Legal
A plain-English account of how Aesthetics Unlocked handles personal information across membership, courses, email, checkout and optional measurement.
Last updated · 11 October 2026
Aesthetics Unlocked® is a trading name operated by Bernadette Tobin. We are the controller for personal information collected through this site, our courses and our email programme. Questions or data requests can be sent to hello@aunlock.co.uk.
When you join, start a free course, buy a course or contact us, we collect the information needed for that action: normally your name, email address, account and course activity, messages, purchase record and the source that brought you to the site. Stripe handles card and wallet details; Aesthetics Unlocked does not receive your full card number. Security records may include limited technical information needed to prevent abuse.
We use personal information to create and secure your account, deliver course access, process purchases, send requested sign-in and course emails, answer enquiries, operate agreed follow-up and offers, measure the funnel, and meet our legal obligations. Our legal bases are performance of a contract or steps you ask us to take, consent for optional marketing measurement and marketing email, legitimate interests in keeping the service secure and improving it, and legal obligation where records must be retained.
For signed-in learners we record which lesson opens, whether it stays visible for 45 seconds, use of the Day 1 calculator and an explicit mark-complete action. These are separate signals: time on a page is not proof of completion or understanding. Daily records help us find access problems and improve course support. They contain no clinic figures and are not sent to advertising platforms. Optional marketing measurement remains governed by your cookie choice.
If you submit a course or clinic-review form from a campaign-tagged landing address, the form carries the campaign, ad-set and advert identifiers plus the landing path with your request. Aesthetics Unlocked keeps this first-party source record with the member account to understand which acquisition activity results in a real enrolment. It does not require a tracking cookie. The source record is not separately shared with an advertising platform; any conversion event sent to Meta is limited to the information and choices described under Optional Meta advertising measurement below.
If you request a Clinic Opportunity Review, we use the clinic name and public website or business social page you provide, together with public service, positioning and pricing information found there, to prepare a private plan. We record the pages and evidence used, the recommendations shown and whether the plan is opened or a recommended free course is started. We do not seek or use patient information. The requested review and its delivery emails are a service you asked for. Permission for later teaching and course marketing is a separate, optional choice on the form. Private review links are unguessable, excluded from search indexing and expire after 90 days.
We use selected providers to operate the service, including Supabase for member data and course access, Resend and Microsoft 365 for email, Stripe for payments, Vercel for hosting and measurement, Cloudflare for anti-abuse checks, and, for the voice assistant, Anthropic to write answers and Google to read them aloud. They receive only the information needed for their role. We do not sell personal information. Where processing takes place outside the UK, the provider's applicable transfer safeguards or adequacy mechanism applies.
The voice is an AI assistant. When you tap it and talk, your browser turns your speech into text using its own speech service (Google in Chrome, Apple in Safari). The text of your question is sent to our AI provider, Anthropic, to write the answer, and is not used to train its models. The answer is read aloud by your browser, or by Google's text-to-speech service, which receives the words of the answer only. We keep each question and the answer it was given so we can see what practitioners want to know, improve our answers and add to our FAQs. We do not keep your name, your IP address or anything that identifies your device, and any email address, phone number, postcode or card number in a question is removed before it is saved. Questions that come up often may be answered on our FAQs page, written in general terms so no one can be identified. The wording of questions and answers is cleared after 12 months. Our lawful basis is our legitimate interest in answering questions well. Please do not share client or patient details with the voice.
Meta Pixel stays off until you actively allow Meta measurement, at a course signup, just after opening a new course, or through ‘Cookie settings’. If you allow it, Meta may receive a one-time event identifier, page context, browser identifiers and a one-way SHA-256 hash of the normalised signup email, plus limited technical data, to match and deduplicate the conversion. Separately, when you create a new free account or request your first Clinic Opportunity Review, we send Meta a single server-side Lead event through the Meta Conversions API under our legitimate interest in measuring which adverts bring genuine members. That event is built only from what you typed into our form, the connection details of that request and the advert link you followed: a one-way SHA-256 hash of the normalised email, your IP address and browser user agent, the course or review name, a one-time event identifier and, if you arrived from a Meta advert, the click reference that Meta placed in that link. It reads and sets no cookie or other device storage and never includes a Meta browser identifier unless you allowed measurement. You can object at any time through ‘Cookie settings’ or by emailing hello@aunlock.co.uk, and objecting does not affect course access, review delivery, email delivery or checkout. When you buy a course, we send Meta a single server-side Purchase event on the same legitimate-interest basis, so we can tell which adverts lead to genuine sales. It carries a one-way SHA-256 hash of the normalised email you paid with, the amount and currency, a one-time order reference and, if you arrived from a Meta advert, the click reference in that link. If you allowed Meta measurement, the Meta browser identifiers are included as well. If you have said no in ‘Cookie settings’, neither the Lead nor the Purchase event is sent.
Essential sign-in, purchase and course-access messages are sent because you asked us to provide the service. Educational follow-up and promotional offers are sent where you opted in or where another lawful permission applies. Every marketing email includes an unsubscribe route. Unsubscribing from marketing does not remove service messages needed for an active account or purchase.
We keep account and course records while the account is active and for only as long as needed afterwards; purchase and tax records for the applicable statutory period; email-marketing data until you unsubscribe or it is no longer needed; and consent or security records for as long as needed to demonstrate the choice or protect the service. The cookie policy lists browser-side durations. You can ask for the current retention position for your record at hello@aunlock.co.uk.
Depending on the circumstances, you can ask to access, correct, erase, restrict or receive a copy of your personal information, object to certain uses, and withdraw consent at any time without affecting earlier lawful processing. Email hello@aunlock.co.uk. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
Necessary technology supports sign-in, security and checkout. Optional site analytics and Meta advertising measurement are off on a first visit and load only after permission. No consent panel blocks the page. Use ‘Cookie settings’ in the footer at any time to opt in or choose the two purposes separately. See the cookie policy for the current inventory and durations.
