Who we are
Bio Medspa (“we”, “us”) is an advanced skin, body and wellness clinic at 22-24 Evan Street, Stonehaven, AB39 2EQ. We are the data controller for the personal information described in this notice. If you have any questions about how we use your information, contact us on 07956 217604, by visiting the clinic, or through the contact page on this website.
What information we collect
- Contact details such as your name, phone number and email address when you get in touch, book an appointment or sign up to our newsletter.
- Booking and payment information when you book through our online booking system or buy a gift voucher. Card payments are handled by our booking and payment provider; we do not see or store your full card details.
- Health and treatment information that you share with us at consultation, such as medical history, medications, skin concerns, treatment notes and before-and-after photos. This is special category data and we treat it with extra care.
- Website information such as basic technical data your browser sends when you visit our site.
How and why we use it
- To respond to your enquiries and manage your appointments, courses and memberships (to take steps at your request before and under a contract with you).
- To assess whether a treatment is safe and suitable for you, and to keep accurate treatment records (our legitimate interests and legal obligations; for health information, because it is necessary for the provision of health care and treatment, and with your explicit consent where required).
- To send you our newsletter and offers, only if you have signed up. You can unsubscribe at any time using the link in every email (your consent).
- To keep our website secure and working properly (our legitimate interests).
Who we share it with
We only share your information with trusted providers who help us run the clinic, and only as far as needed. These include our online booking and gift voucher provider (Phorest), our website host (Hostinger), and our email newsletter provider (Hostinger Reach). We will not sell your information. We may share information with a medical professional or authority where the law requires it or where it is needed to protect your health.
How long we keep it
We keep treatment and health records for at least 8 years after your last treatment, in line with professional guidance. Newsletter details are kept until you unsubscribe. Enquiries that do not lead to a booking are deleted within 12 months.
Your rights
Under UK data protection law you have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to how we use it, to ask us to transfer it to you or another organisation, and to withdraw consent at any time. To make a request, contact us using the details above. We will respond within one month.
If you are unhappy with how we have handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Cookies
Our website uses only the cookies needed for it to work. If we add analytics or marketing cookies in future, we will ask for your consent first and update this notice.
Changes to this notice
We may update this notice from time to time. This version was last updated on 13 October 2026.