Privacy Policy

1. Who is responsible for your information

Sunny Rejuvenation is the data controller for the personal information described in this policy. That means we decide what is collected and what it is used for, and we are responsible for looking after it.

• Controller: Sunny Rejuvenation
• Website: sunnyrejuvenation.uk
• Data protection contact: sunnyrejuvenation@gmail.com
• Phone: 07916 624003

This policy is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What information we collect

When you use a form on this website

The booking form on the contact page collects your name, email address, phone number (optional), the area of interest you select (optional), and anything you write in the message box. The CalerieLife enquiry form collects the same details plus the products you tick.

Please keep the message box to practical details — preferred times, general questions. There is no need to describe your medical history in it; that is discussed properly at consultation.

When you contact us directly

If you phone, text, email or message us, we hold whatever you choose to tell us, along with your contact details.

When you become a client

Before and during treatment we record a health and medical history, details of consent, the treatments carried out, aftercare given, and any follow-up. With your separate written consent we may also take before-and-after photographs.

Automatically, when you visit the site

Our host and analytics provider record technical information such as the pages visited, approximate country, referring site, browser type and IP address (see section 5).

3. Why we use it, and our legal basis

• To reply to your enquiry and arrange an appointment. Legal basis: taking steps at your request before entering a contract, and our legitimate interest in responding to people who contact us.
• To provide the treatment you have booked, and to keep clinical records. Legal basis: performance of our contract with you; and for health information, Article 9(2)(h) UK GDPR — the provision of health care by a professional bound by a duty of confidentiality.
• To send you a booking confirmation and a cancellation link. Legal basis: performance of our contract with you.
• To take payment and keep financial records. Legal basis: contract, and our legal obligation to keep tax records.
• To answer product enquiries about the CalerieLife range. Legal basis: steps taken at your request, and our legitimate interest in running the business.
• To keep the website working, secure and free of spam (including the hidden anti-spam field on our forms). Legal basis: our legitimate interest in protecting the site.
• To understand, in aggregate, how the site is used. Legal basis: our legitimate interest in improving the site, using analytics that do not identify you individually.

We do not sell your information, we do not share it for anyone else's marketing, and we do not send marketing emails from this website. Any use of your details for marketing in future would happen only with your consent, and you could withdraw that consent at any time.

4. Health information

Health information is "special category" data and is treated with particular care. It is collected only where it is needed to treat you safely, it is kept confidential, and access is limited to Sunny.

As a nurse registered with the Nursing and Midwifery Council, Sunny is bound by professional duties of confidentiality and record-keeping in addition to data protection law.

Photographs of your treatment are only taken and only used with your separate, specific written consent, which you can withdraw at any time.

5. The website, cookies and analytics

Cookies. This site sets no advertising or tracking cookies, which is why you are not asked to accept a cookie banner. The only thing stored on your device is a small localStorage entry (sunnyLangChosen) that remembers whether you chose English or 中文, so the language prompt is not shown to you again. You can clear it at any time through your browser settings.

Hosting. The site is hosted by Vercel Inc. Vercel processes standard server request data, including IP addresses, in order to serve pages and protect the service.

Analytics. We use Vercel Web Analytics, which measures page views without cookies and without building a profile of you or following you across other websites.

Fonts. Typefaces are loaded from Google Fonts. This means your browser makes a request to Google's servers, which discloses your IP address to Google.

Cancellation links. There is no client database behind this website. Your booking details travel inside the cancellation link itself, encoded and signed cryptographically so the link cannot be altered or forged. Please treat your confirmation email as private, since anyone holding that link could cancel that booking.

6. Who we share your information with

We share personal information only where we need to:

• Vercel Inc. — website hosting and analytics.
• Google (Gmail) — delivery and storage of the emails generated by our forms, and our own correspondence with you.
• Our insurers, accountant or professional advisers — where genuinely necessary, for example in the event of a claim or a tax enquiry.
• Regulators, the police or the courts — where we are legally required to disclose information, or where there is a serious safeguarding concern.
• Another healthcare professional — for example your GP, and normally only with your consent, unless there is an urgent clinical or safeguarding reason.

We never sell or rent your information to anyone.

7. How long we keep it

• Enquiries that do not lead to a booking — up to 12 months, then deleted.
• Clinical and consent records — normally 8 years after your last treatment, in line with professional record-keeping guidance. Records relating to a person under 18 are kept until their 25th birthday.
• Financial records — 6 years, as required for tax.
• Consented photographs — until you withdraw consent, or until they are no longer needed.
• Website analytics — aggregate figures only, retained by our analytics provider on their standard schedule.

8. How we keep it safe

The website is served over HTTPS, and forms are submitted encrypted in transit. Paper records are kept locked away; digital records are held on password-protected, access-controlled accounts. Only Sunny has routine access to client records.

No system can be guaranteed completely secure. If a breach were ever to put your rights at risk, we would tell you and report it to the Information Commissioner's Office as the law requires.

9. Information sent outside the UK

Vercel and Google are US-headquartered, so some information may be processed outside the UK. Where it is, transfers are covered by the safeguards permitted under UK data protection law — an adequacy decision, or standard contractual clauses with the UK addendum.

10. Your rights

Under UK data protection law you have the right to:

• ask what personal information we hold about you and receive a copy;
• have inaccurate information corrected;
• ask us to delete information, where there is no overriding reason to keep it (clinical records usually must be kept for their full retention period);
• ask us to restrict how we use your information, or object to us using it on the basis of legitimate interests;
• ask for the information you gave us to be provided in a portable format;
• withdraw consent at any time, where we relied on your consent — for example for photographs.

To exercise any of these, email sunnyrejuvenation@gmail.com. We will respond within one month, and there is no charge. We may ask you to confirm your identity first, so that we do not disclose your records to someone else.

11. Children

Our services and this website are intended for adults. We do not knowingly collect information about anyone under 18 through this website. Where a young person is treated, that happens with appropriate consent and their records are kept as set out in section 7.

12. Complaints

If you are unhappy with how we have handled your information, please tell us first — we would like the chance to put it right. You also have the right to complain to the UK's data protection regulator:

• Information Commissioner's Office
• Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
• Helpline: 0303 123 1113
• ico.org.uk/make-a-complaint

13. Changes to this policy

We may update this policy as the site or our services change. The date at the top of this page shows when it was last revised. Please also see our Terms & Conditions.