Privacy Policy
*
Privacy Policy *
ALIEN WORLD PRIVACY NOTICE
Last updated: 27 October 2026
1. Introduction
At Alien World, we are committed to protecting your privacy and handling your personal information responsibly, securely and transparently.
This Privacy Notice explains how we collect, use, store and share personal information when you visit our website, book an appointment, receive treatment, purchase products or interact with our businesses.
This notice applies to:
Alien Aesthetics Ltd
Company Number: 11698503
Alien Skin Ltd (trading as Skin by Alien)
Company Number: 16083795
Registered office address for both companies:
Office 4, Second Floor
Park Lorne, 111 Park Road
London, NW8 7JL
Both companies operate within the Alien World group and act as joint data controllers for the shared processing activities described in this notice, including our shared Pabau client management system.
Each company remains responsible for processing activities it carries out independently.
This Privacy Notice does not cover Alien Juice Ltd, which operates as a separate legal entity.
Data Protection Contact
For privacy enquiries, data access requests or concerns about how your information is handled, please contact:
This is the central privacy contact for both companies.
2. Personal Information We Collect
We collect personal information necessary to provide our services, maintain clinical records, manage appointments and operate our businesses.
This may include:
Personal Information
Full name and date of birth
Contact details and address
Emergency contact details where appropriate
Photographic identification where age verification is necessary
Booking and Account Information
Appointment and treatment history
Booking fees, cancellations and rescheduling records
Memberships, packages and subscriptions
Loyalty points and account credit
Client portal information
Communication preferences
Medical and Clinical Information
Medical history and health questionnaires
Relevant health conditions, allergies and medications
Previous aesthetic procedures
Consultation and assessment records
Treatment plans and clinical notes
Prescribing information
Consent forms
Clinical photographs
Treatment outcomes and follow-up records
Relevant clinical correspondence
Health information is classified as special-category personal data under UK GDPR and is subject to additional protections.
Payment Information
We process information relating to deposits, treatment payments, memberships, refunds and outstanding balances.
Where required, clients must maintain a valid payment card securely on file through our booking and payment providers.
Website Information
IP addresses
Browser and device information
Website visits and interactions
Referral sources
Cookie identifiers
Analytics and advertising interactions
3. How We Collect Information
We collect information when you:
Book appointments online, by telephone or in person
Create or use your Pabau client portal
Complete medical questionnaires or consent forms
Attend consultations and treatments
Purchase products, gift cards or packages
Join memberships or loyalty programmes
Contact us by email, telephone, website forms or social media
Subscribe to marketing communications
Visit or interact with our website
We may also receive relevant information from authorised healthcare professionals, prescribers or other appropriate sources where lawful and necessary.
4. How We Use Your Information
We use personal information to:
Arrange, confirm and manage appointments
Assess clinical suitability for treatment
Maintain accurate medical and treatment records
Provide treatments and follow-up care
Manage prescriptions and clinical safety
Process payments, deposits and subscriptions
Administer memberships, packages and loyalty points
Communicate important appointment and aftercare information
Respond to enquiries and complaints
Meet legal and professional obligations
Improve our services and website
Send marketing communications where permitted
Measure advertising and website performance
We only process information where there is an appropriate lawful basis.
5. Lawful Bases for Processing
Under UK GDPR, we rely on different lawful bases depending on the purpose of processing.
Contract – Article 6(1)(b)
Where processing is necessary to provide services requested by you, including appointments, bookings and payments.
Legal Obligation – Article 6(1)(c)
Where processing is necessary to meet applicable legal requirements.
Legitimate Interests – Article 6(1)(f)
Where processing is necessary for legitimate business purposes, provided these interests are not overridden by your rights.
This may include maintaining security, managing complaints, preventing fraud and recovering legitimate outstanding payments.
Consent – Article 6(1)(a)
Where we request permission for specific activities, including certain marketing communications and promotional photography.
Consent may be withdrawn at any time.
Special-Category Health Information
Medical and health information requires an additional condition under Article 9 of UK GDPR.
Where applicable, we may rely on Article 9(2)(h) for the provision of health care or treatment, subject to the relevant professional confidentiality requirements.
Other applicable conditions may include explicit consent under Article 9(2)(a) or the establishment, exercise or defence of legal claims under Article 9(2)(f).
The appropriate condition depends on the processing activity.
Consent to receive treatment is separate from consent to receive marketing or have photographs used for promotional purposes.
6. Shared Client Records and Pabau
Alien Aesthetics Ltd and Alien Skin Ltd use a shared Pabau practice management system.
This system supports:
Appointment bookings and scheduling
Client accounts and portal access
Medical questionnaires
Consultation and treatment records
Consent forms
Clinical photography
Prescribing records
Payment administration
Memberships and packages
Client communications
Authorised practitioners and administrative personnel working across both businesses may access relevant client information where necessary for clinical care or legitimate operational purposes.
Sharing records helps maintain continuity of care, supports safe treatment planning and reduces unnecessary duplication of information.
Access to client records is restricted according to staff responsibilities and legitimate business or clinical requirements.
Both companies are responsible for the lawful handling of shared information.
Clients may contact our central Data Protection Contact regarding information held by either company.
7. Clinical Photography
Clinical photographs may be taken before, during or after treatment to document progress, support assessments and maintain accurate treatment records.
Clinical photographs may be used for:
Treatment planning
Monitoring outcomes
Clinical reviews
Follow-up care
Managing complications
Investigating treatment concerns
Where relevant, photographs form part of your confidential clinical record.
Marketing and Promotional Photography
We will not use identifiable clinical photographs for advertising, social media or other promotional purposes without separate, appropriate consent.
Promotional consent is independent of treatment consent.
You may withdraw promotional consent at any time by contacting us.
Where photographs have already been published, we will take reasonable steps to remove them from platforms and materials within our control, subject to applicable legal requirements.
We cannot guarantee removal of material already copied or shared by third parties.
8. Appointment and Clinical Communications
We may contact clients by email, SMS or other appropriate methods regarding:
Appointment confirmations and reminders
Booking changes and cancellations
Prescribing consultations
Treatment preparation
Aftercare instructions
Treatment reviews and follow-ups
Account and payment activity
Membership administration
These communications may be necessary to administer your booking or provide appropriate clinical care.
Some messages may be generated automatically through Pabau.
Essential service and clinical communications are separate from promotional marketing.
9. Marketing Communications
We may send marketing emails or SMS messages about treatments, products, services, memberships, events and special offers.
Where consent is required, clients are given the opportunity to actively agree or decline marketing communications.
Marketing preferences are managed through our client management system.
We comply with applicable requirements under the Privacy and Electronic Communications Regulations (PECR).
Consent to marketing is optional and is not a condition of receiving treatment.
Clients may unsubscribe by:
Clicking the unsubscribe link in a marketing email
Following SMS opt-out instructions
Updating available communication preferences
Contacting megan@alienaesthetics.co.uk
We maintain appropriate suppression records to respect marketing opt-outs.
Where communications relate to both Alien Aesthetics and Skin by Alien, we ensure that the relevant marketing permissions cover the businesses and communication channels concerned.
10. Website Analytics and Advertising
Our website is hosted by Squarespace.
We also use analytics and advertising technologies, including:
Google Analytics
To understand website traffic, visitor activity and website performance.
Google Ads
To measure advertising conversions and assess campaign performance.
Meta Pixel
To measure website interactions and advertising performance across Meta platforms, including Facebook and Instagram.
Squarespace Analytics
To understand website visits, traffic sources and general website activity.
These services may process information such as IP addresses, device identifiers, browsing activity, referral sources and website interactions.
Where consent is legally required, non-essential analytics and advertising technologies will only operate after the visitor has provided appropriate consent.
We do not intentionally share identifiable clinical records or medical histories with advertising platforms.
11. Cookies
Cookies are small files stored on your device when visiting a website.
Our website uses cookies and similar technologies for:
Essential Website Functions
Necessary for website security, operation and functionality.
Analytics
To understand website traffic and improve performance.
Advertising and Conversion Tracking
To measure advertising effectiveness and support relevant advertising activities.
Non-essential cookies and tracking technologies are subject to applicable consent requirements.
Visitors must be able to accept or reject non-essential cookies and update their preferences.
Further information about Squarespace cookies is available at:
https://support.squarespace.com/hc/en-us/articles/360001264507
12. Payments and Stored Payment Methods
We use authorised payment processing services, including Stripe and relevant Pabau payment integrations, to manage payments securely.
This includes:
Booking fees
Treatment payments
Membership subscriptions
Packages and gift cards
Refunds
Authorised cancellation and no-show charges
Where required by our Booking Terms & Conditions, clients must maintain valid payment card details within their account.
Saved payment methods may be used for authorised transactions in accordance with the applicable payment terms.
Payment card information is handled through our payment providers.
We do not require clients to send full payment card details by email or messaging services.
Financial transaction records may be retained where necessary for accounting, tax and legal purposes.
13. Memberships, Packages and Loyalty Programmes
Where clients participate in our memberships, packages or loyalty programmes, we may process information including:
Membership details and subscription status
Payment history
Package entitlements and balances
Loyalty points
Account credit
Relevant membership communications
This information is used to administer the programme and provide the associated benefits.
14. Sharing Your Information
We do not sell client medical records or personal information to advertising companies or data brokers.
We may share information with trusted providers and authorised third parties where necessary and lawful.
These may include:
Pabau: Booking management, client records, communications and practice administration.
Squarespace: Website hosting and related website services.
Stripe and Payment Providers: Secure payment processing.
Google: Website analytics and advertising measurement.
Meta: Advertising measurement and related services.
Healthcare Professionals: Authorised practitioners, prescribers and other appropriate healthcare professionals where necessary for care.
Professional Advisers: Accountants, insurers and legal advisers where appropriate.
Regulators and Public Authorities: Where disclosure is required or permitted by law.
We aim to share only the information necessary for the relevant purpose.
Where organisations process information on our behalf, appropriate data protection and security arrangements are required.
15. International Data Transfers
Some of our technology and service providers may process or access personal information outside the United Kingdom.
Where international transfers occur, we use appropriate safeguards as required by UK data protection law.
These may include UK adequacy regulations or approved contractual safeguards, together with any additional protections required.
Information about relevant international transfer safeguards can be requested from our Data Protection Contact.
16. Data Retention
We retain personal information only for as long as necessary for its intended purpose and applicable clinical, legal, financial and professional requirements.
Clinical Records
Our standard retention period for routine adult clinical records is 10 years following the client's last treatment or relevant clinical contact, unless a longer period is required or justified.
This includes medical histories, consultation notes, treatment records, consent forms and relevant clinical photographs.
Financial Records
Financial records are retained in accordance with applicable tax and accounting requirements.
Marketing Information
Marketing information is retained while an appropriate lawful basis exists.
Where clients unsubscribe, limited information may be retained to ensure their preferences continue to be respected.
Website and Analytics Information
Website analytics information is retained according to the relevant platform settings and our applicable retention requirements.
Complaints and Legal Matters
Information relevant to complaints, legal disputes or regulatory matters may be retained for longer where necessary and lawful.
When information is no longer required, it will be securely deleted, anonymised or otherwise disposed of in accordance with our retention procedures.
17. Information Security
We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse or disclosure.
These include, as appropriate:
Secure client management systems
Individual staff accounts and access permissions
Confidentiality obligations
Secure payment processing
Appropriate staff training
Secure handling of clinical records
Procedures for managing information security incidents
Access to confidential information is restricted to authorised individuals who require it for legitimate professional or operational purposes.
18. Your Data Protection Rights
Under UK GDPR and applicable data protection law, you may have the following rights:
Right of Access
You may request a copy of the personal information we hold about you.
Right to Rectification
You may request correction of inaccurate or incomplete information.
Right to Erasure
You may request deletion of personal information where this right applies.
Certain clinical or financial records may need to be retained despite a deletion request.
Right to Restrict Processing
You may request restrictions on certain uses of your information in specified circumstances.
Right to Data Portability
Where applicable, you may request certain personal information in a structured, commonly used and machine-readable format.
Right to Object
You may object to certain processing activities, including processing based on legitimate interests.
You may object to the use of your information for direct marketing at any time.
Right to Withdraw Consent
Where processing is based on consent, you may withdraw it at any time.
Rights Relating to Automated Decision-Making
You have rights relating to certain decisions made solely by automated processing that produce legal or similarly significant effects.
We do not use solely automated decision-making to determine clinical suitability for treatment.
To exercise your rights, please contact:
We may request reasonable information to verify your identity before responding.
We will respond within the timescales required by applicable data protection legislation.
19. Information Required for Treatment
Certain personal and medical information is necessary to provide our services safely.
This may include contact details, relevant medical history, medication information and completed consent documentation.
Failure to provide information necessary for clinical assessment or treatment may mean we are unable to proceed with an appointment.
Consent to promotional marketing is not required to receive treatment.
20. Automated Processing
We use automated systems to support appointment reminders, booking communications, administrative processes, marketing preferences and website analytics.
Advertising platforms may use website interaction data for conversion measurement and audience targeting, subject to applicable privacy requirements.
Automated systems do not replace the clinical judgement of our qualified practitioners.
We do not use solely automated processing to make final decisions about clinical treatment suitability.
21. Complaints and Concerns
If you have concerns about how your personal information is handled, please contact our Data Protection Contact:
We will review your concerns and respond in accordance with applicable data protection requirements.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.
Information Commissioner's Office
Website: https://ico.org.uk
Telephone: 0303 123 1113
You may contact the ICO if you are dissatisfied with our response or have concerns about the handling of your personal information.
22. Changes to This Privacy Notice
We may update this Privacy Notice periodically to reflect changes in our services, technology, legal requirements or data processing activities.
The latest version will be available on our website.
Where changes materially affect how personal information is processed, we will provide additional information or notifications where required by law.
23. Contact Information
For all privacy and data protection enquiries relating to Alien Aesthetics Ltd or Alien Skin Ltd:
Data Protection Contact
Email: megan@alienaesthetics.co.uk
Registered Office for Both Companies
Office 4, Second Floor
Park Lorne, 111 Park Road
London, NW8 7JL
Alien Aesthetics Ltd: 11698503
Alien Skin Ltd: 16083795
Website: https://www.alienaesthetics.co.uk
Alien World | Alien Aesthetics | Skin by Alien