Privacy policy

Last updated: 27 July 2026

1. Who we are

This website and studio are operated by Karrina Crystal PMU & Skin Specialist of 21 White Rose Way, Garforth, Leeds, LS25 2EF.

We are the data controller for the information described below. You can reach us at info@karrinacrystal.com or on 07926 928242.

2. What we collect

When you book

• Your name, telephone number and email address
• The treatment booked, the date and time, and your appointment history
• Any notes you add to the booking

Bookings are taken through That Time, an external booking platform. Information you enter there is held by them as well as by us, under their own privacy policy.

At consultation and treatment

Before most treatments we take a health and lifestyle history. Depending on the treatment this can include:

• Relevant medical conditions and past treatments
• Medications and supplements you are taking
• Allergies and known sensitivities
• Skin type, skin conditions and concerns
• Whether you are pregnant or breastfeeding
• Photographs taken before, during and after treatment
• Consent forms, patch test records and aftercare notes

Some of this is special category data under UK data protection law, because it concerns your health. It is treated accordingly and is covered in section 4.

When you pay

Payments are handled by our payment provider. We do not see or store your full card details.

When you use this website

This website sets no cookies. We use Cloudflare Web Analytics, which is cookieless and does not track you across sites or build a profile of you. It tells us how many people visited a page and roughly where in the world they were, and nothing that identifies you.

That is why you will not see a cookie banner here. If you follow a link to the booking system, or to Facebook or Instagram, those services have their own policies and may set cookies.

3. Why we use it

• To provide the treatment you have booked. Managing appointments, assessing suitability, carrying out the treatment safely and following up afterwards.
• To keep proper records. Treatment notes, pigment and product records, consent forms and aftercare, so that repeat and corrective work can be done safely and so we can respond if a question arises later.
• To answer enquiries you send by phone, WhatsApp, email or social media.
• To meet legal and insurance obligations.
• To show our work, where you have separately agreed to photographs being used. See section 6.

4. Our lawful bases

Under UK GDPR we must have a lawful basis for using your information. Ours are:

• Performance of a contract (Article 6(1)(b)) for taking and delivering your booking.
• Legal obligation (Article 6(1)(c)) where the law requires us to hold or produce records.
• Legitimate interests (Article 6(1)(f)) for record keeping, client safety, and responding to enquiries. We have considered your rights and do not believe these uses override them.
• Consent (Article 6(1)(a)) for marketing and for the use of your photographs.

For health information we rely on your explicit consent (Article 9(2)(a)), which you give on the consultation form. You can withdraw that consent at any time, although we may then be unable to treat you safely.

5. Who we share it with

We do not sell your information and we never will. We share it only with:

• That Time, our booking platform
• Cloudflare, who host this website and provide our analytics
• Our email provider
• Our payment provider
• Our accountant, and other professional advisers where needed
• Our insurer, if a claim or complaint arises
• Anyone we are required by law to share it with

Some of these providers operate outside the UK. Where that is the case, transfers are made under the safeguards UK data protection law requires.

6. Photographs

We photograph treatments to keep a clinical record. We only use a photograph publicly, including on this website, on social media or in advertising, if you have given separate written consent for that specific use.

You can withdraw that consent at any time by contacting us. We keep a record linking each published image to its consent form so it can be found and removed promptly. Images already printed or shared by others may not be recoverable, and we will tell you honestly if that is the case.

7. How long we keep it

• Treatment and consultation records: seven years after your last appointment, in line with our insurer's requirements.
• Booking and contact details: for as long as you remain a client, and three years afterwards.
• Enquiries that do not lead to a booking: twelve months.
• Marketing consent: until you withdraw it.

After that, records are securely deleted or destroyed.

8. Your rights

You have the right to:

• Ask what we hold about you and get a copy
• Have inaccurate information corrected
• Ask us to delete information, where we are not required to keep it
• Ask us to restrict how we use it
• Object to us using it on the basis of legitimate interests
• Ask for it in a portable format
• Withdraw consent at any time, where we rely on consent

To use any of these, contact info@karrinacrystal.com. We will respond within one month. There is no charge.

9. Marketing

We will only send you marketing messages if you have asked us to, or where the law permits it for existing clients. Every message includes a way to stop them, and you can also just tell us. Opting out of marketing does not affect appointment reminders, which are part of the service you have booked.

10. Keeping it safe

Paper records are held securely at the studio. Digital records are held on password-protected systems with access limited to those who need it. This website is served over an encrypted connection.

11. Complaints

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

12. Changes

If we change this policy we will update the date at the top. Where a change is significant we will tell clients directly.