Privacy Policy

1. Who we are

Barker's Aesthetics is a trading name of TATTOO BYE BYE LTD, registered in England and Wales under company number 16613581. Our registered office is 183 Saxon Way, Liverpool, England, L33 4HG. TATTOO BYE BYE LTD is the data controller for the personal information described in this notice and is registered with the Information Commissioner's Office (ICO).

For privacy questions or requests, please use our Contact / Enquiry page and state that your message concerns privacy or data protection.

2. Information we collect

Depending on your interaction with us, we may collect your name, contact details, date of birth, preferred contact method, appointment details, enquiry messages, consultation and treatment records, medical history and other relevant health information, consent forms, signatures, clinical or before-and-after photographs, treatment or Home Visit address, next-of-kin details, notes, complaints, aftercare and follow-up communications, and payment and transaction records.

We may also collect separate permission for the use of photographs or other content on social media. This permission is optional and is not a condition of receiving treatment. Our website may collect technical information such as IP address, browser information, security logs and cookie data. Please see our Cookie Policy.

Our services are intended for people aged 18 and over.

3. How we obtain information

We usually receive information directly from you through our website, consultations, consent forms, appointments and communications. Where necessary, we may also receive relevant information from an authorised member of staff, a registered prescriber, a pharmacy or medical supplier, or another person or organisation involved in your care or the delivery of a requested service.

4. Health information and prescribing

Medical history and health information are special category personal data and receive additional protection. Barker's Aesthetics relies primarily on your explicit consent when it is necessary for us to process this information. We may also process relevant information where necessary to establish, exercise or defend legal claims.

For prescription-only treatments, a separately registered prescriber conducts the required assessment, decides independently whether prescribing is appropriate and, where appropriate, issues the prescription. The prescriber may have separate professional duties and privacy information. We use Faces Consent where necessary to manage prescription and prescriber-related information, including relevant consultation details, consent information and associated clinical records.

You may withdraw consent, but this will not affect processing that was lawful before withdrawal. We may still need to retain certain records where required for safety, insurance, legal or professional reasons. Without necessary health information, we may be unable to assess suitability or provide a requested service.

5. Why we use personal information

We use personal information to respond to enquiries; arrange consultations, appointments and Home Visits; assess suitability; provide and document services; obtain independent prescriber input where required; provide appointment reminders, aftercare, follow-up and review communications; manage payments and refunds; maintain clinical, financial and business records; respond to complaints; protect clients and the business; prevent misuse of the website; and meet legal, insurance, professional and regulatory obligations.

Service communications may be sent by email, SMS, telephone, WhatsApp or post where appropriate. Please do not send unnecessary detailed medical information through the general website form, ordinary email, SMS or WhatsApp. We will use or request a more appropriate route where needed.

6. Our lawful bases

Depending on the purpose, our lawful bases under UK data protection law are: taking steps at your request before entering into a contract; performing our contract with you; complying with a legal obligation; our legitimate interests in operating, securing and administering the business, keeping appropriate records, handling complaints and protecting legal rights; and consent where required.

Marketing emails and newsletters will only be sent where we have the required permission. Marketing permission is separate from treatment consent and may be withdrawn at any time. Optional permission to use photographs or content for social media is also collected separately.

7. Who we may share information with

We only share information where it is necessary and lawful. Recipients may include authorised administrative staff and other authorised staff members; registered prescribers; pharmacies and medical suppliers; VISN as our website-hosting provider; Faces Consent for prescription and prescriber-related records; business email, secure backup and cloud-storage providers, including business accounts with Apple iCloud, Google Drive and Microsoft OneDrive; a selected payment provider; and other suppliers that help us operate securely.

Our accountant or bookkeeper may receive financial and transaction information but would not normally receive medical or treatment records. We may also share relevant information with our professional insurer, professional or legal advisers, regulators, courts, the ICO or other authorities where required.

Information may be shared with a GP or another healthcare professional only where necessary and when suitable details are available; this is not routine. Information may be shared with emergency services, or with a nominated next of kin, when necessary to protect health or life or where you have authorised us to do so.

We do not sell personal information.

8. International transfers

Some technology and cloud-service providers may process or support information from outside the United Kingdom. Where this occurs, we take reasonable steps to use providers that apply an appropriate UK transfer safeguard, such as a UK adequacy regulation or approved contractual protections.

9. Different locations and Home Visits

Appointments may take place at different suitable locations or, for selected appointments, at a client's home. A Home Visit address is treated as personal information and is recorded only where needed. We aim to maintain privacy and appropriate record handling regardless of appointment location.

10. How long we keep information

We keep personal information only for as long as necessary, taking account of clinical safety, insurance, tax, legal, professional and regulatory requirements. Our usual periods are:

• general enquiries that do not proceed to a consultation or treatment: 12 months;
• consultation, consent, health, clinical, treatment, prescriber and associated photographic records: eight years after the last consultation or treatment, unless a longer period is required;
• financial and transaction records: six years;
• marketing information: while you remain subscribed, together with the minimum information needed after an opt-out to ensure that your preference is respected; and
• social-media permission: until it is withdrawn, subject to any record we reasonably need to show what was authorised.

If social-media permission is withdrawn, we will stop future use and take reasonable steps concerning content under our control. We cannot control copies already shared or republished by other people.

11. Security and storage

We use reasonable organisational and technical measures intended to protect personal information. These include locked storage for paper records; password-protected computers, phones and tablets; restricted access; business accounts; secure backups; and reputable hosted or cloud services. Faces Consent states that information held through its service is encrypted in transit and at rest on UK-based infrastructure.

No website, email system or online service can be guaranteed completely secure. Please keep your own account and communication details secure and tell us promptly if you believe information has been sent to the wrong person or accessed without permission.

12. Cookies and website services

Our website uses cookies and similar technologies. Strictly necessary cookies may operate without optional consent where permitted. Non-essential analytics, advertising or similar cookies should only operate after the required consent has been obtained. The services currently operating on the website will be confirmed through our cookie audit and described in our Cookie Policy.

13. Your data-protection rights

Depending on the circumstances, you may have rights to request access to your information, correction, erasure, restriction, objection and data portability. Where processing relies on consent, you may withdraw that consent. These rights are subject to legal exceptions, and we may need to verify your identity before responding.

To make a request, use our Contact / Enquiry page and state that your message concerns data protection. We normally respond within one month, although the law allows additional time in certain circumstances.

14. Complaints about data protection

Please contact us first if you have a privacy concern so that we have an opportunity to investigate. You also have the right to complain to the Information Commissioner's Office. Information about making a complaint is available at ico.org.uk/make-a-complaint.

15. Changes to this policy

We may update this policy when our services, suppliers, systems or legal obligations change. Please check this page for the current version.

Last reviewed: 11 August 2026.