Last updated: 21 September 2026

1. Who we are

Moon Apothecary & Rituals is operated by Tina Bhopla.

For the purposes of UK data protection law, Tina Bhopla trading as Moon Apothecary & Rituals is the data controller responsible for the personal information described in this Privacy Policy.

You can contact us at:

Moon Apothecary & Rituals
Room 2, Spa LaLa
50 Pages Lane
Great Barr
Birmingham
B43 6LR

Email: tina@moonapothecary.co.uk
Telephone / WhatsApp: 07777 456 678

2. Information we collect

We may collect personal information when you contact us, make an enquiry, book or receive a treatment, complete a consultation form, communicate with us by email or WhatsApp, or use our website.

This may include your name, email address, telephone number, appointment information, messages and correspondence, payment or transaction information where relevant, and information you choose to provide in an enquiry.

Where necessary for the safe and appropriate provision of a treatment, we may also ask for information relating to your health, allergies, sensitivities, medications, pregnancy, scalp conditions or other relevant circumstances.

Health information is considered special category personal data under UK data protection law and receives additional protection. Where we rely on explicit consent to process this information, that consent will be requested separately and clearly as part of the consultation process; it will not be assumed simply because you have read this Privacy Policy.

3. How we use your information

We use personal information to respond to enquiries, arrange and manage appointments, communicate with you about your treatment, provide services you have requested, maintain appropriate treatment and business records, handle payments and accounting where applicable, deal with complaints or queries, and operate and improve our website and business.

We do not sell your personal information.

We do not use solely automated decision-making that produces legal or similarly significant effects about you.

4. Our lawful bases for using your information

When you contact us about a treatment or make a booking, we may process your information because it is necessary to take steps at your request before entering into a contract or to perform our contract with you.

We may also process information where it is necessary for our legitimate interests, such as responding to general enquiries, administering our business, maintaining appropriate records, protecting our business and customers, and improving our services, provided those interests are not overridden by your rights.

Some information may be retained because we have a legal obligation, including appropriate financial, tax or accounting records.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

Where we process health or other special category information, we will also identify an appropriate condition under Article 9 of the UK GDPR. Where that condition is explicit consent, we will obtain it separately through the relevant consultation process.

5. Client consultation and treatment information

Before certain treatments, we may ask you to complete a consultation or declaration.

We only ask for information that is relevant to understanding whether the treatment may be suitable for you and whether any adjustments or precautions may be appropriate.

Please provide accurate information and tell Tina if anything relevant changes before your appointment.

Consultation information will be treated confidentially and will only be accessed or used where reasonably necessary for providing the service, administering the business, meeting insurance or legal requirements, or protecting you or Moon Apothecary & Rituals.

The ICO requires organisations to avoid collecting more health information than is necessary for the stated purpose.

6. Contact forms and email

When you submit the contact form on moonapothecary.co.uk, the information you enter may be processed through Squarespace and delivered to us through our business email services.

Our business email is provided through Google Workspace.

Please do not submit detailed medical or sensitive health information using the general Contact form. Relevant treatment information should instead be provided through the designated client consultation process.

7. WhatsApp and telephone communications

If you contact Moon Apothecary & Rituals using WhatsApp, your communication will also be processed through WhatsApp and its associated service providers in accordance with their own privacy terms.

You can choose to contact Tina by telephone or email instead if you prefer.

We may retain relevant appointment or customer-service correspondence where it is reasonably necessary for managing your booking, responding to your enquiry or keeping an appropriate business record.

8. Website, cookies and analytics

Our website is hosted using Squarespace.

Squarespace and services embedded into the website may use cookies or similar technologies to make the website function, maintain security and, where enabled, provide analytics or other functionality.

Some third-party content, such as Google Maps, may also interact with your browser or device when you use it.

Where consent is required for non-essential cookies or similar technologies, they should not be activated until you have made the appropriate choice through our cookie controls. The ICO states that non-essential cookies generally must not be set before valid consent has been obtained.

You can change your cookie choices using the controls provided on our website.

9. Who we may share information with

We may use trusted service providers to operate the business and website. These may include Squarespace for website hosting and website forms, Google Workspace for business email and related services, WhatsApp/Meta where you choose to communicate with us through WhatsApp, Google where Google Maps or related functionality is used, payment or accounting providers where relevant, and professional advisers, insurers or legal advisers where reasonably necessary.

We may also disclose information where required by law or where necessary to establish, exercise or defend legal claims.

These organisations may process information on our behalf or, in some circumstances, act as independent data controllers under their own privacy terms.

10. International data transfers

Some of our technology providers may process or store personal information outside the United Kingdom.

Where UK data protection law requires safeguards for an international transfer, we expect the relevant provider to use an appropriate legal mechanism, such as applicable adequacy regulations or approved contractual safeguards.

Further information about a particular provider's international-transfer arrangements can usually be found in that provider's privacy or data-protection documentation.

11. How long we keep your information

We do not keep personal information for longer than reasonably necessary for the purpose for which it was collected.

General enquiries and correspondence will normally be retained only for as long as needed to deal with the enquiry and maintain an appropriate business record.

Booking, transaction and financial records may be retained for longer periods where required for accounting, tax, insurance or legal purposes.

Consultation and treatment records may be retained for as long as reasonably necessary to support ongoing treatment, meet applicable insurance requirements and establish, exercise or defend legal claims.

We periodically review the information we hold and delete or securely dispose of information where there is no longer a valid reason to retain it.

12. Your data protection rights

Depending on the circumstances and the lawful basis being used, you may have rights to request access to your personal information, ask us to correct inaccurate information, request deletion of information, ask us to restrict how information is used, object to certain processing, request transfer of certain information, and withdraw consent where processing is based on consent.

These rights do not apply in exactly the same way in every circumstance, and there may be situations where the law permits or requires us to retain information.

To exercise a data protection right, contact:

tina@moonapothecary.co.uk

We may need to verify your identity before responding.

The ICO requires privacy information to explain the applicable rights available to individuals and the right to complain to the supervisory authority.

13. Complaints

If you have a concern about how Moon Apothecary & Rituals handles your personal information, please contact Tina first so that we have the opportunity to address it.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

Information Commissioner's Office

14. Changes to this Privacy Policy

We may update this Privacy Policy when our services, technology providers or legal obligations change.

For example, we will review the policy before introducing Booksy online booking or making material changes to how consultation information is collected.

The latest version will always be published on this website with the date of the most recent update.