Your beauty journey starts here with unmatched expertise and care!
This policy explains how The Fab Clinic and The Fab Salon collect, use and protect your personal information when you visitour websites, book with us, receive treatment or contact us.
The Fab Clinic and The Fab Salon are trading names of TFBS Limited, registered in England and Wales under company number 693392302. We are the data controller for your personal information, which means we decide how and why itis used.
• Address: 283 – 285 Oldham Road, Grotton, Oldham OL4 4LQ
• Email: mail@thefabclinic.co.uk
• Phone: 0161 627 1114
• Websites: www.thefabclinic.co.uk and www.thefabsalon.co.uk
• ICO registration number: ZA558315
This policy covers clients and patients,people who enquire about treatments, website visitors and people who contact us through social media. We follow the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
We only collect what we need to book, treatand look after you safely.
Identity and contact details
Name, date of birth, address, email, phone number
Booking and account details
Appointment history, treatments booked, preferences, notes from your visits
Health and medical information
Medical history, medications, allergies, skin type, pregnancy, conditions that affect treatment suitability, consultation and consent forms, patch-test results, treatment records
Photographs
Before-and-after photos taken for your clinical record (and, only with your separate consent, for marketing)
Payment details
Payments, deposits, gift vouchers and courses. Card payments are handled by our payment provider; we do not store full card numbers
Communications
Emails, calls, WhatsApp, text and social media messages, enquiry forms and reviews
Marketing preferences
Whether you have agreed to receive offers and news from us
Website and device data
IP address, browser, pages visited and cookie data (see section 6)
Communications
Images recorded in and around the premises, if CCTV is in use [delete if not]
CCTV
Emails, calls, WhatsApp, text and social media messages, enquiry forms and reviews
Health information is "special category data" under UK GDPR and gets extra protection. We collect it because many treatments — especially laser, injectables and other aesthetic procedures — cannot be carried out safely without it.
We do not knowingly provide treatments to, or collect information from, anyone under 18 [adjust if you treat under-18s with parental consent].
• From you directly — when you book online, call, visit, fill in a consultation or consent form, message us or enter a competition.
• Through our online booking system (Phorest), which stores your bookings and client record.
• Through social media and advertising — for example when you message us on Facebook, Instagram or WhatsApp, or submit a lead form on a Facebook or Instagram ad.
• From your doctor or other practitioners — occasionally, and only where needed for your treatment and with your knowledge.
• Automatically from ou rwebsite — through cookies and similar technologies(see section 6).
The law requires us to have a lawful basis for each use of your information.
Taking bookings, sending appointment reminders and providing treatments
Contract
Assessing whether a treatment is safe for you and keeping clinical records
Contract and legal obligation; for health data, provision of health care (Art. 9(2)(h)) or yourexplicit consent
Before-and-after photos for your clinical record
Contract and provision of health care
Using your photos or reviews in marketing
Your explicit consent, which you can withdraw at any time
Taking payments and keeping financial records
Contract and legal obligation (tax and accounting)
Following up enquiries you send us, including ad lead forms
Legitimate interests (responding to your request) or steps before a contract
Sending marketing emails, texts and WhatsApp messages
Your consent, or for existing clients, the "soft opt-in" for similar services; you can opt-out at any time
Running and improving our website, preventing fraud and keeping our premises safe
Legitimate interests
Handling complaints, insurance claims and legal matters
Legal obligation and legitimate interests; for health data, legal claims (Art. 9(2)(f))
We do not use automated decision-making or profiling that has a legal or similarly significant effect on you.
We will only send you offers and news by email, text or WhatsApp if you have agreed, or if you are an existing clientand have not opted out. Every message tells you how to unsubscribe, or you cantell us at any time.
We never use your health information for marketing, and we never sell your data.
Advertising on Facebook and Instagram: we advertise through Meta. If you submit a lead form on one of our ads, Meta passes your details to us so we can contact you about the treatment you asked about. With your consent (via our cookie banner), we may also use the Meta Pixel on our website to measure ad results and show ads to people who have visited our site. We may upload hashed (scrambled) contact lists to Meta to find similar audiences or exclude existing clients; we never share health information for this. You can control ad preferences in your Facebook and Instagram settings.
Photos and reviews: we only post client photos, videos or testimonials on our websites or social media with your clear written consent. You can ask us to stop using them at any time, and we will remove them from our own channels.
Cookies are small files stored on your device when you visit a website. We use:
Strictly necessary
Makes the site and booking pages work
No
Analytics (e.g. Google Analytics)
Tells us how visitors use the site so we can improve it
[Yes, unless you use an exempt, privacy-friendly setup]
Marketing (e.g. Meta Pixel)
Measures our adverts and shows ads to past visitors
Yes
When you first visit, our cookie banner lets you accept or reject non-essential cookies. You can change your choice at any time through the cookie settings link at the bottom of the site, or by clearing cookies in your browser.
[Check this table against the tools yourwebsite actually uses, and make sure the banner blocks marketing cookies untilsomeone accepts.]
We only share your information where needed, and our suppliers may only use it on our instructions.
• Practitioners and doctors who treat you at the clinic, including visiting clinicians on clinic days.
• Phorest — our booking, client record and messaging system.
• Payment providers [name, e.g. Stripe / card terminal provider] — to process payments.
• IT, website and email providers [name your web host and email provider].
• Meta (Facebook, Instagram, WhatsApp) and Google — for messaging, advertising and analytics as described above.
• Your GP or other healthcare providers — only with your consent, or in an emergency.
• Our insurers, accountants and legal advisers — where needed to run the business or handle a claim.
• Regulators, police or courts — where the law requires it.
Transfers: some of our suppliers (for example Meta and Google) may process data outsidethe UK. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum to keep your information protected.
Security: we protect your information with password-protected systems, restricted staffaccess, secure storage for paper records, and staff training in confidentiality. If a data breach is likely to put you at risk, we will tell you and the ICO as the law requires.
How long we keep it:
Clinical and treatment records, consultation and consent forms, clinical photos
[8] years after yourlast treatment
Payment and accounting records
6 years after the end of the financial year
Enquiries that do not lead to a booking
[12] months
Marketing preferences
Until you opt out, then a suppression record so we don't contact you again
Marketing photos and testimonials
Until you withdraw consent
CCTV
[30] days unless needed for an incident
[Confirm the clinical record period with your insurer or professional body.]
You have the right to:
• access a copy of the information we hold about you;
• correct information that is wrong or incomplete;
• delete your information, where we are not legally required to keep it;
• restrict or object to how we use it, including at any time to direct marketing;
• move your information to another provider (data portability);
• withdraw consent at any time, where we rely on consent.
To use any of these rights, email mail@thefabclinic.co.uk or call 0161 627 1114. There is no charge, and we will reply within one month.
If you are unhappy with how we have handled your information, please contact us first at mail@thefabclinic.co.uk, by phone, or in writing to the address above. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay.
You can also complain to the InformationCommissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.
We may update this policy from time to time. The latest version will always be on our website.
Last updated: 5 November 2026
