MIRABELL

1. Who We Are

Mirabell Cosmetology Limited, trading as Mirabell Aesthetics, is the data controller responsible for your personal data.
Address: Dolcan House, 78/80 Tower Road, Clondalkin, Dublin 22, D22 N6F6
Email: mirabell.aesthetics.pmu@gmail.com
Phone: +353 85 186 5581
For any privacy or data-protection query, contact us using the details above.

​

2. What Data We Collect

Depending on how you interact with us, we may collect:

• Identity and contact details - name, email, phone number

• Booking and appointment details

• Health and lifestyle information relevant to your treatment (see section 4)

• Consultation, consent, patch-test and treatment records, including before-and-after photographs where required for clinical records

• Payment-related information (processed securely by our payment providers; we do not store full card details)

• Training course enrolment and model-treatment information

• Purchase history (in-clinic and online)

• Communications with us (messages, enquiries, reviews)

• Website and device data - cookies, analytics and usage data (see section 11)

​

​3. Why we use your data, and our lawful basis

To manage and confirm bookings and provide treatments - performance of a contract

• To assess suitability and treat you safely - explicit consent and, where relevant, provision of health care (Article 9(2)(a) and 9(2)(h) GDPR - see section 4)

• To process payments and product orders - performance of a contract

• To deliver training courses - performance of a contract

• To respond to enquiries -our legitimate interest in running our business, and consent where you contact us

• To send marketing or offers - your consent, withdrawable at any time (see section 10)

• To meet legal, regulatory, tax and insurance obligations - compliance with a legal obligation

• To improve our services and website - our legitimate interests, balanced against your rights

​

4. Health and other special-category data

Some treatments require us to collect health and medical information. This is "special category" data under Article 9 GDPR and receives extra protection. We process it only where necessary to assess your suitability, treat you safely, and keep accurate clinical records - relying on your explicit consent (Article 9(2)(a)) and, where relevant, the provision of treatment and care (Article 9(2)(h)). You may withdraw consent at any time, though this may mean we cannot safely provide certain treatments.

Where you tell us you are unable to attend an appointment for medical reasons, any health information you choose to share for that purpose is used only to manage your booking. You do not need to tell us the nature of a condition, and we do not ask for or retain medical certificates, letters or reports.

​

5. Providing your data

Providing accurate identity, contact and health information is necessary for us to treat you safely and lawfully. If you choose not to provide required information, we may be unable to proceed with a booking or treatment.

 

6. Consultation forms and clinical records

We may collect information through consultation, consent and medical-history forms completed digitally (including in-clinic on a tablet), online, by email, or through secure applications. This is used to assess suitability, ensure safety and maintain accurate records, and is stored securely using encrypted systems or trusted GDPR-compliant providers.

 

7. Training and model treatments

From time to time, treatments may be carried out by trainees under professional supervision. Clients taking part as models are informed in advance and their consent is obtained before proceeding.

​

8. Who we share your data with

We do not sell your personal data. We share it only where necessary with: booking and scheduling providers; payment processors; delivery and postal providers (for product orders); IT, website and hosting providers; and our insurers, professional advisers, or legal and regulatory authorities where required by law. All processors act on our instructions under written agreements requiring GDPR-level protection.

​​

9. International transfers

Some providers (for example website, analytics or communication platforms) may process data outside the European Economic Area. Where this happens, the transfer is protected by an EU adequacy decision or by Standard Contractual Clauses, so your data continues to receive an equivalent level of protection.

10. Marketing

Where you have consented, we may contact you with offers, news or updates. You can opt out at any time via the unsubscribe link in our emails or by contacting us. Withdrawing marketing consent does not affect treatment-related communications you need.

​

11.Cookies and analytics

Our website uses cookies and similar technologies. Strictly necessary cookies are required for the site to function. Analytics and marketing cookies (such as Google Analytics and the Meta pixel) are used only with your consent, which you give or manage through the cookie banner / "Privacy Preferences" on our website. You can also control cookies through your browser settings.

​

12. How we store and protect your data

We use appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration or misuse, and use trusted third-party providers who process data in line with GDPR. While we take reasonable steps to keep systems secure and reliable, no system can be guaranteed entirely error-free.

​

13. How long we keep your data

We keep personal data only as long as necessary for the purposes in this policy and to meet our legal, clinical, insurance and tax obligations. In particular:

• Treatment and clinical records (including consent forms and clinical photographs): 7 years from your last treatment, in line with recommended clinical record-keeping and to allow us to respond to any query or claim within the legal limitation period. Where a client was under the age of 18 at the time of treatment, records are kept for longer as required.

• Booking, financial and tax records: at least 6 years

• Marketing data: until you withdraw consent

When no longer needed, data is securely deleted or anonymised.

​

14. Your rights

Under the GDPR you have the right to: access your data; have inaccurate data corrected; have data erased where applicable; restrict or object to processing; data portability; and withdraw consent at any time where we rely on it. We do not use your data for automated decision-making or profiling with legal or similarly significant effects. To exercise any right, contact us (section 1). You also have the right to lodge a complaint with the Data Protection Commission, the Irish supervisory authority, at dataprotection.ie.

15. Children

Our treatments and services are intended for adults. We do not provide injectable treatments, or any other age-restricted treatment, to anyone under 18, and we do not knowingly collect the personal data of anyone under 18 through our booking or treatment services. Where a young person takes part in any permitted service, we require the consent and supervision of a parent or guardian.

16. Updates

We may update this policy from time to time to reflect changes in law or our operations. The latest version will always appear on our website.

17. Contact

Mirabell Cosmetology Limited (trading as Mirabell Aesthetics)
Dolcan House, 78/80 Tower Road, Clondalkin, Dublin 22, D22 N6F6
Email: mirabell.aesthetics.pmu@gmail.com
Phone: +353 85 186 5581