Privacy policy

Who looks after my data?

The data controller is MIRABELL COSMETOLOGY LIMITED, trading as Mirabell Aesthetics and Mirabell Academy.

• Company registration (CRO) number: 794405
• Registered office: Dolcan House, 78/80 Tower Road, Clondalkin, Dublin, D22 N6F6
• Clinic and academy: Dolcan House, 78/80 Tower Road, Clondalkin, Dublin, D22 N6F6, Ireland
• Phone and WhatsApp: +353 85 186 5581
• Email for privacy questions: hello@mirabellaesthetics.ie

We are a small business and have not appointed a Data Protection Officer, because the law does not require one for a business of our size and type. Our owner is responsible for data protection and answers every privacy request personally.

What is the short version?

• We collect what we need to book you, treat you safely, sell to you and train you. Nothing more.
• Your health information is only used to keep you safe during treatment. It is never used for marketing.
• Clinical photos for your records and photos for our marketing are two separate things. We never show your photos publicly without your separate written consent.
• We never sell your data.
• Payments are handled by Wix Payments. We never see or store your full card number.
• Mira, our website assistant, is an AI. Do not share health details with Mira; tell us in person instead.
• You can ask to see, correct or delete your data at any time, and you can complain to the Data Protection Commission.

What do you collect, and why?

3.1 Booking an appointment

What: name, email, phone number, the treatment, date and time, deposit or payment status, booking history, cancellations and no-shows, and any message you add. Why: to make and manage your booking, send confirmations and reminders, apply our booking policy, and contact you about your appointment. Legal basis: contract (Article 6(1)(b) GDPR). Keeping a record of late cancellations and no-shows to apply our booking policy is our legitimate interest (Article 6(1)(f)).

Health and consent form: our online booking does not ask health questions. Your health and consent form is filled in with us in clinic before your treatment. These answers are health data: we use them only to check that a treatment is safe for you, with your explicit consent (Article 9(2)(a)), and keep them in your client record.

3.2 Consultation, medical history and consent forms

What: your date of birth, medical history, medicines, allergies, skin type, pregnancy or breastfeeding, previous treatments, patch test results, the treatment plan, the products, batch numbers and amounts used, your signed consent, aftercare given, and notes from follow-up visits. Why: to decide if a treatment is safe and suitable for you, carry it out safely, trace a product if there is ever a product recall, give you aftercare, and deal with any complaint or claim. Legal basis:

• Article 6: contract (6(1)(b)) to give you the treatment you asked for, and legitimate interest (6(1)(f)) to keep accurate records that protect you and us.
• Article 9 (health data is special category data): your explicit consent (Article 9(2)(a)), which you give on the consultation form. We also keep these records to establish, exercise or defend legal claims (Article 9(2)(f)).

You do not have to give us this information. But if you do not, or if you withdraw your consent, we cannot safely treat you, and we will not go ahead with the treatment. Withdrawing consent does not make us delete records we must keep to defend a claim (see the retention table).

3.3 Photos

We take two kinds of photos, and they are completely separate.

Marketing photos in detail:

• You choose what we may use: face visible or not, and where (website, social media, adverts, teaching).
• Photos are genuine and not edited apart from cropping. Before and after photos are taken in the same light, from the same angle, with a relaxed face. We do not retouch results.
• You can withdraw consent at any time. We remove the photo from our website and accounts within 14 days and do not use it again. We cannot recall copies that other people have already shared or saved, and printed material already produced may stay in use until it runs out.

3.4 Payments

What: amount, date, what you paid for, the last four digits and type of card, and whether payment succeeded. Who processes it: Wix Payments (provided in Ireland through Adyen N.V. as the payment processor) and, if we offer them, other payment options shown at checkout. Card details go straight to the payment provider. We never see or store your full card number. Legal basis: contract (6(1)(b)) and our legal obligation to keep accounting and tax records (6(1)(c)). Payment providers also use data to prevent fraud, as independent controllers under their own privacy policies.

3.5 Online shop orders

What: name, delivery address, email, phone, items ordered, delivery and return details. Why: to deliver your order, handle returns and faults, and keep accounts. Legal basis: contract and legal obligation.

3.6 Gift vouchers

What: buyer name and email, recipient name and email, your personal message, the send date, the voucher code, value and balance. Why: to send the voucher, let the recipient use it, and keep track of the balance for the whole 5-year validity. Legal basis: contract and legal obligation. If you buy a voucher for someone, please only give us their details if you are sure they would be happy to receive it.

3.7 Newsletter and 10% welcome offer

What: email address, first name (optional), the date and way you signed up, and, if you agree when you sign up, whether you open our emails and click links in them. Why: to send your 10% welcome code and our news, offers and new treatments. Legal basis: your consent (6(1)(a) and Regulation 13 of S.I. 336/2011). Every email has an unsubscribe link. Unsubscribing is free and takes effect straight away. We never use health information to decide what marketing you receive.

3.8 Contact form, email, phone, WhatsApp and social media messages

What: what you tell us and your contact details. Why: to answer you. Legal basis: legitimate interest in replying, or steps before a contract at your request. Please do not send health details by WhatsApp, social media or the contact form. If you do, we only use them to answer you and move anything clinical to your secure client record. WhatsApp is provided by WhatsApp Ireland Limited (Meta). When you message us there, WhatsApp also processes your data under its own policy.

3.9 Mira, our AI assistant

Mira is an AI assistant, not a person. Every chat window says so before you start (EU AI Act, Article 50).

• What Mira processes: the messages you type and Mira's replies, plus basic technical data (time, page).
• Why: to answer questions about treatments, prices, opening hours, courses and bookings, and to pass you to WhatsApp or booking.
• Health information: Mira gives general information, not medical advice. Please do not share health details with Mira. If you do, they are only used to answer you in that chat.
• Storage: we do not keep chat transcripts. Our AI provider, Anthropic, processes each message to create the reply and keeps it for no more than 30 days for safety and abuse checks, then deletes it.
• Urgent aftercare problems: if you tell Mira about a problem after a treatment, Mira asks whether it may send that chat to our team so we can check on you. Only if you say yes, the chat and the name and phone number you give are emailed to the clinic and kept with your client record, like any other aftercare contact. If you say no, nothing is sent. Legal basis: your explicit consent (Article 9(2)(a) GDPR) and, where your health is at risk, your vital interests.
• Training: your chats are not used to train AI models, by us or by our provider.
• No decisions about you: Mira does not decide anything about you. It cannot book, cancel, refund or approve treatments.
• Legal basis: legitimate interest in answering questions quickly. Mira is set up to tell you not to share health details and to move health questions to a consultation. If you type health details anyway, we do not keep them; our provider deletes them as stated above.

3.10 Academy enquiries, applications and students

What: name, contact details, the course, your experience and existing qualifications, proof of qualifications, photo ID (to confirm identity and that you are 18 or over), payment details, attendance, assessment results, certificate number, feedback, and photos or videos of your practical work. Why: to check you meet the entry requirements, run the course, assess you, issue and verify your certificate, and offer Mirabell Circle graduate benefits. Legal basis: steps before a contract and contract; legal obligation for accounts; legitimate interest to verify certificates later (for example when an employer asks us). ID documents: we check your ID and record that we checked it, the type of ID and your date of birth. We delete any copy of the ID within 30 days of the check.

3.11 Training models

What: name, contact details, the treatment you are interested in, availability, your consultation and medical history, consent forms, and photos and videos of the treatment. Why: to screen you for suitability, carry out the training treatment safely under supervision, and assess the student. Photos and videos are a condition of a training treatment. They are needed to assess the student's work. You can refuse, but then the training treatment cannot go ahead. These training photos are only used inside the academy for assessment and training records. Using them publicly (website, social media, course materials) needs your separate consent, which you can refuse. Legal basis: contract, legitimate interest in running and assessing training, and explicit consent for health data and photos (Article 9(2)(a)).

3.12 Reviews

If you leave a review on Google or send us one, we may show your first name and review on our website. Where you sent it to us directly, we ask first.

3.13 Website and cookies

We use only essential cookies and browser storage: what the site needs for booking, forms and checkout to work, and to remember choices you make, like your language. We use no analytics, no advertising cookies and no tracking pixels. If we ever want to add any, we will ask for your consent first and update our policies. See our Cookie Policy. Our map is our own image, so no Google cookies are set by it.

How is my health information protected?

Health information is special category data. We protect it more than anything else:

• Only the practitioner treating you and the owner can see it.
• It is kept in our secure client records, never in WhatsApp chats, personal phones' camera rolls or email folders long term.
• Clinical photos are taken on a clinic device and moved to your secure record, then removed from the device.
• We never use health information for marketing, profiling or Mira.
• If you tell us you cannot attend for medical reasons, you do not need to say what the condition is. We do not ask for or keep medical certificates.

Do computers make decisions about me?

We do not make decisions about you by automated means that have legal or similarly significant effects. Our booking system may automatically apply the deposit rule shown before you book; a person reviews any dispute.

How long do you keep my data?

We keep data only as long as we need it. Then we delete it securely or anonymise it.

If a claim, complaint or investigation is ongoing, we keep the relevant records until it is finished.

Who do you share my data with?

We never sell your data. We share it only with the service providers below, who process it on our instructions under data processing agreements (Article 28 GDPR), or where the law requires.

We may also share data with An Garda Síochána, the HPRA, Revenue, a court, or another authority where the law requires it, and with a buyer of the business if it is ever sold (they would have to keep this policy).

Does my data leave the EU?

Some providers process data outside the European Economic Area. We only allow this with a legal safeguard:

• Israel (Wix.com Ltd): the European Commission has an adequacy decision for Israel.
• USA: providers certified under the EU-US Data Privacy Framework, or Standard Contractual Clauses approved by the European Commission, with extra safeguards where needed.

You can ask us for details of the safeguard used for any provider.

How do you keep my data safe?

Strong passwords and two-step login on every system that holds client data, access limited to the people who need it, encrypted systems, no client records on personal devices, and staff trained in confidentiality. If a data breach puts your rights at risk, we will tell you and the Data Protection Commission as the law requires.

What are my rights?

You have the right to:

• Access a copy of your data.
• Correct data that is wrong or incomplete.
• Delete your data, unless we must keep it (for example clinical records we need to defend a claim, or tax records).
• Restrict how we use your data while a question is resolved.
• Object to processing based on legitimate interest, and to direct marketing at any time.
• Portability: receive data you gave us, in a common format, where we use it based on consent or contract.
• Withdraw consent at any time. This does not affect what we did before. For health information, it means we cannot treat you.

To use a right, email hello@mirabellaesthetics.ie or ask us in clinic. It is free. We answer within one month (we can extend by two more months for complex requests and will tell you why). We may ask you to confirm your identity.

How do I complain about my data?

Please tell us first and we will try to fix it. You also have the right to complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, www.dataprotection.ie.

What about clients under 18?

Our treatments are for adults aged 18 and over. We do not treat anyone under 18, with one exception: when the practitioner considers a treatment suitable, with written consent from a parent or guardian, decided at a consultation the parent or guardian attends. For these clients, both the young person and the parent or guardian sign the consent for health information and clinical photos. We never use photos of anyone under 18 for marketing. We do not knowingly collect data online from anyone under 16, and our newsletter, Mira and shop are for adults.

Can this policy change?

We will update this policy when the law or our services change. The date at the top shows the latest version. If a change matters to you (for example a new use of your data), we will tell you by email before it applies.