Face Dr UK Privacy Policy

September 2026

This Privacy Policy explains how Face Dr Ltd collects and uses personal data when you visit myfacedr.com, create an account, place an order, contact us, or use our skincare consultation services.

1. Who we are and how to contact us

For the purposes of applicable data protection law, the controller of personal data described in this policy is:

Face Dr Ltd
Company number: SC622325
Registered office: 53/55 York Place, Perth, PH2 8EH, United Kingdom
Email: hello@myfacedr.com

A controller decides why and how personal data is processed. We are responsible for handling your personal data in accordance with applicable law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 as amended, and the Privacy and Electronic Communications Regulations 2003 (PECR).

Simon Langford

2. What this policy covers

This policy applies to personal data processed in connection with the UK website, online store, customer accounts, orders, customer support and skincare consultations, including interactions with our online concierge or other AI-assisted tools.

It does not replace any separate privacy notice presented when you use a particular service or submit information for a specific purpose. If there is a difference, the more specific notice will explain how that particular processing works.

3. Personal data we may collect

The information we collect depends on how you interact with us. It may include:

• Identity and contact information, such as your name, email address, telephone number and account details.
• Account information, such as login credentials, account preferences and records of products or services you have viewed or ordered through your account.
• Order and transaction information, such as products purchased, order history, payment status, refunds and payment confirmations. Payments may be handled by a payment provider; we do not necessarily receive or store your full payment-card details.
• Delivery information, such as your billing and delivery addresses and delivery instructions.
• Customer service information, including messages, enquiries, complaints and information you provide when requesting support.
• Technical and usage information, such as device, browser, IP address, website activity and cookie or similar technology information, subject to the cookie choices you make and applicable law.
• Marketing and preference information, such as your communication preferences, consent choices and records of whether you have opted out.
• Consultation information, which may include your skin concerns, current skincare routine, relevant medical history, allergies, pregnancy or breastfeeding information, photographs and other information you choose to provide for skincare advice.
• AI interaction information, such as messages, prompts, answers, photographs or other content you choose to share with an online concierge or AI-assisted consultation tool, together with records needed to operate and support that interaction.

Information about your health is special-category personal data under the UK GDPR. A photograph may also be health data if it reveals or is used to infer information about your health or is provided as part of a skincare consultation.

4. Where we get personal data

We may obtain personal data:

• directly from you when you browse, create an account, place an order, contact us, complete a questionnaire or use a consultation service;
• from your device or browser through website logs, cookies and similar technologies, subject to the choices you make and applicable law;
• from service providers who help us process payments, fulfil orders, provide customer support, host or maintain our website, or deliver consultation or communication tools; and
• from other sources where you have asked us to use them or where this is permitted by law.

5. How and why we use personal data

We use personal data only where we have a lawful basis under the UK GDPR. The basis depends on the purpose and the circumstances.

Where we rely on legitimate interests, we consider those interests against your rights and freedoms. You may object to processing based on legitimate interests in the circumstances described in section 13.

We will not use personal data for a materially different purpose without informing you where required by law.

Consultation and health information

You choose whether to provide consultation information and photographs. The consultation interface may ask you to give explicit consent to the processing of information and photographs for personalised skincare advice. We will only rely on that consent for special-category health data if it is valid, specific, informed, freely given, explicit and properly recorded, and if the relevant Article 9 condition and any other legal requirements have been confirmed.

You can withdraw consent at any time by contacting us at hello@myfacedr.com, or by using any withdrawal control provided in the consultation service. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. If you withdraw consent, we may be unable to provide personalised skincare advice that depends on processing your health information or photographs. We will explain any consequences at the time.

6. AI-assisted consultations and online tools

Some consultations or online concierge interactions may be AI-assisted. Information you choose to share through those tools may be used to provide personalised skincare advice and to support the interaction. Please do not submit information that is not needed for your enquiry or consultation.

AI-assisted output may not always be accurate or appropriate for your circumstances. It is not a substitute for urgent medical care or a diagnosis from a suitably qualified healthcare professional. You can contact us if you need to ask a person to review or respond to your enquiry.

7. Cookies and similar technologies

Our website may use cookies, pixels, local storage or similar technologies. Some are necessary to provide core functions, such as maintaining a basket, processing an order, securing the website or remembering your privacy choices. Other technologies may be used for analytics, personalisation or advertising.

We will not use non-essential cookies or similar technologies unless the required consent has been obtained under PECR and applicable data protection law. You can manage your choices through the cookie tool provided on the website. You may also be able to control cookies through your browser settings, although blocking some cookies may affect website functionality.

Withdrawing consent does not affect processing that took place before withdrawal.

8. Marketing communications

We may send you marketing by email or text where you have consented, or where the PECR “soft opt-in” applies. The soft opt-in is available only if its legal conditions are met, including that your contact details were obtained during a sale or genuine negotiations for a sale, the marketing concerns our own similar products or services, and you were offered a clear opportunity to opt out when your details were collected and in every subsequent message.

You can opt out at any time by using the unsubscribe link in a message or contacting us at hello@myfacedr.com. We may still send service messages about orders, accounts, consultations or important changes; these are not marketing messages.

9. Who may receive personal data

We may share personal data with service providers who process it on our behalf or help us operate the business. Depending on the service and the arrangements in place, categories may include:

• our website, e-commerce and hosting platform;
• payment providers;
• delivery, fulfilment and warehouse providers;
• IT, cloud storage, security and communications providers;
• customer support and consultation providers, including providers of online concierge or AI-assisted tools;
• analytics or advertising providers, where these are used and the required consent has been obtained; and
• professional advisers, auditors, insurers, regulators, courts or public authorities where necessary or legally required.

We require service providers who process personal data for us to protect it and use it only in accordance with our instructions and applicable law. Some recipients may act as independent controllers for their own purposes, such as payment processing; their own privacy notices may apply.

10. International transfers

Some service providers may process personal data outside the United Kingdom. Where personal data is transferred internationally, we will use a lawful transfer mechanism and appropriate safeguards where required. These may include a UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another permitted safeguard. Further information about the relevant safeguards can be requested using the contact details in section 1.

11. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purposes described in this policy, including to provide services, fulfil orders, meet legal and accounting requirements, resolve disputes and establish or defend legal claims. Retention periods depend on the type of information and why we hold it. We may securely delete or anonymise information when it is no longer required.

12. How we protect personal data

We use appropriate technical and organisational measures intended to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. No online service or method of transmission is completely secure, and we cannot guarantee absolute security. If we become aware of a personal data breach, we will take steps required by applicable law.

13. Your data protection rights

Subject to applicable law and any relevant exemptions, you may have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request erasure of personal data in certain circumstances;
• request restriction of processing in certain circumstances;
• receive certain personal data in a structured, commonly used and machine-readable format, or ask us to transmit it to another controller, where the right to data portability applies;
• object to processing based on our legitimate interests, including certain direct marketing;
• withdraw consent at any time where processing is based on consent; and
• complain to the Information Commissioner’s Office.

These rights are not absolute and may not apply in every situation. To exercise a right, contact us at hello@myfacedr.com. We may need to verify your identity before responding.

If you are unhappy with how we handle your personal data, please contact us first so that we can try to resolve your concern. You may also complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

14. Children and consultations

Our skincare consultations are not provided to people under 18. The consultation service asks users to confirm that they are 18 or over. Do not use the consultation service or provide health information or photographs for a consultation if you are under 18.

15. Links to other websites

Our website may contain links to websites or services operated by other organisations. We are not responsible for their privacy practices. Please read the relevant privacy information when you visit or use a third-party website or service.

16. Changes to this policy

We may update this policy from time to time. The current version will be published on our website with its effective date. If a change materially affects how we use personal data, we will provide any notice required by law.

17. Contact us

For questions about this policy or how we handle personal data, contact:

Face Dr Ltd
53/55 York Place
Perth
PH2 8EH
United Kingdom

Email: hello@myfacedr.com