare and supplement information voluntarily provided, meals and snacks, sleep, stress, movement, digestion, morning and evening skincare, SPF, questions about the personalised review and later check-in responses. We also process the personalised review itself and relevant correspondence about the experience.
Children and young people
The website and The Skin Decoded Method™ are not specifically directed at children. If information concerning someone under 18 is provided in connection with an enquiry or service, we will consider whether it is appropriate to collect and use that information and what additional safeguards, permissions or notices are required. Please do not submit information about a child or another individual unless you are authorised to do so and it is necessary for the relevant purpose.
Interactions elsewhere
Information may reach HEXIE Beauty directly when you complete forms or communicate privately, or via providers supporting the website and services. Publicly posted reviews or enquiries on Google Business Profile and social platforms are also visible in accordance with those platforms' settings. We do not normally ask clients to disclose sensitive health information through public reviews or public comments.
How information is used and the lawful bases
We use personal information for defined purposes. Depending on the context, those purposes include replying to enquiries; handling booking changes; reviewing consultations and determining treatment suitability; providing treatment, aftercare and client support; managing customer accounts; processing orders and payments; dispatching skincare; arranging clinic collection; administering digital access; delivering the Method and preparing personalised reviews; answering questions and completing check-ins; handling complaints; protecting systems; maintaining appropriate records; and meeting legal obligations.
Contractual necessity
Processing may be necessary to take steps you request before entering a contract or to perform a contract, for example to process a skincare order, arrange an appointment, manage portal access or provide an agreed personalised review.
Legal obligations
Some records or disclosures are required by law, including relevant tax, accounting, consumer-protection or lawful regulatory requirements. We may retain relevant evidence to meet these obligations.
Legitimate interests
Where appropriate, we may rely on legitimate interests in operating the business, responding to customers, preventing fraud, protecting website security, maintaining relevant records, resolving disputes and improving client experience. We consider the necessity of the processing and the effect on individual rights before relying on this basis.
Consent
Consent may be used where the law requires it, including for certain marketing activity, non-essential storage or tracking technologies, optional promotional image use and some processing of special category information. You may withdraw consent using an appropriate contact route. Withdrawal does not retrospectively make earlier processing unlawful; other legal grounds may require us to retain some information.
Different activities can have different lawful bases. Consent to a cosmetic treatment is not the same thing as consent under data protection law. Marketing consent is not a condition of receiving a treatment.
Health information, suitability and confidential images
Data about health can qualify as special category personal data under UK data protection law. We must identify an appropriate Article 6 lawful basis and, separately, an Article 9 condition before processing it. The appropriate condition may be explicit consent or another valid condition where it properly applies. A general booking acknowledgement alone should not be treated as consent for every use of health data.
Information supplied for a consultation is used to understand relevant contraindications, assess whether a cosmetic treatment should proceed, record agreed care and respond to concerns. Information supplied for the Method is used to understand the client's self-reported circumstances and prepare the agreed educational review. We seek to limit collection and access to what is appropriate to those purposes.
Consultation information and treatment photographs are intended for confidential records, assessment, planning and progress review where relevant. They are not automatically licensed for website, gallery, promotional or social-media use. Where identifiable images or private feedback are proposed for promotional use, separate permission and an appropriate lawful basis will be obtained. Refusing optional promotional use will not, by itself, prevent an otherwise appropriate service.
For appointment-related consultation and consent, see Client Care. You should update HEXIE Beauty if relevant health or treatment information changes before a future appointment. Please avoid uploading unrelated sensitive information or images containing identifiable third parties.
The Skin Decoded Method™ and private portal records
The Skin Decoded Method™ is delivered through seven stages: 14 educational lessons; Skin Discovery Consultation; Three-Day Baseline Observation; Personal Skin Decoded Review; questions about that review; a later check-in; and Method completion. The information collected in each stage supports the agreed educational and personalised service.
Some questionnaires are embedded Google Forms. Forms requiring file uploads may open in a separate Google page because Google can require sign-in to submit files. Uploaded images, review documents and related correspondence may be handled using Google Drive and other appropriate business systems. Google's own account and privacy terms also apply to its independent activities.
Portal access uses Shopify customer accounts and eligibility information, including access permissions and stage status. Some lesson progress information may be saved locally in the browser, with other status information retained in customer records. Clearing browser storage, switching browser or changing device can affect local progress. Where needed, HEXIE Beauty may use available customer-stage controls to help a client continue.
Private administrative notes may be used to manage the agreed client journey. Reports and form submissions are not intended for public display. Please keep account details private and contact HEXIE Beauty through the approved private channels if you suspect unauthorised access.
Service providers, third-party platforms and disclosure
HEXIE Beauty uses external providers to operate different parts of the business. Depending on the product or service, categories include:
- Shopify: website, store, checkout, customer account, order records, portal eligibility, customer communications and site security.
- BookX: appointment selection, scheduling and booking records.
- Payment processors: authorised payments, refunds, fraud prevention, identity or regulatory checks and transaction reporting, as relevant. We generally use payment confirmations rather than collecting full card details directly.
- Google Forms and Google Drive: consultation and consent responses, Method forms, uploads, supporting documents and review delivery or administration.
- Royal Mail or another suitable delivery provider: recipient name, address and parcel information needed to fulfil skincare orders.
- Google Business Profile: public reviews, business enquiries and interactions.
- Instagram, Facebook and TikTok: educational or promotional content, public posts and private messages; those platforms process personal data in their own right when you interact with them.
- Website chat, messaging and telecom providers: enquiry correspondence and established SMS or WhatsApp communication.
- Professional advisers, accountants, insurers and legal authorities: information required for advice, obligations, insurance, dispute resolution or lawful requests.
We share information only where necessary and legally justified, including with service providers acting under appropriate arrangements or independent controllers where required. We do not sell confidential client consultation or health records to advertising organisations. We may disclose information where legally required or where necessary to establish, exercise or defend legal claims, subject to the applicable requirements.
When you choose to use an external platform, its own privacy policy may govern part of the processing. A link to a third-party site does not make HEXIE Beauty responsible for that provider's separate actions, but it does not remove obligations relating to our own use of the provider.
Enquiries, social media, reviews and direct marketing
Website chat and the contact facility in Client Care can be used for a new enquiry. Official social-media private messages are also available; existing clients may continue an already-established SMS or WhatsApp conversation. Messages about treatment, orders or client care may be retained where reasonably required to provide the service, resolve issues or meet legal obligations.
Reviews left through Google Business Profile or another public platform may be visible to others under that platform's policies. We aim not to disclose private consultation, treatment or transaction details in public replies. If a private matter needs investigation, we may invite the reviewer to communicate privately.
Operational updates concerning a booking, order, payment, account, safety or agreed Method stage are distinct from marketing. Marketing about treatments, skincare and educational products will only be sent where the applicable UK marketing rules permit it. Where consent is the basis, clients can withdraw it. Where an opt-out is required, it will be provided through an appropriate route.
We do not use confidential medical or consultation responses for unrelated targeted marketing merely because someone has booked an appointment or completed a form.
Cookies, local storage and website technologies
The website may use cookies and related technologies for shopping baskets, authentication, checkout, booking, fraud prevention, security, customer privacy preferences and access to the Method portal. Locally saved lesson progress may use browser storage, which can be cleared or affected by device settings.
Analytics and advertising technologies, if enabled, must be assessed separately from essential functions. Where UK privacy rules require consent for non-essential tracking or device storage, the technology should not be activated until valid consent is obtained. Users should be able to review appropriate privacy choices through the available website controls. Not all cookies are set by HEXIE Beauty; providers may set technologies as part of the services used.
Cookie types, providers and retention periods depend on the current website configuration and may change. HEXIE Beauty should keep its cookie information and consent controls aligned with the tools actually enabled. Changing browser or privacy settings can affect parts of the checkout, portal or saved progress.
Security, international transfers and retention
We take proportionate technical and organisational measures to protect personal information, including appropriate access control, account security and restrictions on confidential client records. No online service is completely free of security risk. Clients should protect passwords, avoid sending payment card details in messages and report suspected account misuse.
Some providers may store or access data outside the UK. Where a restricted international transfer occurs, we must use a valid mechanism where required, such as UK adequacy regulations, an appropriate transfer agreement, the UK Addendum or another recognised safeguard. Relevant provider arrangements should be checked as they change.
Personal information is retained for no longer than reasonably necessary for the purpose for which it was obtained or for a lawful retention reason. Different categories have different periods: enquiry messages may be needed for customer support; treatment records may be needed for client care, insurance, safeguarding or legal claims; order and payment records for accounting, taxation and disputes; Method reports and access records for service delivery and account administration; and marketing choices to honour preferences and objections.
UK company accounting records may be subject to a statutory six-year retention requirement, but not every type of client information must be kept for that long. Information may need to be retained longer for a valid legal claim or other obligation. We aim to review retention and securely delete or anonymise information when it is no longer required. Account closure does not guarantee immediate deletion of records that must lawfully be retained.
Your rights, data requests, complaints and changes
Subject to applicable law and circumstances, you may have the right to be informed; obtain access to your personal data; request corrections; request erasure; restrict processing; object to certain uses; obtain portable data where applicable; withdraw consent; and challenge certain automated decisions. These rights are not absolute, and a lawful reason may sometimes require continued processing.
HEXIE Beauty does not ordinarily make treatment suitability decisions solely by automated processing that produces legal or similarly significant effects. Automated systems may still support ordinary checkout, booking confirmations, login, security and fraud prevention.
To exercise a right, make a clear privacy request using the website chat or contact facility within Client Care, an official social-media private message, or an existing SMS or WhatsApp conversation. We may ask for proportionate identity verification before disclosing information. Requests will be handled within applicable UK legal timeframes.
You can also raise a concern with the Information Commissioner's Office, the UK data protection regulator. You may contact HEXIE Beauty first if you would like your concern reviewed directly.
Services, legal requirements and providers may change. This Privacy Policy may therefore be amended. The current website version will show the month and year of its most recent substantive update. Where a new use of information requires fresh notice or consent, we will address that requirement separately.