Privacy Policy

1. Who we are and how to reach us

1.1 What this policy covers

This policy explains what we do with personal information when you use Little Black Book - our website, our practitioner app, and the booking, payment and messaging that run through them.

It covers three groups of people, and says which parts apply to whom:

• Clients - you book a treatment with a practitioner listed with us.
• Practitioners and clinics - you list your services and run your bookings through us.
• Prescribers - you are a regulated prescribing clinician connected to practitioners on the platform.

Read it alongside our Terms & Conditions and End-user License Agreement. This policy supplements those documents; it does not override them.

1.2 Who is responsible for your information

This matters more on our platform than on most, because a practitioner keeps records about you that we hold but do not decide the content of. There are three different answers depending on which information you mean.

We are responsible for the platform itself. Little Black Book App Ltd (SC655855) is the controller for: your account, the practitioner directory, bookings made through us, payments and refunds, the emails, texts and notifications we send, reviews, and the security and operation of the service.

We and your practitioner are jointly responsible for your consultation and consent forms. These are the forms you complete before a treatment - medical history, allergies, patch tests, treatment consent. We decide how those forms are built, stored, secured and made available; your practitioner decides what is asked, and how your answers inform your treatment. Under Article 26 of the UK GDPR that makes us joint controllers, and the essence of our arrangement is this:

You can exercise your rights against either of us, and we will not turn you away on the grounds that the other one should handle it. The full arrangement is available on request.

Your practitioner alone is responsible for their own notes about you. If a practitioner writes treatment notes on your client record or on an appointment, they decide what goes in them and we simply store them, on their instructions, as their processor. If you want to see or change those notes, ask your practitioner. If you ask us, we will pass the request on and help them act on it, but they decide.

1.3 Contact details and complaints

• Legal entity: Little Black Book App Ltd
• Company number: SC655855 (registered in Scotland)
• Email: info@mylittleblackbook.app
• Website: https://mylittleblackbook.app

If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113. We would like the chance to put it right first, so please come to us before the ICO - but you do not have to, and you can go to them at any time.

1.4 Changes to this policy, and keeping your details right

We review this policy and will post any changes here with a new date. Where a change materially affects you, we will tell you.

Please tell us if your contact details change. Much of what we do - appointment reminders, payment receipts - depends on reaching you.

1.5 Sites we link to

Our pages link to practitioners' own websites, their social media, and to Stripe for payment. We do not control those sites and are not responsible for what they do with your information. Read their privacy notices.

2. The information we hold

2.1 If you book treatments

If a practitioner brought you onto the platform by importing their existing client list, we may hold this information about you before you have ever visited our site. Section 3 explains that, and section 10 explains what you can do about it.

2.2 If you are a practitioner or clinic

Your name, professional title and biography; your photograph, hero image, brand logo and galleries; your qualifications as you describe them; your clinic name, type, address, postcode and map location, and a second location if you have one; your contact details, and whether you have chosen to show your phone or email publicly; your social media and website links; your specialisation, gender and the date you started practising; your policies on cancellation, rescheduling, lateness and patch tests; your services and prices; your availability; your commission rate and plan; your Stripe Connect account identifier and its status; your clients, bookings and takings; and your notification and marketing preferences.

Much of this is deliberately public - it is your listing. Your address and postcode are published as part of it, which matters if you practise from home.

We also hold the outcome of our approval review of your profile, when it changed, which of our staff decided it, and any note they wrote.

2.3 If you are a prescriber

Your name, professional title, email and phone; your professional regulator and registration number (GMC, NMC, GPhC, HCPC or other); your practice name and address, service area and preferred contact method; your photograph, bio, experience and languages; your insurance provider and policy expiry; the treatments and consultation types you cover; your verification status; and your connections and requests with practitioners, including notes our staff write when approving or rejecting a connection.

2.4 Consultation and consent forms - health information

This is the most sensitive information on the platform, so it gets its own section.

Before certain treatments your practitioner will ask you to complete a form. Depending on the treatment, those forms ask about:

• medical history, current and past
• medications you take, including dosage
• allergies and previous reactions
• pregnancy and breastfeeding
• named conditions - including eczema, psoriasis, rosacea, acne, dermatitis, vitiligo, epilepsy, bleeding disorders, keloid scarring and cold sores
• whether you are awaiting a diagnosis or under investigation
• previous cosmetic treatments and any complications
• your skin type on the Fitzpatrick scale
• whether you smoke
• your GP's name, address, phone and email
• your date of birth and gender

Some forms ask you to sign on screen with your finger or a stylus, and we store that signature as an image.

Some forms ask for your consent to before-and-after photographs, and say whether they may be used in marketing. That consent is separate, it is yours to give or refuse, and refusing it does not stop you being treated.

Under data protection law most of this is "special category" information, which gets stronger protection. We rely on your explicit consent, given when you complete the form, and on the fact that it is necessary for your practitioner to treat you safely. You can withdraw consent - see section 10 - though your practitioner may then be unable to treat you.

Your answers are stored in our database and are visible to the practitioner treating you. They are also emailed to that practitioner when you submit the form. Prescribers do not have access to them.

2.5 What we do not collect

Being clear about this is as useful as the list above.

• No advertising or analytics tracking. We run no Google Analytics, no tag manager, no advertising pixel, and no third-party analytics of any kind. We do not track which pages you visit or what you search for.
• No card or bank details. Card numbers, expiry dates, security codes, account numbers and sort codes are entered directly into Stripe's own pages and never reach our servers. We could not show you your card number if we wanted to.
• No profiling or automated decisions. Nothing about you is decided by an algorithm. No automated decision is made about you that has legal effect or significantly affects you.
• We never sell your personal information, and we do not share it with anyone for their own marketing without asking you first.
• Our app collects no analytics. It contains no tracking, crash-reporting or attribution software, requests no advertising identifier, and does not ask to track you across other apps.

3. Where we get it

From you. When you create an account, book, pay, complete a form, leave a review, set your preferences, or contact us.

From your practitioner. Practitioners can add clients directly, and can import an existing client list from their previous booking system. An import can bring across your name, email, phone, date of birth, gender, address, marketing preferences, and any notes their old system held about you - in this industry those notes often contain treatment and health detail. Your practitioner is responsible for having a lawful basis to give us that information. If you find we hold information about you and you never gave it to us, this is usually why; contact us and we will tell you which practitioner provided it.

From Stripe. After you pay, Stripe tells us the payment succeeded, the email address you used, and references we use to match the payment to your booking.

From Google. If you sign in with Google, Google gives us your email address, first and last name, and an account identifier.

Automatically, and only a little. We record the IP address of a device that repeatedly fails to sign in, so that we can block it. Our error-monitoring and the fonts and code libraries our pages load also see your IP address - see sections 5, 6 and 7.

4. Why we use it, and our lawful basis

Where we rely on legitimate interests we have weighed our interest against your rights, and we will explain any of these assessments if you ask.

4.1 Marketing

We send marketing only if you have opted in. Every marketing message has an unsubscribe link, and you can change your preferences in your account at any time. Turning marketing off does not stop booking confirmations, reminders or receipts - those are part of the service, and you cannot opt out of them while you have an active booking.

4.2 If you do not give us what we need

Some information we need in order to do what you have asked. If you do not give us your phone number we cannot text you a reminder; if you do not complete a required consent form your practitioner may not be able to treat you. We will tell you when this is the case.

5. Who we share it with

5.1 Your practitioner

Your name, contact details, bookings, payment status and completed forms are visible to the practitioner you have booked with. This is the point of the service.

If two practitioners you see both use Little Black Book, your name, email, phone and Stripe identifier sit on a single shared client record. Notes are not shared - notes one practitioner writes about you are not visible to the other.

5.2 Our staff

Our staff can see client records and completed forms in order to run the platform and support practitioners, including by opening a practitioner's own view of their account. Access is limited to people who need it, they are bound by confidentiality, and every time a member of staff opens someone else's account it is recorded in an access log.

5.3 Companies that provide parts of the service

Each of these does a specific job for us, acts on our instructions, and is bound by contract.

Professional advisers - lawyers, accountants, insurers - see what they need to advise us, when they need it.

5.4 When the law requires it

We will share information with HM Revenue & Customs, regulators, the police or a court where we are legally required to, or to establish or defend legal claims, or to protect someone's safety.

5.5 If our business changes hands

If we sell or merge part of our business, information may transfer with it. The new owner would be bound by this policy, and we would tell you.

6. Cookies and similar technologies

We set two cookies of our own. Neither is used for advertising or analytics.

Because these are all strictly necessary or preference cookies you set yourself, we do not ask for cookie consent for them.

Separately from cookies, our pages load fonts and code libraries from Google, jsDelivr and Cloudflare, and our error monitoring runs in your browser. Those requests reveal your IP address and browser to those companies even though they set no cookie. Sections 5.3 and 7 cover that.

You can block or delete cookies in your browser. Parts of the site will stop working if you block the ones above.

7. Where your information is held

Our servers are in the United Kingdom. Some of the companies in section 5.3 are outside the UK, principally in the United States: Stripe, Twilio, Expo, Apple, Google, Sentry and Cloudflare. Brevo is in the European Union.

Where information goes outside the UK we rely on one of:

• a UK adequacy decision, where the country has one - this covers the EU, and so Brevo
• the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, with a transfer risk assessment
• the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified under it

Ask us and we will tell you which applies to a particular provider and give you a copy of the safeguards.

8. How long we keep it

If a complaint or legal claim is live we keep what is relevant to it until it is resolved.

Where we no longer need information but still want the statistics, we strip out everything that identifies you. Once it can no longer identify you, data protection law no longer applies to it and we may keep it indefinitely.

9. How we protect it

Connections to our site and app are encrypted. Passwords are stored hashed, not in readable form. Access is limited to people who need it for their job, and practitioners can only reach their own clients — or their clinic's clients when they work as a team. Payment card details never reach our systems. Sign-in attempts are rate-limited and repeated failures are blocked. Sessions and app tokens expire, and you can sign out of every device at once. When a member of our staff opens someone else's account, that is recorded.

No service can promise perfect security. We have a procedure for suspected breaches, and where the law requires it we will report a breach to the ICO within 72 hours and tell the people affected.

10. Your rights

You can ask us to:

• Give you a copy of the personal information we hold about you
• Correct anything that is wrong or incomplete
• Delete it, where we have no continuing reason to hold it
• Restrict what we do with it while a dispute is resolved
• Send it to you or someone else in a portable format, where we hold it on the basis of your consent or a contract
• Stop, where we rely on legitimate interests, or for direct marketing - for marketing this is absolute, and we will always stop
• Withdraw consent at any time, where consent is our basis. This does not make our earlier use of it unlawful.

How to ask. Email info@mylittleblackbook.app. Say what you want and what information you mean. We may need to confirm who you are first.

How long we take. One month. If your request is complicated we may take up to two more months, and we will tell you within the first month if so.

Cost. Free, unless a request is excessive or repetitive, in which case we may charge a reasonable fee or decline - and we will explain why.

Practitioners: deleting your account. You can delete your account in the app, under More then Account then Delete account. It takes effect immediately and cannot be undone. Your profile comes out of the directory and your personal details are erased. Bookings, payment and payout records survive, because tax law requires them and because they are also your clients' records of their own appointments. Your clients' records and their completed forms also survive: they belong to the clients, and to the clinical record. If you want those deleted too, tell us.

Clients: deleting your information. Email us. Bear in mind two limits. We must keep booking and payment records for six years for tax. And we cannot delete a treatment record your practitioner is professionally required to keep - for that part, your practitioner decides, and we will pass your request to them and tell you what they say.

If you are not satisfied, complain to the ICO at ico.org.uk.

11. Clients under 18

Some practitioners treat clients aged 16 and 17 - brows, lashes, nails and waxing, typically.

Where a practitioner records information about a client under 18, that practitioner is responsible for obtaining consent from a parent or guardian before treatment, and for recording that consent. Where a consent form asks about health, consent to that must come from whoever holds parental responsibility, unless the young person is competent to give it themselves and the practitioner has judged that they are.

We do not knowingly hold information about children under 16. If you believe we do, tell us and we will delete it.

Our marketing is not directed at anyone under 18. An account holder must be 18 or over.

12. What the terms mean

• Personal information (the law says "personal data") - anything that can identify you, on its own or combined with something else.
• Special category information - health, racial or ethnic origin, religion, political opinions, trade union membership, genetic and biometric data, sex life and sexual orientation. It gets extra protection, and we need a stronger justification to use it.
• Controller - the organisation that decides why and how information is used, and carries the legal responsibility.
• Joint controllers - two organisations deciding that together. See 1.2.
• Processor - an organisation that only uses information as another organisation instructs.
• Performance of a contract - we need to use your information to do what you asked us to do, or to take steps before agreeing to.
• Legitimate interests - we have a genuine business reason, and we have checked it does not override your rights.
• Legal obligation - the law makes us.
• Consent - you have given clear agreement, and can change your mind.
• Explicit consent - the stronger form needed for health information: a clear, specific statement of agreement, not something we infer.