Privacy & cookies

Your information, handled with care.

This notice explains what we collect when you visit the website or book a treatment, why we need it, how long we keep it, and the choices you have. Last updated 5 September 2026.

Who we are

Coralluxe Ltd is an aesthetic practice led by Marjan, operating in London. We are the data controller for the information described here.

Contact: res@coralluxe.co.uk.

What we collect and why

Booking details
Name, email, phone, chosen treatment, location and appointment time. Needed to hold your appointment, confirm it, send reminders and aftercare, and contact you about changes. Lawful basis: performing our contract with you.
Consultation & consent forms
Medical history, medications, allergies, skin concerns and your signature. Needed to treat you safely and to record your informed consent. Lawful basis: your explicit consent, and our obligation to keep clinical records.
Treatment photographs
Only taken with your written consent, stored securely, and never published without separate written permission. Lawful basis: explicit consent.
Payments
Card payments are processed by Stripe on Stripe's own pages. We never see or store your full card number; we keep the payment reference and receipt. Lawful basis: contract and legal record-keeping.
Gift vouchers
Purchaser and recipient names and email addresses, and any personal message, to issue and redeem the voucher. Lawful basis: contract.
Email
Confirmations, reminders, before- and after-care notes and receipts, sent from our own addresses. We do not send marketing email unless you have asked for it.

Cookies and analytics

No cookies are set unless you accept them. No Google Analytics, no social media pixels, and nothing that follows you around other websites.

One optional Google Ads cookie. We advertise on Google, and to know whether an advert led to a booking we use Google's measurement tag. It runs in "consent mode": until you click Accept on the small cookie notice it stores nothing in your browser. If you accept, Google sets its advertising cookies so the booking can be matched to the advert. Decline and the site works exactly the same. You can change your mind here at any time:

We count page views with our own, cookieless analytics. Your IP address and browser type are turned into a salted, one-way hash that rotates monthly, so we can count visitors and see which pages and referrers are popular without being able to identify you or store your IP address. Approximate location (country and city) comes from our hosting provider and is kept only at that level.

Otherwise the only cookie the site sets is a sign-in cookie for staff using the private admin area. It is strictly necessary for that area to work and is never set for visitors. Your Accept / Decline choice itself is remembered in your browser’s local storage, not in a cookie.

Who we share it with

We share only what each service needs to do its job, and never sell your data:

  • Stripe — card payments and receipts.
  • Google Ads — advert measurement, only if you accept cookies.
  • Microsoft 365 — sending and receiving our email.
  • Vercel and Neon — hosting the website and its database, with data stored in encrypted form.

Some of these providers process data outside the UK under standard contractual safeguards. We will also disclose information where the law requires it.

How long we keep it

  • Clinical records, consent forms and treatment photographs: 8 years from your last treatment, in line with UK clinical record-keeping guidance.
  • Booking, payment and voucher records: 6 years, for tax and accounting.
  • Analytics: anonymous from the moment it is recorded; kept for trend reporting.

Your rights

You can ask us for a copy of the information we hold about you, ask us to correct it, ask us to delete it where we have no legal duty to keep it, object to or restrict how we use it, and withdraw consent at any time (for example, for photographs). Write to res@coralluxe.co.uk and we will respond within one month.

← Back to the site