Privacy Policy
Last updated: 4 September 2026
Kirk Skin Reset respects your privacy and is committed to protecting your personal information.
This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you visit Kirk Skin Reset, join our mailing list, book a consultation, complete a skin assessment or AI-assisted consultation, communicate with us, interact with our advertising, or otherwise use our services.
It also explains the additional protections that apply when you provide information concerning your health or skin.
Please read this Privacy Policy together with our Cookie Policy and any additional privacy information or consent wording shown to you when we collect particularly sensitive information.
1. Who we are
Kirk Skin Reset is operated by:
James Kirk, trading as Kirk Skin Reset
United Kingdom
Email: kirk@kirkskinreset.com
For the purposes of UK data protection law, James Kirk trading as Kirk Skin Reset is the data controller of personal information described in this Policy unless we tell you otherwise.
This means that we determine why and how that personal information is processed.
If Kirk Skin Reset is subsequently incorporated or its business is transferred to a limited company or other legal entity, that entity may become the controller. We will update this Policy and provide any legally required information if that occurs.
2. Scope of this Policy
This Policy applies to personal information collected through or in connection with:
kirkskinreset.com;
skin assessments and questionnaires;
AI-assisted skincare consultations;
consultation bookings;
email newsletters;
SMS or messaging communications where introduced;
customer support;
advertising and social-media campaigns;
affiliate and referral programmes;
surveys and research;
future ecommerce services; and
other Kirk Skin Reset services that refer to this Policy.
Our website may be accessed from outside the United Kingdom. Additional privacy rights may apply depending on where you live.
3. Our approach to sensitive information
The nature of Kirk Skin Reset means you may choose to tell us information about your skin, health, medication, treatment history or other sensitive matters.
Under UK data protection law, certain health information is treated as special-category personal data and receives additional legal protection.
We therefore aim to apply a higher standard of protection to consultation information.
In particular:
we only seek health information that is relevant to providing or improving the service;
we require an appropriate legal basis and special-category condition before processing health information;
where we rely on explicit consent, we request it separately;
we restrict access to consultation information;
we seek to prevent advertising and behavioural-tracking technologies from capturing consultation content;
we do not sell health information;
we do not use individual health information for targeted advertising unless you have separately and explicitly agreed to that specific use;
we seek to minimise the information provided to AI service providers;
we do not intentionally permit identifiable consultation information to be used by AI service providers to train their general-purpose models; and
where information is no longer required in identifiable form, we aim to delete or anonymise it.
4. Personal information we may collect
Depending on how you use Kirk Skin Reset, we may collect the following categories of information.
Identity information
This may include:
name;
age or age range;
date of birth where required;
sex where relevant to the consultation;
username or customer identifier; and
other identifiers associated with your account or consultation.
Contact information
This may include:
email address;
telephone number;
communication preferences; and
other contact details you choose to provide.
Skin and health information
This may include information about:
acne;
rosacea;
eczema or dermatitis;
skin sensitivity;
allergies;
product or ingredient reactions;
current skincare products;
prescription or non-prescription medication;
isotretinoin or similar treatment;
pregnancy or breastfeeding;
medical diagnoses;
previous skin treatments or procedures;
symptoms;
medical or treatment history relevant to your skin;
skin concerns;
free-text information you provide during a consultation; and
other information concerning your physical health that you choose to submit.
This information may constitute special-category personal data.
Photographs and image information
Where our consultation service permits it, you may provide photographs of your face or skin.
These photographs may reveal information about your health and are treated accordingly.
We do not intend to use skin photographs for facial recognition, identity verification or the creation of biometric identity profiles.
We may also receive technical metadata associated with uploaded files and will seek to minimise or remove unnecessary metadata where reasonably practical.
Consultation information
We may collect and generate information including:
questionnaire responses;
consultation history;
consultation dates and timestamps;
skincare objectives;
recommendations generated for you;
suggested products, ingredients or routines;
AI prompts or structured inputs derived from your answers;
AI-generated outputs;
feedback on recommendations; and
records required to understand or troubleshoot the consultation.
Inferred information
Our systems may derive information from what you provide.
For example, an AI system may use your answers and photographs to generate observations about your skin characteristics, concerns or suitability for particular skincare products.
Where an inference reveals information about your health, we treat it as health information.
Communications information
We may retain communications between you and Kirk Skin Reset, including:
emails;
customer-service messages;
consultation queries;
complaints;
survey responses;
feedback;
SMS or messaging communications where introduced; and
records of your marketing preferences.
Marketing information
This may include:
whether you subscribed to our newsletter;
when and how you consented;
email engagement;
links clicked;
marketing preferences;
source of signup;
campaign or referral information; and
whether you unsubscribed.
Technical and usage information
This may include:
IP address;
browser and device information;
operating system;
approximate location derived from IP address;
referral source;
pages viewed;
interaction information;
session information;
error logs;
advertising identifiers;
analytics identifiers; and
cookie and consent information.
Please see our Cookie Policy for more information.
Booking information
If you book a consultation, we may process information such as:
your name;
contact information;
appointment date and time;
booking history;
cancellation information; and
relevant correspondence.
Transaction information
If we introduce paid consultations, products or ecommerce functionality, we may process:
order information;
products or services purchased;
amounts paid;
payment status;
refunds;
billing information;
delivery information where applicable; and
transaction records.
Payment-card information would ordinarily be processed by a specialist payment provider rather than stored directly by Kirk Skin Reset.
Affiliate and referral information
Where affiliate or referral programmes are used, we may process:
referral links;
affiliate identifiers;
promotional codes;
campaign attribution;
conversion information; and
associated transaction information.
5. How we collect personal information
We may obtain information in several ways.
Directly from you
You may provide information when you:
subscribe to emails;
complete a form;
book a consultation;
complete a skin assessment;
upload a photograph;
use an AI consultation;
make a purchase;
respond to a survey;
contact us;
enter a competition;
provide feedback; or
exercise your privacy rights.
Automatically
We may collect technical and usage information through:
cookies;
pixels;
analytics technologies;
server logs;
browser storage;
advertising technologies; and
similar technologies.
These are explained further in our Cookie Policy.
From service providers
We may receive information from providers that help us operate the business, such as:
website-hosting providers;
booking platforms;
email providers;
analytics providers;
payment processors;
AI service providers;
advertising platforms; and
affiliate or referral platforms.
From advertising and social platforms
Where permitted, we may receive information showing that someone interacted with a Kirk Skin Reset advertisement, social-media post, referral link or campaign.
We do not assume that information publicly available on social media may automatically be used for direct marketing.
6. AI-assisted skincare consultations
Kirk Skin Reset may use artificial-intelligence systems to analyse information you submit and produce skincare-related suggestions.
We may use more than one AI model or AI service provider.
The systems may process questionnaire responses, relevant skin information and, where you choose to provide them, photographs.
The purpose of this processing is to help generate skincare product, ingredient or routine suggestions based on the information you provide.
Automated processing
Recommendations may be generated substantially or entirely by automated systems and may not be individually reviewed by a human before being shown to you.
The AI consultation is designed to provide skincare information and product suggestions.
It is not intended to provide a medical diagnosis, prescribe medication or replace advice from an appropriately qualified healthcare professional.
The recommendations are not intended to produce legal or similarly significant effects about you.
You remain free to decide whether to act on a recommendation.
If the way we use automated systems materially changes, including if we introduce automated decisions capable of having legal or similarly significant effects, we will review the relevant safeguards and update our privacy information before implementing that processing.
Information sent to AI providers
We aim to provide AI providers only with the information reasonably necessary to generate the requested output.
Where technically and operationally feasible, we seek to avoid providing information such as your name, email address or other direct contact identifiers to an AI model where they are not needed to perform the analysis.
Photographs and health-related answers may nevertheless themselves constitute personal and sensitive information.
AI providers may therefore process personal information on our behalf in order to provide their services.
We assess the contractual and privacy arrangements applicable to the AI services we use and seek to use business, enterprise or API arrangements offering appropriate data-protection controls.
We do not intentionally authorise AI providers to use identifiable Kirk Skin Reset consultation information to train their general-purpose AI models.
7. Our legal bases for processing
UK data protection law requires us to identify a lawful basis when processing personal information.
Where special-category information such as health data is involved, we also require an additional condition under Article 9 of the UK GDPR.
Our principal processing activities are summarised below.
PurposeInformationPrincipal UK GDPR basisSpecial-category condition where applicableOperating and securing the websiteTechnical and usage informationLegitimate interests in operating, securing and protecting our service; legal obligation where applicableNot normally applicableResponding to enquiriesIdentity, contact and communications informationLegitimate interests and/or taking steps at your requestExplicit consent where an enquiry contains health information and this is the appropriate conditionBooking a consultationIdentity, contact and booking informationPerformance of a contract or steps taken at your requestNot normally applicable until health information is suppliedProviding a skin assessment or AI consultationIdentity, consultation, skin, health and image informationPerformance of a contract or steps taken at your requestExplicit consent under Article 9(2)(a)Generating AI skincare suggestionsConsultation, health, image and inferred informationPerformance of a contract or steps taken at your requestExplicit consent under Article 9(2)(a)Maintaining consultation records for a reasonable periodConsultation and related informationLegitimate interests in service continuity, support, quality and legal protectionExplicit consent and/or another applicable Article 9 condition where permittedSending newsletters and promotional emailsIdentity, contact and marketing informationConsent, or legitimate interests where a lawful existing-customer marketing exception appliesWe do not use individual health information for this purpose without separate explicit consentSMS or messaging marketingContact and marketing informationConsent or another legally permitted basisWe do not use individual health information for this purpose without separate explicit consentMeasuring advertising effectivenessTechnical, usage and conversion informationConsent where requiredHealth information is excluded from advertising conversion data as a matter of policyAffiliate attributionTechnical, referral and transaction informationConsent and/or legitimate interests depending on the technologyHealth information is not requiredProduct and service developmentUsage, feedback and aggregated consultation insightsLegitimate interests for non-sensitive informationWe seek to use anonymised data; identifiable health data will not be repurposed for product research without an appropriate Article 9 conditionAnalytics and website improvementTechnical and usage informationConsent or legitimate interests where legally permittedSensitive consultation content is excludedProcessing purchasesIdentity, contact and transaction informationPerformance of a contractNot normally applicableTax, accounting and regulatory recordsIdentity and transaction informationLegal obligationNot normally applicableFraud prevention and securityIdentity, technical and transaction informationLegitimate interests and/or legal obligationWhere special-category information is exceptionally relevant, an appropriate Article 9 condition will also be requiredHandling privacy requests and complaintsIdentity, contact and relevant recordsLegal obligation and legitimate interestsLegal claims or another applicable Article 9 condition where requiredEstablishing, exercising or defending legal claimsRelevant informationLegitimate interestsArticle 9(2)(f), where applicable
The appropriate basis may depend on the particular circumstances.
8. Explicit consent for health information
Before intentionally collecting health information through our consultation service, we intend to ask you to provide separate explicit consent.
Your decision must be affirmative.
The consent request will identify the nature of the health information involved and the intended processing.
You may withdraw consent by contacting kirk@kirkskinreset.com.
Withdrawal does not make processing carried out before withdrawal unlawful.
However, where health-information processing is genuinely necessary to provide the consultation, withdrawing consent may mean we can no longer provide or retain some elements of that service.
Other lawful reasons may occasionally permit or require us to retain limited information after consent is withdrawn, for example where information is needed to establish, exercise or defend a legal claim.
9. Product development and understanding our audience
One of Kirk Skin Reset's objectives is to better understand consumers' skincare needs and develop content, services and products relevant to those needs.
Consultation information may therefore help us identify trends such as:
common skin concerns;
ingredients or products people struggle with;
frequently reported sensitivities;
gaps in the skincare market;
commonly requested solutions; and
broad demographic or audience trends.
Our default approach is to use aggregated or anonymised information for this type of product-development and audience research wherever reasonably possible.
For example, we might identify that a particular proportion of consultation users report sensitive skin without needing to identify which individual users reported it.
Information that has been irreversibly anonymised so that an individual can no longer reasonably be identified is no longer personal information under UK data protection law.
We may retain and use genuinely anonymised statistical information for long-term business, research and product-development purposes.
We do not use identifiable health information to decide which individual should receive a particular marketing message unless we have first obtained any separate explicit consent required for that activity.
10. Marketing
If you subscribe to Kirk Skin Reset marketing, we may send you information about:
skincare education;
articles or videos;
consultations;
new features;
products;
launches;
offers;
surveys;
events; and
other Kirk Skin Reset news.
We currently use Kit, formerly known as ConvertKit, to help manage email subscribers and marketing communications.
Kit should be used for ordinary subscriber and marketing information, not as the primary storage location for detailed health consultation records or photographs.
You can unsubscribe from email marketing at any time by using the unsubscribe mechanism in an email or contacting us.
Where we introduce SMS, WhatsApp or similar electronic marketing, we will obtain the consent required for that particular channel unless another applicable legal exception permits the communication.
We may retain minimal suppression information after an unsubscribe so that we can respect your preference and avoid accidentally re-adding you to marketing.
Health information and marketing
We distinguish between:
general marketing, which may be based on matters such as being a subscriber, customer or previous visitor; and
health-based personalised marketing, which would use or infer an individual's health information to decide what advertising or marketing that person receives.
We do not conduct health-based personalised marketing unless we have obtained any separate explicit consent required by law.
We may nevertheless use anonymised and aggregated trends derived from our audience to determine what content, products or general campaigns Kirk Skin Reset should develop.
11. Online advertising
With appropriate consent where required, we may use advertising platforms such as search engines and social-media platforms to:
measure conversions;
understand campaign effectiveness;
attribute visits or purchases;
create non-sensitive audiences;
conduct retargeting; and
advertise Kirk Skin Reset.
Advertising platforms may receive technical identifiers, browsing information and conversion events.
We seek to prevent advertising platforms from receiving:
health questionnaire answers;
diagnoses;
medication information;
pregnancy information;
allergy information;
skin photographs;
AI consultation text;
AI recommendations that reveal a health condition; or
equivalent sensitive consultation information.
We also seek to prevent advertising pixels from operating within sensitive consultation areas unless there is a compelling lawful reason and the necessary consent.
Where a jurisdiction legally describes certain advertising disclosures as a “sale” or “sharing” of personal information even though no money is exchanged, we will provide any legally required opt-out.
12. Cookies and analytics
We use or plan to use technologies including website analytics and experience tools.
These may include services such as:
Google Analytics;
Google Tag Manager;
Microsoft Clarity;
Hotjar; and
advertising measurement technologies.
We apply consent requirements as described in our Cookie Policy.
Session recording, heatmap and similar behavioural tools should be excluded from areas containing sensitive consultation information.
Please see our Cookie Policy for additional information and cookie controls.
13. Who we share personal information with
We do not sell your personal information for money.
We do not sell health information.
We may disclose personal information to carefully selected organisations where reasonably necessary for the purposes described in this Policy.
These may include:
Website and infrastructure providers
For example, Framer, which provides website-building, hosting or related infrastructure services.
Email and communications providers
For example, Kit, which helps us maintain our subscriber list and send email communications.
AI technology providers
We may use multiple AI model providers or technical platforms to process information required to generate consultation outputs.
The specific providers may change as technology develops.
We seek to contract with providers that offer suitable privacy, security and enterprise/API protections for the information concerned.
Analytics providers
These may include Google, Microsoft and Hotjar where relevant services are enabled.
Booking and scheduling providers
If a third-party service is introduced to manage consultations or appointments, it may process the information required to manage that booking.
Payment providers
If paid services or ecommerce are introduced, specialist payment providers may process transaction and payment information.
Ecommerce and fulfilment providers
If we sell products, we may share necessary information with ecommerce, warehouse, delivery and fulfilment providers.
Advertising platforms
Where you have made the appropriate privacy choice, advertising providers may process technical, advertising and conversion information.
Professional advisers
We may disclose information where reasonably necessary to accountants, lawyers, insurers, cybersecurity specialists, consultants and other professional advisers who owe appropriate obligations of confidentiality.
Authorities and legal recipients
We may disclose information if reasonably necessary to:
comply with law;
respond to a lawful request;
protect someone's safety;
investigate fraud;
enforce our rights; or
establish, exercise or defend legal claims.
Business transfers
If Kirk Skin Reset is incorporated, sold, reorganised, merged, financed or transfers part of its business, personal information may be transferred as part of that transaction.
Any new controller would be required to process personal information in accordance with applicable law and provide any required privacy information.
14. Service providers and sensitive information
We take additional care when selecting providers that may have access to consultation or health information.
Where appropriate, we seek to ensure providers:
process information only for agreed purposes;
provide suitable confidentiality and security commitments;
offer appropriate data-processing terms;
support deletion or return of data;
impose suitable controls on subprocessors; and
provide appropriate safeguards for international transfers.
A provider suitable for ordinary marketing information is not automatically suitable for storing health information.
For this reason, we intend to keep detailed health records separate from ordinary email-marketing databases wherever reasonably practical.
15. International transfers
Some service providers may process personal information outside the United Kingdom.
This may include processing in the United States, European Economic Area or other countries in which our providers or their subprocessors operate.
Where UK data protection rules concerning restricted international transfers apply, we seek to use an appropriate mechanism such as:
applicable UK adequacy regulations;
the International Data Transfer Agreement;
the UK Addendum to approved EU Standard Contractual Clauses;
another legally recognised safeguard; or
an applicable statutory exception where permitted.
Where required, we also assess whether transferred information will continue to receive an appropriate level of protection.
16. Data security
We take the security of personal information seriously, particularly health information and photographs.
We implement, or seek to implement as the service develops, technical and organisational safeguards appropriate to the nature and risk of the information processed.
These may include:
encryption in transit;
appropriate encryption at rest;
access controls;
multifactor authentication;
restricted administrative access;
separation of sensitive consultation information from marketing information;
minimisation of information sent to AI systems;
secure vendor authentication;
security logging;
backup controls;
appropriate processor agreements;
vulnerability and software-update practices;
data-retention controls; and
incident-response procedures.
No internet-based service can guarantee absolute security.
If a personal-data breach occurs, we will assess it and notify affected individuals and regulators where required by law.
17. How long we keep personal information
We do not keep identifiable personal information indefinitely merely because it might prove useful in future.
Our initial retention framework is as follows.
InformationIntended retention approachSkin questionnaire responses and AI consultation outputsNormally retained for up to 24 months after your most recent consultation or meaningful interaction, then deleted or anonymised unless a longer period is justifiedSkin photographsNormally retained for up to 12 months after the relevant consultation, unless you request or use a feature requiring longer retention or another lawful reason appliesAnonymised audience, consultation and product-development statisticsMay be retained indefinitely, provided they remain genuinely anonymisedNewsletter and marketing informationWhile you remain subscribed or otherwise while the relevant marketing basis remains valid; inactive records are periodically reviewedMarketing suppression recordsAs long as reasonably necessary to ensure we continue to respect an opt-outBooking and routine customer-service informationNormally up to 24 months after the relevant interactionPrivacy consent recordsAs long as reasonably necessary to demonstrate consent and compliancePrivacy requests and complaintsNormally up to 6 years where necessary for compliance and legal protectionTransaction, tax and accounting recordsFor the period required by applicable tax, accounting or legal obligations, commonly up to 6 yearsLegal-claim informationFor as long as reasonably necessary in light of an actual or reasonably anticipated claimCookie and analytics informationAccording to the periods described in our Cookie Policy and relevant provider settings
These are maximum or general retention periods rather than a promise to retain information for the entire period.
We may delete information sooner where it is no longer needed.
We may keep particular information for longer where there is a legal obligation, unresolved dispute, fraud investigation, safeguarding concern or reasonably anticipated legal claim.
When identifiable information is no longer required but statistical value remains, we may irreversibly anonymise it rather than delete the resulting anonymous data.
18. Your privacy rights
Depending on the circumstances and applicable law, you may have rights including the right to:
Access
Ask whether we process your personal information and request a copy.
Correction
Ask us to correct inaccurate or incomplete personal information.
Erasure
Ask us to delete personal information where there is no longer a lawful reason to retain it.
This right is subject to legal exceptions.
Restriction
Ask us to restrict certain processing in applicable circumstances.
Objection
Object to processing based on legitimate interests in applicable circumstances.
You can object to direct marketing at any time.
Data portability
Receive certain personal information you provided to us in a structured, commonly used and machine-readable format where the legal requirements for portability are met.
Withdraw consent
Withdraw consent where our processing relies on consent.
Withdrawal will not affect processing already lawfully undertaken.
Rights relating to automated processing
Where applicable law grants rights in relation to qualifying automated decision-making, you may exercise those rights by contacting us.
Our current AI skincare recommendations are not intended to make decisions that have legal or similarly significant effects on you.
Complain
You may make a complaint directly to Kirk Skin Reset by contacting:
We will maintain a process for handling data-protection complaints.
We will acknowledge a qualifying data-protection complaint within 30 days and investigate and communicate the outcome without undue delay, as required by applicable UK law.
You also have the right to complain to the Information Commissioner's Office, the UK's data-protection regulator.
We would appreciate the opportunity to address your concern directly first, but this does not affect your right to approach the regulator.
19. Exercising your rights
To exercise a privacy right, email:
Please describe the request clearly enough for us to understand what you would like us to do.
We may need to ask for information reasonably necessary to verify your identity before disclosing, changing or deleting personal information.
This is intended to prevent personal information being provided to somebody who is not entitled to receive it.
You will not normally have to pay a fee.
Applicable law may permit us to charge a reasonable fee or decline to act in limited circumstances, for example where a request is manifestly unfounded or excessive.
We will respond within the timeframe required by applicable law.
20. Users outside the United Kingdom
Kirk Skin Reset is based in the United Kingdom but our website and online content may be accessed internationally.
Privacy laws vary between jurisdictions.
If the law where you live applies to our processing, you may have additional rights such as:
confirming whether personal information is processed;
requesting access, correction or deletion;
obtaining a portable copy;
withdrawing consent;
restricting or objecting to processing;
opting out of certain targeted advertising, sale or sharing practices;
limiting certain uses of sensitive personal information; and
appealing certain decisions concerning privacy requests.
Where such rights legally apply to Kirk Skin Reset, we will honour them.
A request may be made using kirk@kirkskinreset.com.
21. United States privacy disclosures
Certain US state privacy laws may apply only when a business, consumer or processing activity meets specific statutory requirements.
Where an applicable US law gives you a right to opt out of the sale, sharing or targeted advertising involving personal information, you may contact us or use available cookie/privacy controls.
Kirk Skin Reset's policy is that:
we do not sell personal information for money; and
we do not sell consumer health information.
Some US laws use terms such as “sale” or “sharing” more broadly than ordinary speech and may classify certain advertising technology disclosures in this way even if no money is paid for the information.
Where such a law applies, we will provide the legally required choice.
We will not discriminate against a consumer for exercising an applicable privacy right.
22. Children
Kirk Skin Reset is designed for adults.
Our consultation service is not intended for individuals under 18, and we do not knowingly seek to collect health information from children through that service.
If you believe a person under 18 has provided personal information through a service intended for adults, please contact kirk@kirkskinreset.com.
We will investigate and take appropriate action.
23. Third-party websites and services
Our website may link to websites, social platforms, payment providers or other services operated by third parties.
We do not control those organisations' independent privacy practices.
When you leave Kirk Skin Reset or interact directly with a third party, that organisation's own privacy information may apply.
24. Changes of purpose
We will ordinarily use personal information only for the purpose for which it was collected or for a compatible purpose permitted by law.
If we wish to use identifiable personal information for a materially different purpose, we will assess whether the new use is lawful and provide additional information where required.
Where new consent or explicit consent is required, we will seek it before beginning the new processing.
A privacy policy alone does not give us permission to use health information for any purpose we choose.
25. Changes to this Privacy Policy
We may update this Privacy Policy as Kirk Skin Reset develops.
Changes may be required because of:
new consultation functionality;
new AI providers;
changes to our technology;
ecommerce;
new communication channels;
new service providers;
international expansion;
changes in law or regulatory guidance; or
improvements to our privacy practices.
We will display the latest version on our website and update the date at the top of the Policy.
Where a change materially affects processing based on consent, we will seek new consent where required.
26. Contact
For questions, privacy-right requests or data-protection complaints, contact:
James Kirk
Trading as Kirk Skin Reset
United Kingdom
Email: kirk@kirkskinreset.com
Please use the subject line “Privacy” or “Data Protection Complaint” where appropriate so that your request can be identified promptly.