Version privacy-notice-v2-2026-08-27 · 27 August 2026
Privacy Notice
This notice explains how we use personal information in the UK Dr Sknn account, cosmetic scan, consultation, booking, progress, rewards, research and sharing services.
Who is responsible
Shaffu Development Group Ltd, trading as Dr Sknn is the data controller. Company number 12211754. Dr Sknn is its trading name.
- Registered office
- Woodfords Solicitors LLP, 11 Harwood Road, London, England, SW6 4QP
- Clinic
- 45 Alderley Road, Wilmslow, Cheshire, SK9 1NZ
- Privacy and complaints
- hello@drsknn.com · 01625 520 300
- ICO registration
- ZB446955
The service is currently for people aged 18 or over in the United Kingdom.
Information we use
- Identity, age confirmation, contact, account, authentication, device, security, accessibility and preference information.
- Face photographs you select for a cosmetic scan, capture quality, cosmetic readings, authorised overlays, result provenance and progress comparisons.
- Information you or a practitioner add for consultation, medical-safety screening, treatment/appointment history, practitioner decisions, aftercare and care progression.
- Booking, deposit/payment/refund, rewards/referral, customer service, complaint and data-rights records. We do not store full card details.
- Optional goals, routine or personal context, marketing choices, commercial personalisation, research choices, private progress images and photos you specifically allow Dr Sknn to publish.
We do not use your facial photograph to recognise or uniquely identify you. A photograph is not special-category biometric data merely because it shows a face, although health-related readings or clinical context are treated as special-category data.
Why we use it and our legal bases
| Purpose | UK GDPR basis | Your choice |
|---|---|---|
| Account, requested service, booking and customer support | Article 6(1)(b), contract steps/performance; proportionate security also Article 6(1)(f) | Needed to provide the requested account/service |
| Cosmetic scan and health-related readings | Article 6(1)(b) and Article 9(2)(a), explicit consent | Separate scan choice; no scan if refused/withdrawn |
| Optional AI-generated explanation | Articles 6(1)(a) and 9(2)(a), consent | Separate optional choice |
| Practitioner consultation, safety intake, care tracking and Pabau clinic record | Article 6(1)(b); for direct care, Article 9(2)(h), Data Protection Act 2018 Schedule 1 Part 1 paragraph 2 and professional confidentiality. Optional tracking/context also uses consent where shown | Purpose-specific read/write/tracking choices and practitioner process |
| Payment, refunds, accounting and disputes | Articles 6(1)(b) and 6(1)(c); proportionate fraud controls Article 6(1)(f) | Needed for a paid booking |
| Channel marketing and health-data commercial personalisation | Article 6(1)(a), Article 9(2)(a) where applicable, and PECR | Optional, separate by channel/purpose |
| Research/model improvement, private progress sharing and optional photo publication | Articles 6(1)(a) and 9(2)(a), explicit consent | Optional and independent of care, price and access |
| Rights, complaints, incidents, legal claims and statutory records | Articles 6(1)(c), 6(1)(f) and, where needed, Article 9(2)(f) | Handled under law; consent is not used to avoid a legal duty |
Receiving this notice is not blanket consent. We record the statement version, your affirmative decision and any later refusal or withdrawal for each optional purpose.
Appearance analysis, AI and practitioner decisions
The scan provides non-medical cosmetic appearance observations. It does not diagnose or predict disease, prescribe, choose device settings or automatically approve, reject or rank treatment suitability. Capture, lighting, pose, skin preparation, software and provider performance can affect results.
Direct booking of IPL or another displayed aesthetic service reserves an appointment and remains conditional on an appropriately qualified practitioner's consultation and suitability checks. If unsuitable, treatment is not performed. Anti-wrinkle is consultation only.
If optional AI explanation is enabled, it receives only a minimized structured scan record—not the raw face photograph, direct identity, full medical intake, Pabau history or payment data. You can challenge an output and ask for human review.
Who receives information
Authorised Dr Sknn staff and practitioners receive only what they need. Depending on the service you choose, approved providers may include AILabTools for cosmetic image analysis, Pabau for the clinic record/booking, Render for hosting, AWS for private image storage, Stripe for payments, a configured communications provider, and an approved AI API provider for optional explanations. We also disclose information where law, safeguarding, claims or a regulator requires it.
Each processor is contractually restricted and reviewed. We do not disclose API keys, proprietary prompts, algorithms or other trade secrets in a privacy notice because they are not needed for you to understand how your personal data is used.
International transfers
Our intended private image region is London (AWS eu-west-2); some providers or their support/subprocessors may process information outside the UK. For a restricted transfer we use an applicable UK adequacy regulation or safeguards such as the UK International Data Transfer Agreement/Addendum with a transfer risk assessment and supplementary security controls. Contact us for information about the safeguard relevant to your data.
How long we keep information
- Failed/unclaimed captures and one-time challenges: 1 day; expired session evidence: 90 days.
- Closed account/contact operational copy: 90 days.
- Patient scan photographs, analysis/practitioner records and care events: 8 years after the last relevant activity.
- Generated scan overlays: 2 years, only when approved for retention.
- Raw AI prompt/output: not stored by the application; minimized safety metadata: 3 years.
- Optional personal context: 30 days after withdrawal/account closure unless already part of a required clinic record.
- Consent/privacy and marketing preference/suppression evidence: 7 years; rights/complaint and rewards/referral records: 6 years.
- Payment/transaction records: 7 years; pseudonymised research dataset: 5 years after project close/last use.
- Private progress images and publication-permission assets: up to 24 months or earlier withdrawal.
A documented legal hold, tax requirement, complaint, safety or clinical-record duty may require a particular record for longer. We delete, minimise or irreversibly anonymise it when that reason ends.
Research, improvement and public sharing
Research/model improvement is optional and limited to repeatability, performance/bias, safety and improvement of Dr Sknn cosmetic readings and explanations. We use a minimized pseudonymised copy by default. We do not sell it, use it for facial recognition, diagnosis or unrelated third-party model training without asking again. Withdrawal stops new use and removes a linkable active copy where feasible; irreversible anonymous aggregate findings cannot be linked back or unwound.
Share my progress creates a private image for you to download and does not let Dr Sknn publish it. If you separately choose “Allow Dr Sknn to publish this photo”, the screen shows the exact photo/result/testimonial, identity label, purpose, one channel, audience and 24-month end date before you confirm. Anonymous is the default. Withdrawal stops future use and we aim to remove controlled digital copies within 30 days; already distributed print or third-party copies may not be fully recallable.
Your rights
Depending on the circumstances, you may request access, portability, correction, erasure, restriction, objection, consent withdrawal and meaningful human review. Withdrawal does not make earlier lawful use unlawful or automatically erase a record that must lawfully remain.
Signed-in patients can use the privacy requests centre, or contact hello@drsknn.com. We normally respond within one calendar month after any proportionate identity check.
Complaints and changes
Contact hello@drsknn.com. You can also complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.
We preserve earlier notice/choice versions. We will highlight a material new purpose and ask again where consent is required rather than treating continued use as consent.