Privacy Policy

1. Who we are

Covered Beauty is a trading name of HAMR Ltd, a company registered in England and Wales (Companies House No. 17190046). Registered office: 25 Lowther Street, Whitehaven, CA28 7DG.

For all data protection enquiries please contact us at hello@covered.technology.

2. Our role under UK GDPR

Where you are a salon or clinic operator using Covered Beauty to manage your business, you are the data controller for your clients’ personal data. We are your data processor, processing that data only on your documented instructions under our Data Processing Agreement.

For our own corporate data, including our subscriber records, billing data, marketing communications and website analytics, HAMR Ltd is the data controller and this notice describes how we act in that capacity.

3. What we collect and why

From salon operators (our subscribers)

Name, email address, mobile number, login activity, role within the salon, to operate your account.
Where you heard about us, which you tell us when you sign up (and, if you like, what you asked an AI app), plus the website that sent you and the first page of ours you opened, so we know which ways of finding us work.
Salon profile, branding, opening hours, treatment menu, prices, to render your booking page.
Billing details handled by Stripe Payments Europe Ltd. (we do not store card numbers).
Support correspondence and audit logs of administrative actions.
If you use Help chat (Chat with us) in the dashboard: what you write there, when you started the chat, and our replies. This is our own support correspondence with you, like an email to us, so HAMR Ltd is its controller. To answer, we use our help pages and your salon’s setup details: its name and booking link, plan and subscription status (and when a free trial ends), what it takes bookings for, treatments, opening hours, deposit and cancellation settings, forms, whether card payments are on and the owner’s email is confirmed, how many team members and venues it has, whether the person asking is the owner or a team member, and whether they’re using the website or the app. Our replies there are written by an AI service from Anthropic (see section 9), and Dean reads every chat and replies himself whenever it needs him. We don’t send your client records to Help chat, and we ask you not to type clients’ details into it.
If you use the Covered Beauty Salon app for iPhone or iPad and allow notifications: a push notification token for your device, issued by Apple, linked to your login and salon, so we can send you alerts about your bookings. We use it for nothing else. It’s deleted when you sign out of the app, delete your account or are removed from the salon, and it stops working if you delete the app. The app shows this website, so everything else in this policy applies to it in the same way.

From end clients (booking through a salon)

Name, email address, phone number, appointment history.
Responses to medical history and consent forms, which can include special category data concerning health under UK GDPR Article 9. We collect this only where the salon requires it for safe treatment, on the basis of your explicit consent at the time of booking.
Payment intent identifiers from Stripe (no card data).
Cancellation and review activity tied to your appointment.
Whether you chose to get booking messages on WhatsApp, and when. If you did, your booking confirmation, reminder and any changes are sent from the salon’s own WhatsApp number through WhatsApp (Meta), and we keep a record of each message’s delivery status for 90 days. While a salon’s number is connected, WhatsApp also passes its other chats to us; we discard them without reading or storing them.

From all visitors to beauty.covered.technology

Strictly necessary cookies for authentication and remembering this notice (see our cookie policy).
Server logs (IP address, user agent, request path, status code) retained for security monitoring for up to 30 days.
If you allow analytics cookies, Google Analytics receives visits to our public marketing pages and clicks on trial buttons, along with device, browser and cookie identifier information. We exclude the sign-up and login pages, dashboard, client booking pages and salon subdomains. We do not send form contents, client records or payment details. You can withdraw this consent through Manage cookies.

4. Lawful basis for each processing activity

Activity	Lawful basis (UK GDPR Art. 6)
Provide the booking platform to salons	Contract (Art. 6(1)(b))
Process bookings, deposits and reminders for end clients	Contract (Art. 6(1)(b)), between client and salon
Store medical / consent form responses	Explicit consent (Art. 6(1)(a) and Art. 9(2)(a))
Send transactional service emails (booking confirmation, reminders)	Legitimate interest and contract performance (Art. 6(1)(b), 6(1)(f))
Send booking messages by text, or on WhatsApp where you chose it	Contract performance and legitimate interest (Art. 6(1)(b), 6(1)(f))
Send booking alerts to salon staff in the Covered Beauty Salon app, where they allowed notifications	Contract performance (Art. 6(1)(b))
Send marketing emails to salon operators about Covered Beauty	Consent (soft opt-in) (Art. 6(1)(a))
Email salon operators about their account, including a monthly summary of their own numbers	Contract and legitimate interest (Art. 6(1)(b), 6(1)(f))
Ask salons where they heard about us, and note the website that sent them and the first page of ours they opened, to learn which ways of finding us work	Legitimate interest (Art. 6(1)(f))
Answer salon owners' and staff's questions in Help chat	Contract performance and legitimate interest (Art. 6(1)(b), 6(1)(f))
Retain financial records	Legal obligation (HMRC, Art. 6(1)(c))
Detect fraud and abuse, log security events	Legitimate interest (Art. 6(1)(f))
Optional Google Analytics on the public marketing website	Consent (Art. 6(1)(a))

5. Special category data (health)

Medical history and consent form responses are special category personal data concerning health under Article 9 of the UK GDPR. We process this category of data only where the client has given explicit consent on the form itself, when they fill it in, and only for the purpose of allowing the salon or clinic to treat them safely. We do not use health data for marketing, profiling or any automated decision-making.

If a salon sends you a form to fill in, the link is just for you and works for up to 14 days. When the salon asks us to, we email it to you on their behalf.

Health data is encrypted at rest and in transit, version-locked to the consent form schema in force at the time of submission, and signed by the client. Access inside the salon is restricted to staff members the salon owner has explicitly granted access to via our role-based permission system.

6. Where your data is stored

Optional website analytics is processed by Google and may be processed outside the UK. Google’s data processing terms describe its processing and international transfer arrangements. This analytics service is separate from storage of salon and client records.

All databases and file storage are hosted in the United Kingdom (London). Some sub-processors (notably Vercel and Resend) may transfer data outside the UK; in those cases transfers are protected by the UK Addendum to the EU Standard Contractual Clauses. See our sub-processor list for the full chain. Help chat messages are also processed in the United States, by Anthropic, with the same safeguards (see section 9).

7. How long we keep your data

Optional Google Analytics user and event data is set to a two-month retention period, without restarting that period when you return. Aggregated standard reports may be kept for longer. Analytics cookies expire within 12 months and can be removed through Manage cookies.

Active client records: for as long as the salon operates its account with us, plus up to 5 years if the client has not booked or filled in a form again (after which we anonymise unless financial records require retention).
Medical and consent form answers: 7 years from the date of the appointment they were for or, for a form filled in without a booking, the date it was signed, in line with UK aesthetics insurance and clinical-records norms, while the salon’s account is open. When a salon’s account ends, it has 30 days to export its data, as section 9 of our terms says, after which its data, signed forms included, can be deleted, apart from records the law requires us to keep. If its only owner deletes their account, its data is deleted straight away (see Deleting your account below). Salons should export their records before they close.
Financial records (payments, refunds, invoices): 7 years to comply with HMRC requirements.
Audit log of administrative actions: 2 years.
Help chat messages: kept while the salon’s account is open, and deleted with it. They stay with the salon if the team member who wrote them leaves or deletes their login.
Server logs: 30 days.

When you exercise your right to erasure (see below), we anonymise personal data within the records that legal obligations require us to retain. We cannot delete the financial record entirely, but the personal identifiers are stripped and replaced with a pseudonymous reference.

8. Your rights under UK GDPR

You have the following rights at any time:

Right of access: ask for a copy of the personal data we hold about you (Art. 15).
Right to rectification: correct inaccurate or incomplete data (Art. 16).
Right to erasure: have your personal data deleted, subject to legal retention requirements (Art. 17).
Right to restrict processing: pause certain processing while a dispute is resolved (Art. 18).
Right to data portability: receive your data in a structured, machine-readable format (Art. 20).
Right to object: object to processing based on legitimate interest, including marketing (Art. 21).
Right not to be subject to automated decision-making: we do not make any automated decisions that produce legal or similarly significant effects about you. Our optional rebooking-reminder emails (which suggest when you might be due for a follow-up appointment) are purely informational and you can opt out at any time using the unsubscribe link in the email (Art. 22).
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, email us at hello@covered.technology. If you are an end client of a salon using Covered Beauty, please contact the salon directly first. They are the data controller and we act on their instructions. We will respond to all requests within one calendar month.

Deleting your account: salon owners and staff can delete their own login at any time, on the website or in the Covered Beauty Salon app. Open Your account (in Settings, or on a phone tap More, then Manage account), pick a reason, type DELETE and confirm. It happens straight away. If you’re the only owner of a salon, the salon is deleted too, with its appointments, clients, treatments, forms and reports. If you’re staff, only your login and access are removed and the salon’s records stay with the salon. You can also email us to ask for your account to be deleted.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office at any time: ico.org.uk/make-a-complaint.

9. Sub-processors

We use a small set of carefully chosen sub-processors to operate the platform. Each is bound by a Data Processing Agreement and has been assessed for technical and organisational security measures. The full, up-to-date list lives at beauty.covered.technology/subprocessors. We notify subscribers of any new sub-processor at least 30 days before the change takes effect.

Our own support providers. Some services help us run our own support for salon owners and staff, not the client data we process for salons, so they aren’t sub-processors under our Data Processing Agreement and aren’t on that list. For Help chat, the support chat in the salon dashboard, we use Anthropic, PBC (Claude), an AI service that writes our answers to support questions. It receives the help chat messages salon owners and staff write, our earlier replies in that chat, and the salon’s setup details listed in section 3. It processes them in the United States. Those transfers are protected by the UK Addendum to the EU Standard Contractual Clauses, and under its commercial terms Anthropic doesn’t use them to train its models. We don’t send it client records, and we ask everyone not to share clients’ details in the chat.

10. Security

We follow controls aligned with ISO/IEC 27001:2022. Highlights include HTTPS everywhere with HSTS, encryption at rest in our databases and file storage, role-based access control with least-privilege defaults, multi-factor sign-in for administrators, restrictive content security policy, audit logging of every data-changing action, and a defined incident response process. We accept responsible-disclosure reports at hello@covered.technology (see also our security.txt).

11. Children

The Covered Beauty platform is not intended for use by anyone under the age of 16. Where a salon offers treatments to minors, it must obtain appropriate parental or guardian consent in accordance with its own clinical and safeguarding policies.

This does not apply to sunbeds. Under the Sunbeds (Regulation) Act 2010 (and equivalent law in Scotland, Wales and Northern Ireland) it is unlawful for anyone under 18 to use a sunbed, and parental consent does not change that. A salon must never permit under-18s to use a sunbed under any circumstances.

12. Salons we write to

We sometimes post a card or send an email to beauty businesses that might want Covered Beauty. If you got one, this is how we handle your details.

What we hold: your business name, business address or business email, website, town and, if your website shows one, your logo. We don’t collect owners’ names or personal phone numbers.

Where we got them: your own website, public business listings, OpenStreetMap (© OpenStreetMap contributors) and, for companies, Companies House.

Why: to tell you about Covered Beauty. Our lawful basis is legitimate interests: we’re a UK business writing to other businesses about a product for their work.

The code on your card or the link in our email: if you scan or click it, we record that, the pages you look at on our site, and whether you sign up, so we know what works. We delete those records after 90 days.

How long we keep your details: if you don’t sign up, we delete them within 90 days of our last contact. If you ask us not to contact you, we keep just enough to make sure we never do.

Who sees them: only us and the companies that run our systems: Supabase (database), Vercel (hosting), Google Workspace and Instantly (email) and our printer. Where a supplier is outside the UK, we use the safeguards UK law requires.

Your rights: ask what we hold, ask us to correct or delete it, or object, and we’ll stop straight away. Email hello@covered.technology. You can also complain to the ICO at ico.org.uk.

13. Changes to this policy

We may update this policy from time to time. Material changes will be announced by email to subscribers at least 30 days before they take effect. The “last updated” date at the top of this page always reflects the current version.