Privacy Policy

1. Who We Are

LumiDerm Science, located at Unit 14, Ardkeen Retail Park, Dunmore Road, Waterford, X91 A2K4, Ireland, is the data controller responsible for the personal data described in this privacy policy. For the purposes of the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and the Irish Data Protection Acts 1988–2018, LumiDerm Science determines the purposes and means of the processing of your personal data.

2. Data We Collect

We may collect and process the following categories of personal data:

• Contact data: your name, email address, phone number and postal address, provided when you complete a contact or consultation form, book an appointment or contact us directly.
• Consultation data: information you share during skin analysis consultations, including details about your skin type, skin concerns, skincare routine, sensitivities, allergies and relevant medical or dermatological history that you choose to disclose.
• Transactional data: details of products or services purchased from us and records of payments (we do not store full payment card details; payments are processed by secure third-party payment providers).
• Technical data: internet protocol (IP) address, browser type and version, device type, operating system, referring URLs, pages visited and interaction data collected through cookies and similar technologies.
• Marketing and communications data: your preferences for receiving marketing communications from us and records of your consent choices.

3. How We Use Your Data

We use your personal data for the following purposes:

Purpose	Legal basis (GDPR)
Responding to enquiries and providing consultations	Performance of a contract or steps prior to entering into a contract (Art. 6(1)(b))
Providing personalised skincare advice and maintaining consultation records	Performance of a contract (Art. 6(1)(b)); consent for any health-related data you volunteer (Art. 6(1)(a) and Art. 9(2)(a))
Processing orders, payments and delivering products	Performance of a contract (Art. 6(1)(b))
Sending marketing communications where you have opted in	Consent (Art. 6(1)(a))
Analysing website usage and improving our services	Legitimate interests (Art. 6(1)(f)) and consent for non-essential cookies
Complying with legal, tax and regulatory obligations	Legal obligation (Art. 6(1)(c))

We will never sell your personal data to third parties, and we do not use your information for any automated decision-making or profiling that produces legal effects concerning you.

4. Special Category Data

During consultations, you may choose to share information about skin conditions, allergies or treatments that constitutes health-related data (a special category of personal data under Article 9 GDPR). We process such data only with your explicit consent, which you provide when disclosing this information during a consultation, and solely for the purpose of providing safe and appropriate skincare advice. You may withdraw this consent at any time by contacting us.

5. Cookies and Similar Technologies

Our website uses cookies to ensure it functions correctly, to remember your preferences and, subject to your consent, to analyse site traffic and support marketing activities. Essential cookies are required for the website to operate and cannot be disabled. Analytics and marketing cookies are only placed after you give consent through our cookie consent banner, and you may change your preferences at any time. For full details, please refer to our Cookies Policy.

6. Sharing Your Data

We share personal data only where necessary and with appropriate safeguards in place:

• Service providers: trusted third parties who host our website, process payments, deliver products or provide email and scheduling services. These processors act under contract and may process data only on our documented instructions.
• Professional advisers: accountants, auditors and legal advisers, where reasonably required.
• Authorities: law enforcement, tax or regulatory bodies, where we are legally required to disclose information.

All third-party processors are bound by data processing agreements compliant with Article 28 GDPR, and where data is transferred outside the European Economic Area (EEA), we ensure an adequate level of protection through adequacy decisions or Standard Contractual Clauses approved by the European Commission.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Contact form enquiries: up to 12 months after our last correspondence.
• Consultation records: up to 7 years after your last appointment, to meet professional, insurance and legal requirements.
• Transaction and accounting records: 6 years, as required by Irish tax law.
• Marketing consent records: until you withdraw consent, plus 2 years to demonstrate compliance.
• Cookie preference data: up to 180 days.

8. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — to request a copy of the personal data we hold about you.
• Right to rectification — to have inaccurate or incomplete data corrected.
• Right to erasure — to request deletion of your data where there is no compelling legal reason for us to retain it.
• Right to restrict processing — to ask us to suspend processing in certain circumstances.
• Right to data portability — to receive your data in a structured, commonly used, machine-readable format.
• Right to object — to object to processing based on legitimate interests or to processing for direct marketing at any time.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at [email protected]. We will respond within one month of receiving your request. If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland.

9. Security of Your Data

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure. These measures include encryption of data in transit, access controls limited to authorised personnel, secure storage of consultation records and regular review of our security practices. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours and inform affected individuals where required by law.

10. Children's Privacy

Our services are directed at adults. We do not knowingly collect personal data from individuals under the age of 16 without verifiable parental or guardian consent. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, services or legal requirements. The latest version will always be published on this page with an updated revision date. Where changes are significant, we will notify you by email or through a notice on our website before the changes take effect.

12. Contact Us