Privacy Policy

Last updated: 20 October 2026

Who we are

Next Gen Skin is a private skin clinic in Blythe Bridge, Stoke-on-Trent, run by Tammy Savigar-Boon as a sole trader. For the personal data described here, Tammy is the data controller: the person responsible for deciding how it is used and for keeping it safe.

For anything about your data, email [email protected].

Our address is 37 Sutherland Crescent, Blythe Bridge, Stoke-on-Trent, ST11 9JT. We are registering with the Information Commissioner’s Office (ICO), and our registration number will appear here once it is issued.

What this policy covers

This website, the enquiries you send through it, and the online shop. Appointments are booked through Fresha, which has its own privacy policy.

It also covers your clinic records: your consultation form, treatment notes and any photographs taken in clinic. We use these only to plan and carry out your treatment safely, and keep them for 12 months after your last appointment.

What we collect, and why

When you send an enquiry or request a consultation

Your name, email address, phone number, your message and, if you choose to tell us, your main skin concern. We use these only to reply to you and to arrange an appointment you have asked about. If you reached the page from a campaign link, we also receive the campaign name from that link, so we know which adverts work.

A skin concern can be information about your health, which the law protects more strictly. That question is optional. If you answer it, we rely on your explicit consent, given by choosing to share it, and you can withdraw it at any time. For the rest of an enquiry we rely on your request: you have asked us to respond before any booking is made.

When you join the mailing list or the shop waiting list

Your email address, used only to send what you signed up for. We rely on your consent, and every email lets you unsubscribe. The contact forms also have an optional box for occasional skin tips and offers; we only send you those if you tick it.

When you ask for your own shop login

Your name and email address. We email Tammy so she can approve you, then email you a link that logs you in. We keep them on a list of people with shop access, so you can ask for a new link on another device. We rely on your request: you have asked for access.

When you buy from the shop

Payment is taken by Stripe. You enter your card details on Stripe’s own page, and we never see or store your card number. Stripe passes us your name, email address, delivery address and what you ordered, so that we can send it. We use this to fulfil your order, and keep the order record because the law requires businesses to keep financial records.

When you simply visit

The site is hosted by Cloudflare, which processes technical information such as your IP address and browser type to deliver pages and protect the site from attack. We use no analytics, no advertising tracking and no social media pixels.

Cookies and storage on your device

The site stores only what it needs to work, so it does not ask for cookie consent.

• Shop access cookie (ngs_shop). Set only when you enter a client access code or open your own login link, so that the shop stays open for you. It lasts until the code expires, and at most four months.
• Your basket, kept in your browser’s own storage so it survives a page reload. It never leaves your device until you check out.

Stripe and Fresha set their own cookies on their own pages.

Who else sees your data

Only the services that run the business on our behalf:

• Cloudflare hosts the website and processes the forms.
• Google provides our email, where your enquiries arrive.
• Resend sends your website enquiries to our inbox, and sends the shop-access emails.
• Stripe takes payment for shop orders.
• Fresha takes appointment bookings and holds the booking details.

We never sell your data or share it for marketing. Some of these providers process data outside the UK; where they do, they use the legal safeguards UK law requires, such as approved data transfer agreements.

How long we keep it

• Enquiries that do not lead to an appointment: 12 months, then deleted.
• Shop login requests Tammy has not approved: 30 days, then deleted automatically.
• Shop logins: for as long as you have access. Tammy can remove you, or you can ask her to.
• Clinic records and photographs: 12 months after your last appointment, then deleted.
• Mailing list: until you unsubscribe.
• Shop orders: six years, as financial records must be kept for HMRC.

Your rights

You can ask us, free of charge, to:

• give you a copy of the personal data we hold about you;
• correct anything that is wrong;
• delete your data, where we do not need to keep it by law;
• stop or limit how we use it, or object to a use;
• send it to you or to someone else in a portable format;
• withdraw a consent you have given, at any time.

Email [email protected] and we will respond within one month.

Under 18s

Our treatments are for adults only, and we do not knowingly collect data from anyone under 18.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Changes to this policy

If we change how we use your data, we will update this page and the date at the top.