Privacy at Med Spa Guide.

Updated 28 October 2026. Med Spa Guide is a directory by Winback Engine, currently in a private preview. Winback Engine is the controller of the personal data described here under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We don’t ask for, and you shouldn’t send us, health information.

Saved clinics

Saved clinics stay in this browser on this device. They are not synced to an account. Clearing browser storage removes them.

Requests and private status links

We store your name, email, clinic details, role, message, consent choices, referral source, request reference and submission time to review and respond to claims, additions and corrections. Only approved business details appear publicly. Review notes and your personal contact details remain private.

Your private status link contains a secret token. Keep it private: anyone with the full link can see your request’s progress and, for approved owner claims, the clinic’s activity counts. We store a hash of the token with the request. Confirmation emails in the private sending queue contain your full status link.

Requests, review history and confirmation records are retained during the pilot so the team can resolve issues and document approvals. You can ask for deletion at the address below. We will confirm that the request belongs to you and explain any records needed to document a published correction or ownership decision.

Optional Winback Engine interest

The assessment checkbox is separate, unchecked by default and never required for a free listing. If you opt in, the team records your consent and follow-up stage. The directory does not automatically enrol you in marketing campaigns or an external CRM. We only send marketing emails where the Privacy and Electronic Communications Regulations (PECR) allow it, and every one tells you how to opt out.

Directory activity

We count searches, profile views and clicks on booking or contact links. Events contain the clinic, selected area or service, result count, time, and a limited referral source and campaign label. We do not store raw search text, raw IP addresses, persistent visitor identifiers or advertising cookies in these events. Referral labels are kept in this tab’s session storage. Browsers that send Do Not Track and signed-in administrators are excluded. If you tap “Near me”, your browser asks for permission and your location is used only on your device to sort clinics by approximate distance; it is never sent to or stored by Med Spa Guide. Map tiles are loaded from OpenFreeMap. Events older than 90 days are deleted when new activity is recorded.

Cookies and storage

We don’t use advertising or analytics cookies. Saved clinics and referral labels use your browser’s own storage, and administrators get a sign-in cookie. These are strictly necessary for features you ask for, so under PECR they don’t need a consent banner.

Providers and email

Cloudflare provides the application and database infrastructure and may process technical request data to operate the service. Confirmation, sign-in and verification emails are sent from an address on medspaguide.co.uk using Cloudflare Email Service. Phone verification is not enabled. Replies and owner questions go to hello@medspaguide.co.uk.

Clinic photos and logos are stored with the directory where available. External image fallbacks can contact the source image host. Booking, map and website links open external services with their own privacy practices.

Request protection

To limit repeated submissions, the app stores an hourly hash derived from the connecting IP and a request count. It does not store the raw IP in these counters. Expired counters are removed when new requests arrive.

Why we use your details, and your rights

We handle request details to respond to what you asked us to do and to keep the directory accurate (our legitimate interests), and optional Winback Engine follow-up on the basis of your consent, which you can withdraw at any time. Under UK GDPR you have the right to access, correct or delete your personal data, to object to or restrict how we use it, and to data portability. Some of our providers may process data outside the UK; where they do, they rely on safeguards recognised under UK data protection law. If you’re unhappy with how we handle your data, please contact us first; you can also complain to the Information Commissioner’s Office at ico.org.uk ↗.

Questions or deletion requests

Email hello@medspaguide.co.uk and include your request reference, if applicable. Do not send your private status token in a public message.