Cookie Policy
Last update at 29th of July 2026
Introduction and scope
This Cookie Policy explains how Skin & Aesthetics by Haleema Saadia (“we”, “our”, “us” or “the Clinic”) uses cookies and other technologies that store information on, or access information from, your computer, smartphone, tablet or other device when you use our website at www.skinaestheticshaleema.co.uk. The legal entities operating our clinics and the relevant data-controller details are identified in our Privacy Policy and Website Terms of Use.
For simplicity, this Policy generally refers to all of these technologies as “cookies”. The rules apply not only to traditional browser cookies, but also to technologies such as pixels, tags, scripts, local storage, session storage and similar identifiers.
This Policy should be read alongside our Privacy Policy and Website Terms of Use. Our Privacy Policy explains how we use personal data obtained through the website, including information generated by cookies and similar technologies.
Strictly necessary technologies may be used automatically where they are essential to operate the website, maintain security or provide a service you have specifically requested. Other technologies may require your consent. The controls available on the website will depend on its current technical configuration, and we will review and update those controls and this Policy where necessary.
What cookies and similar technologies are
Cookies are small text files that a website places on your device. They may be set directly by us (“first-party cookies”) or by another organisation whose service is used on our website (“third-party cookies”).
Other storage and access technologies may include:
- local storage and session storage, which allow information to be stored within your browser;
- tracking pixels and web beacons, which can record when a page, email or advertisement is viewed;
- scripts and tags, which enable analytics, advertising, booking, security or embedded-content functions;
- device or browser identifiers used for security, fraud prevention, analytics or advertising; and
- similar technologies that access information held on your device.
Some cookie information is anonymous or aggregated. In other cases, information such as an online identifier, IP address, device information or browsing activity may constitute personal data and will be handled in accordance with our Privacy Policy.
Legal framework
Our use of cookies and similar technologies is governed principally by the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), as amended, together with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and relevant amendments made by the Data (Use and Access) Act 2025.
PECR generally requires us to provide clear and comprehensive information and obtain valid consent before using non-exempt storage and access technologies. Limited exceptions may apply where a technology is used solely for communications, is strictly necessary to provide a service requested by the user, is used for qualifying statistical purposes, adapts appearance or functionality to the user’s preference, or is used for emergency assistance. Each exception has specific conditions.
Where the information collected is personal data, we must also have an appropriate lawful basis under the UK GDPR and comply with the principles of fairness, transparency, data minimisation, security and storage limitation. Consent under PECR and a lawful basis under the UK GDPR are related but separate requirements.
Why we use these technologies
Depending on the choices you make and the services enabled on the website, cookies and similar technologies may be used to:
- operate the website, maintain secure sessions and prevent misuse;
- remember your cookie choices, accessibility settings and other requested preferences;
- enable enquiry, consultation, booking and payment functions;
- measure website use and produce aggregated statistics to improve content, navigation and performance;
- identify technical problems, broken pages and loading issues;
- display third-party content such as maps, booking tools or videos;
- measure advertising conversions and campaign performance; and
- support personalised advertising or audience measurement where you have consented.
We do not use cookies to collect more information than is reasonably necessary for the stated purposes.
Categories of cookies and technologies
5.1 Strictly necessary
These technologies are essential to transmit communications, secure the website, remember your privacy choices or provide a service you have requested, such as completing an online form, opening the booking tool or processing a payment. They do not require consent where the relevant PECR exception applies. They must not be used for unrelated analytics, advertising or profiling purposes.
5.2 Functional and appearance preferences
These technologies remember choices such as display, accessibility, language or other user-selected settings. Where the statutory appearance exception is used, we will provide clear information and a simple, free way to object. Where the exception does not apply, we will obtain consent before using them.
5.3 Statistical and analytics
These technologies help us understand how the website is used, for example the number of visits, pages viewed, user journeys, device types and general performance. We may rely on the statistical-purposes exception only where the sole purpose is producing aggregate statistical information to improve the website, the information is not used to identify, profile or make decisions about individuals, any third party acts only to assist with that improvement, and users receive a simple, free means of objecting. Where those conditions are not met, consent is required before the analytics technology is used.
5.4 Performance and diagnostics
These technologies identify technical errors, loading speeds, broken pages and other operational issues. They may be treated as strictly necessary only where they are essential for security or operation and are used solely for that purpose. Other performance or diagnostic technologies require consent or must meet the conditions of an applicable exception.
5.5 Marketing and advertising
These technologies may measure advertising conversions, attribute bookings or enquiries to campaigns, create or refine audiences, limit repeated adverts, support cross-site tracking or personalise advertising. Marketing and advertising technologies, including Meta Pixel and Google advertising tags where enabled, generally require valid consent before use. They are not treated as strictly necessary or covered by the statistical-purposes exception.
5.6 Third-party and embedded content
Features such as maps, booking tools, payment services, videos or social-media content may be supplied by third parties. Some can operate without non-essential tracking; others may access information on your device. Depending on the provider and purpose, consent may be required before the relevant non-essential technology is used.
Indicative cookie and technology schedule
The table below describes the principal technologies that may be enabled on the website. A listed service applies only where it is installed or displayed on the relevant page. The schedule is indicative and is based on the information available when this Policy was last reviewed. Cookie names, purposes and expiry periods may change when providers or website settings are updated, and we will amend this Policy when material changes are identified.
Technology / provider | Typical identifiers | Purpose and category | Typical duration | Choice required |
|---|---|---|---|---|
Cookie banner or preference record, where used | Provider-specific identifier | Remembers a cookie choice or consent preference. Strictly necessary where used for this purpose. | Normally up to 12 months. | No consent required for the preference record itself. |
Website platform and hosting | Session, security, load-balancing and anti-abuse identifiers; names vary by platform | Website operation, availability, security and fraud or abuse prevention. Strictly necessary only where used solely for these purposes. | Session or a provider-defined period, which may change when the service is updated. | No consent where strictly necessary; otherwise consent. |
Pabau booking tools, where embedded or linked | Provider-specific cookies, local storage and session identifiers | Enables appointment enquiries, account or booking sessions and related security. Any separate analytics or marketing use is treated according to its purpose. | Session or a provider-defined period, which may change when the service is updated. | No consent for a service specifically requested where strictly necessary; consent for non-essential tracking. |
Stripe or other payment tools, where enabled | Payment, security and fraud-prevention identifiers, which may include __stripe_mid and __stripe_sid | Supports secure payment processing and fraud prevention when you choose to make a payment. Strictly necessary to the requested payment service where applicable. | Session to provider-defined periods, which may change when the service is updated. | No consent where strictly necessary to process the requested payment; consent for unrelated tracking. |
Google Analytics 4, where enabled | _ga and _ga_<measurement-id>, together with related analytics identifiers | Measures visits, page use and user journeys. Statistical / analytics. | Commonly up to 2 years, subject to our configuration and provider updates. | Consent unless configured and operated strictly within the statistical-purposes exception, with a simple means to object. |
Google Ads or conversion tracking, where enabled | _gcl_au and related advertising or conversion identifiers | Measures advertising performance, attributes conversions and may support audience or remarketing activity. Marketing. | Provider-defined, commonly up to 90 days for certain conversion identifiers. | Consent required before activation. |
Meta Pixel, where enabled | _fbp, _fbc and related pixel or browser identifiers | Measures Meta advertising performance, attributes enquiries or bookings and may support audience creation. Marketing. | Provider-defined, commonly up to 3 months for certain browser identifiers. | Consent required before activation. |
Google Maps or other embedded content, where enabled | Provider-specific cookies, local storage, scripts and identifiers | Displays interactive maps or other third-party content. Functional / third-party content; some provider use may also involve analytics or advertising. | Provider-defined and subject to change when the service is updated. | Consent where the provider stores or accesses information for non-exempt purposes. |
Third-party services and embedded content
Third-party providers may receive information generated when their technologies operate, such as online identifiers, IP address, device and browser details, page activity, booking or conversion events and cookie choices. The providers used may include, where enabled, our website and hosting provider, Pabau, Stripe, Google and Meta.
Third parties may act as our processors, independent controllers or joint controllers depending on the service and purpose. Their own privacy and cookie information applies to their independent processing. Further information about recipients, international transfers and your data-protection rights is provided in our Privacy Policy.
Third-party advertising or social-media technologies may require consent before use where they are not covered by a legal exception. We will keep third-party integrations under review and update our information and controls where necessary.
Consent, objections and changing your choices
Depending on the website’s current configuration, you may be shown a cookie banner or preference tool. Where a consent tool is available, it may provide options to:
- accept all optional technologies;
- reject all non-essential technologies; and
- choose individual categories or purposes.
Where a consent banner is used, rejecting non-essential technologies should be as easy as accepting them, and optional categories should not be pre-selected. Closing a banner, scrolling, continuing to browse or remaining inactive will not be treated as consent.
Non-exempt technologies require a positive action to consent before use. Where the statistical-purposes or appearance exception is relied upon instead of consent, clear information and a simple, free means of objecting must be provided.
Where an on-site preference tool is available, you can use it to revisit or change your choices. You can also use your browser or device settings to view, delete or block cookies. Withdrawal does not affect processing that was lawful before withdrawal. Please contact us if you need information about the controls currently available.
Where you have rejected non-essential technologies, we will not repeatedly prompt you and would normally wait at least six months before asking you to make a new choice, unless our technologies, purposes or providers materially change or an earlier request is otherwise justified.
We may retain a record of your preference or consent choice for as long as reasonably necessary to respect your decision and demonstrate compliance. This record is not used for advertising.
Browser controls and deleting cookies
Most browsers let you view, delete or block cookies, although controls vary and may not cover every technology. Blocking cookies may affect forms, bookings and payments.
Personal data, international transfers and retention
Where cookie information constitutes personal data, we process it in accordance with our Privacy Policy. Depending on the purpose, this may involve consent, legitimate interests, performance of a contract, compliance with a legal obligation or another lawful basis under the UK GDPR. Legitimate interests alone do not remove any requirement to obtain valid consent under PECR for marketing or advertising technologies.
Some providers may process information outside the United Kingdom. Where international transfers occur, appropriate safeguards or another lawful transfer mechanism will be used as described in our Privacy Policy and the relevant provider’s information.
We retain cookie-derived personal data only for as long as necessary for the stated purpose. Cookie expiry does not always determine how long a provider retains information after collection. Applicable retention periods and safeguards are addressed in our Privacy Policy, provider agreements and internal retention arrangements.
Changes to this Cookie Policy
We may update this Policy to reflect changes in the website, our providers, the purposes for which technologies are used, legal requirements or regulatory guidance. The revised version will be published on the website with an updated effective date.
Where a change materially affects choices previously made, we will take reasonable steps to refresh the available information or choice mechanism and obtain a new choice where required. We will not treat continued use of the website as consent to newly introduced non-exempt technologies.
Contact us and complaints
For questions about this Cookie Policy, the technologies used on the website or your privacy choices, please contact
Organisation | Skin & Aesthetics by Haleema Saadia |
Website | www.skinaestheticshaleema.co.uk |
Clinic locations | Edgbaston and Sutton Coldfield |