Privacy Notice — The Skin Advisory

Last updated: 24 October 2026

1. Who we are

The Skin Advisory ("we", "us") is an online dermatology service provided by Ivnit Kaur Bagga and Ersa Tsoutsoura, Specialist Dermatology Pharmacist Independent Prescribers registered with the General Pharmaceutical Council.

Ivnit and Ersa are joint controllers of the information you send through our enquiry form. If you go on to have a consultation, the clinician who provides your care is the controller of your clinical record. Both follow the same privacy practices, described in this notice.

Data protection contact: privacy@theskinadvisory.com

2. The information we collect

When you make an enquiry, we collect the details you provide: your name, email address, phone number (if given), the skin concern you select, what you tell us about your skin and history, and whether you already have a diagnosis.

If you go on to have a consultation, we also collect: a fuller medical history, current medicines and allergies, previous treatments, photographs of your skin, and the clinical records created during and after your consultation (assessment, treatment plan, prescriptions, correspondence).

When you use this website, our hosting provider keeps standard server logs (including your IP address and browser type) for security and reliability. We do not use cookies or analytics — see section 9.

3. Health information (special category data)

Most of what you share with us is information about your health. UK data protection law treats this as "special category" data and requires additional protection. We only collect health information that is necessary to assess your enquiry and provide your care, we limit who can access it, and we hold it securely.

4. How we use your information, and our lawful basis

To respond to your enquiry and decide whether we can help — lawful basis: our legitimate interests and taking steps at your request prior to entering a contract; for health information, the provision of health care (UK GDPR Article 9(2)(h)).
To provide your consultation, treatment plan and any prescription — contract; and Article 9(2)(h) for health information.
To meet our professional, regulatory and legal obligations — legal obligation; and Article 9(2)(h)/(i) where relevant.
To manage complaints, safety concerns and clinical incidents — legal obligation and legitimate interests.
To improve and secure our service — legitimate interests.

5. Who we share it with

We share your information only where necessary:

A pharmacy you choose. If you are prescribed treatment, we issue the prescription to you directly, or send it to a pharmacy you nominate (by email or through an online prescription service). You decide which pharmacy dispenses it; we do not have a partner pharmacy.
Your GP or existing specialist, where this is important for safe prescribing and with your knowledge
Our service providers, who process data on our instructions under a written agreement:
- Website hosting, email, and enquiry-form delivery — Hostinger (Hostinger International Ltd), EU. Your enquiry is sent to and stored in our own mailbox on Hostinger; it is not passed to a separate email company.
- Anti-spam check on the enquiry form — Cloudflare Turnstile (Cloudflare, Inc.); this checks that the form is submitted by a person, not a bot, and does not use tracking cookies
- The video-call service used for your consultation — your clinician will tell you which one before your appointment. We only use services that encrypt calls and offer a written data-processing agreement.
- The payment provider your clinician uses to send you a payment link — it processes your payment details directly; we never see or store your card details
Regulators, or other bodies, where we are legally required to

We do not sell your information or use it for advertising.

6. Where your information is held

We aim to keep your information within the UK or the EU. If any provider stores or processes it outside the UK, we make sure an appropriate safeguard recognised under UK data protection law is in place.

7. How long we keep it

We keep your clinical records for the periods set out in the UK Records Management Code of Practice, which we follow as good practice for health records, alongside our professional obligations as prescribers:

Adult records — at least 8 years after your last treatment.
Records for children and young people — until the person's 25th birthday, or their 26th birthday if they were 17 when treatment ended.

Enquiry information that does not lead to a consultation is kept for a short period and then securely deleted. We may keep records for longer where we have a legal reason to do so.

8. Your rights

You have the right to ask us for a copy of your information, to correct it, to restrict or object to how we use it, and in some cases to have it deleted or transferred. Where we rely on consent, you can withdraw it at any time. To exercise any of these rights, contact us at privacy@theskinadvisory.com.

Some rights are limited where we have a legal or professional duty to keep clinical records.

9. Cookies and analytics

This website does not use cookies, and we do not use analytics, advertising or tracking tools. Our hosting provider keeps standard server logs (including IP addresses) to keep the site secure and running; these are not used to track or profile you. If we ever add cookies or analytics, we will update this notice and add a cookie banner first.

10. Changes to this notice

We may update this notice. We will change the "last updated" date above and, for significant changes, tell you directly where we can.

11. Contact and complaints

If you have a question or concern about how we handle your information, contact us first at privacy@theskinadvisory.com. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113.