Customer Data Requests

How to exercise your data-protection rights

Last updated: 3 August 2026

This page explains how to make a request about personal information controlled by MEDICO BEAUTY LIMITED ("Medico Beauty", "we", "us" or "our"). It applies to information collected through our Squarespace marketing website, our main online shop at www.medicobeauty.com, customer accounts, purchases, skincare forms and quizzes, customer service, marketing, rewards and related services.

This page should be read with our Privacy & Cookie Policy at www.medicobeauty.com/pages/privacy-policy.

You do not need legal wording. A request can be made verbally or in writing. You do not need to mention the UK GDPR, quote an article number or use a particular form. We have provided the steps below to help us identify and respond to your request efficiently.

1. Your data-protection rights

Depending on the circumstances and the law that applies, you may have the following rights.

Access your information

You can ask whether we use personal information about you and request a copy of that information, together with supporting details about how and why it is used. This is commonly called a subject access request or SAR.

Correct inaccurate or incomplete information

You can ask us to correct personal information you believe is inaccurate or to complete information you believe is incomplete.

Ask for information to be erased

You can ask us to delete personal information in certain circumstances. This right is not absolute. For example, we may need to keep some information to comply with tax, accounting, product-safety or other legal obligations; prevent fraud; resolve disputes; establish or defend legal claims; or maintain a record that you have opted out of marketing.

Restrict how information is used

You can ask us to limit the use of your personal information in certain circumstances, for example while we check its accuracy or consider an objection.

Receive or transfer certain information

In certain circumstances, you can ask for personal information that you provided to us to be supplied in a structured, commonly used and machine-readable format, or transferred to another organisation where technically feasible. This right generally applies where processing is automated and based on consent or a contract.

Object to certain uses

You can object to certain processing based on our legitimate interests by explaining how it affects your particular situation. We will stop unless we have compelling lawful grounds to continue or the processing is needed for legal claims.

You may object to direct marketing at any time. We will stop using your information for direct marketing, although we may retain limited details on a suppression list so that we do not contact you again by mistake.

Withdraw consent

Where we rely on your consent, you can withdraw it at any time. Withdrawal does not affect processing that took place before consent was withdrawn, and it does not affect processing based on another lawful basis.

Automated decisions

Where applicable, you may have rights in relation to a decision made solely by automated means that has a legal or similarly significant effect on you, including the right to request human involvement, express your point of view and challenge the decision. Our skincare quizzes and product recommendations provide general guidance and are not intended to make legally or similarly significant decisions about you.

2. How to make a request

The quickest way to make a customer data request is to email enquiries@medicobeauty.com with the subject line "Customer Data Request".

You may also contact us by telephone on 0808 258 4000 during our usual customer-service hours, or write to our registered office using the contact details at the end of this page.

To help us find the correct records, please provide as much of the following as is relevant:

  • your full name;

  • the email address and telephone number linked to your account or order;

  • any previous name or email address that may appear in our records;

  • your order number, account number or professional account details, where relevant;

  • the right you wish to exercise or a clear description of what you want us to do;

  • the types of information, services and approximate date range involved;

  • your preferred response format and any accessibility requirements; and

  • if acting for someone else, evidence that you are authorised to act for them.

For your security: Do not send us your password, complete payment-card details or unnecessary identity documents by ordinary email. If additional verification is required, we will explain what is needed and how to provide it securely.

3. Identity and authority checks

Before disclosing information or changing an account, we must be reasonably satisfied that the request comes from the correct person. We may ask you to confirm information already associated with your account or order. We will request formal identification only where it is reasonably necessary and proportionate.

If someone makes a request on your behalf, we may ask for your signed authority and proof of the representative's identity or legal authority. Different evidence may be needed where a parent, guardian, attorney, deputy, executor or other authorised representative is acting for another person.

4. When we will respond

We will respond without undue delay and normally within one month after receiving a valid request and any information reasonably required to confirm identity or authority.

If a request is unclear, we may ask you to explain the information or action you are seeking. Where the law permits, the response period may be paused until the necessary clarification is received.

If a request is complex or you make several requests, we may extend the response time by up to a further two months. If we do, we will tell you within the initial one-month period and explain why more time is needed.

5. Fees

We normally deal with data-protection rights requests free of charge. Where legally permitted, we may charge a reasonable fee or refuse to act if a request is manifestly unfounded or excessive, particularly if it is repetitive. We may also charge a reasonable fee for additional copies of information already supplied.

If a fee applies or we intend to refuse a request, we will explain our reasons and your available complaint rights.

6. Information we may withhold or retain

Data-protection rights are subject to conditions and exemptions. We may need to:

  • remove or withhold information that identifies another person where disclosure would not be appropriate;

  • protect legally privileged, confidential, security-sensitive or fraud-prevention information;

  • retain transaction and accounting records required by law;

  • retain information needed for product safety, complaints, disputes or legal claims;

  • retain a minimal suppression record after a marketing objection; or

  • make a reasonable and proportionate search rather than a search that would be unreasonable or disproportionate in the circumstances.

A right of access is a right to your personal information, not necessarily to original or complete documents. We may provide relevant extracts or redact information where appropriate. If we cannot comply fully, we will normally explain why, unless the law prevents us from doing so.

7. Marketing choices

You can stop email marketing by selecting the unsubscribe link in any marketing email. You can also contact enquiries@medicobeauty.com to object to marketing or withdraw marketing consent.

Where available, you can change SMS or WhatsApp preferences using the opt-out instructions included in the message. Marketing preferences do not prevent us from sending essential service messages about an order, account, safety notice or request.

8. Data-protection complaints

If you are concerned about how we use your information or handle a request, please contact enquiries@medicobeauty.com with the subject line "Data Protection Complaint". Include your name, contact details, a clear explanation of the concern, relevant dates and any supporting information.

We will acknowledge a data-protection complaint within 30 days, take appropriate steps to investigate it without undue delay, keep you informed where necessary and explain the outcome.

You also have the right to complain to the Information Commissioner's Office, the UK data-protection regulator. Information and the online complaint service are available at www.ico.org.uk/make-a-complaint. If you live outside the UK, you may also be entitled to contact the data-protection authority in your country.

We would appreciate the opportunity to resolve your concern directly before you contact a regulator, but you are not required to do so.

9. Contact details

MEDICO BEAUTY LIMITED

Company number: 03779950

Email: enquiries@medicobeauty.com

Freephone: 0808 258 4000

Telephone hours: 9:30am to 4:30pm, Monday to Friday, excluding public holidays

Registered office: 5 Luke Street, London, EC2A 4PX, United Kingdom

The registered office is for legal and data-protection correspondence. Product returns must be sent only in accordance with our Delivery & Returns Policy.