Privacy Policy

Ask Leida Ltd

Last updated: 16 October 2026

This privacy policy and any other document referred to in it, sets out the basis on which we collect and process your personal data as a data controller when you use our website at www.askleida.com, the Leida app at app.askleida.com, and our own internal admin tools and services. Where something applies to only one of them, we say so.

Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. By visiting our website, or using our services or apps you are accepting and consenting to the practices described in this privacy policy.

Our website, app and services are not intended for use by children and we do not knowingly collect information relating to children.

1. Who we are

Ask Leida Ltd ("Leida", "we", "us") provides a software platform for independent skin therapists. Practitioners use Leida to create personalised homecare guidance pages for their clients.

• Registered name: Ask Leida Ltd

• Company number: 17164111

• Registered office: 122 West End, Costessey, Norwich, England, NR8 5AN

• ICO registration number: ZC217149

• Contact for data protection questions: hello@askleida.com

2. Data Controller

This privacy policy explains how we use your personal data as a controller.

Where we are the controller. For our own website visitors, app users, waitlist subscribers, customers and practitioner accounts, we decide what personal data is collected and why and we are a controller.

Where we are the processor. When a practitioner enters information about their own client into Leida Services, that client's data belongs to the practitioner. They decide what is collected and why. We only handle the data on their instructions, under a separate Data Processing Agreement as a processor.

If you are a client of a practitioner who uses the Leida services and you want to know how your data is handled, please contact your practitioner in the first instance. You can also contact us at hello@askleida.com and we will help.

3. Visitors to our website (askleida.com)

What we collect. With your consent, we use Google Analytics 4 and Microsoft Clarity to understand how our website is used. Google Analytics tells us which pages are visited and how people arrive. Microsoft Clarity records how visitors move around and interact with pages, including clicks and scrolling. Both involve cookies and both can process your IP address.

Our legal basis. Consent. Analytics cookies are only set, and Microsoft Clarity only loads, if you accept them in our cookie banner. Before you choose, Google’s analytics script loads in a restricted mode that does not set cookies. You can decline, and the site works normally if you decline.

Withdrawing consent. You can clear the site data (cookies and local storage) for askleida.com in your browser settings and the banner will appear again, so that you can choose again.

How long we keep this data. Google Analytics keeps event data for 2 months and user data for 14 months, with the 14 months restarting each time a visitor returns. Microsoft Clarity recordings are kept for 30 days.

Fonts. We load fonts from Google Fonts, which means your IP address is transmitted to Google when a page loads.

Embedded demo. Our homepage embeds an interactive demo hosted by Replit. Loading the page connects your browser to Replit's servers.

4. Waitlist and email subscribers

What we collect. Your email address, if you submit it through the waitlist form.

What we do with it. We send you updates about the Leida services, including launch news and occasional articles. We use MailerLite to send these.

Our legal basis. Consent, which you give by submitting the form. Every email includes an unsubscribe link, and unsubscribing takes effect immediately.

How long we keep this data. Until you unsubscribe.

5. Customers and founding members

What we collect. Your name, email address, billing details and subscription history.

Payments. Payments are processed by Stripe. We never see or store your full card number. Stripe holds your card details as a separate controller under its own privacy policy, and sends payment receipts directly to you.

Our legal basis. Performance of a contract with you, for providing the service you have paid for, and our legal obligation to keep financial records.

How long we keep this data. Financial records are kept for six years after the end of the relevant tax year, as required by UK law. Other account data is deleted within 90 days of your account closing.

6. Practitioner accounts

What we collect. Your name, email address, password (stored in hashed form, never in plain text), business details, and any logo or brand image you upload for use on your clients' pages.

You need to give us your name and email address in order to have an account. Without them we cannot provide you with access to the Leida services. The other details are optional.

What we do with it. We use it to give you access to your account, provide access to the Leida services, send service-related messages such as password resets, and provide support.

Our legal basis. Performance of a contract with you.

How long we keep this data. For as long as your account is open, and for 90 days after closure, excluding financial records that we keep for longer as set out above.

Our access to your account. So that we can provide support, our staff can view and edit your account details through an internal admin tool. We only do this to help you or to keep the Leida services running.

7. Client information entered by practitioners

When a practitioner uses the Leida services, they enter information about their clients so that a personalised homecare page can be created. This may include:

• The client's name

• Their date of birth

• Their skin type and skin concerns

• Whether they are pregnant or breastfeeding

• Skin information and notes written by the practitioner

• The products the practitioner has recommended to them

Some of this is information about a person's health. UK data protection law treats health information as a special category of personal data, which requires additional protection. We handle all special category personal data on that basis.

Leida services may only be used for adult clients. Practitioners must not create client records for anyone under 18. The Leida services do not support uploading photographs of clients.

For all information that Clients upload or provide into the Leida services:

• The practitioner is the controller. The Practitioner decides what is collected, and they are responsible for having a lawful basis for collecting it and a valid condition for processing health information, including informing their clients that Leida is used to process their personal data.

• Leida is the processor. We only act on the practitioner's instructions, under a separate Data Processing Agreement.

• Client information is stored in our database located in the European Union.

• When written guidance is generated, only the information needed to write it is sent to our AI provider: the client's skin type, skin concerns, the practitioner's skin overview and any context they add when creating a routine, and the products and usage notes they have chosen. The client's name, date of birth and email address are not sent, and neither are the practitioner's personal notes about the client. Practitioners are asked not to enter a client's name or other identifying details in the free-text boxes.

• We do not send emails to a practitioner's clients.

Client homecare pages (“routine pages”). Each personalised homecare page that a practitioner creates for a client has a randomly generated address that cannot be guessed, and these pages are blocked from search engines. Anyone holding the link can view the page, so practitioners should share links only with the client concerned.

How long we keep this information. Client records are kept for as long as the practitioner's account is open. When their account closes, client records are deleted within 90 days.

Deletion. When a practitioner deletes a client, the record is permanently deleted from our database rather than hidden, and their routine link stops working immediately. The client record may be contained in encrypted backups for up to 30 days, after which it is overwritten.

Automated decisions. Leida uses AI to help write the wording on a client's routine page. We do not use AI to make any decisions about people. The practitioner chooses the products and the advice they provide to their clients, and the practitioner reviews everything before it is shared with a client.

Usage records during the beta. During the beta, Leida records how routine pages are used, so we can see whether practitioners send pages and whether clients use them. We record when a client opens their routine page, when they come back to it, and which shop links they tap. We also record when a practitioner shares a routine or marks it as sent. Each record holds only a time and ID numbers. We don't store names, email addresses, IP addresses or device details. These records are kept in the same secure database as the rest of the account and can't be seen by the public. We keep them until the practitioner deletes the client or asks us to delete them. A client can also ask their practitioner, or us, to have them deleted.

8. Who else handles data

We use the following third party providers to provide our website, app and/or services who may have access to your information, as our third party supplier. Each is contractually required to protect the data they handle and to act only on our instructions. We may share your information, where necessary, with the third party providers set out below, for the purposes set out in the table below.

We do not sell personal data, and we do not share it with anyone for their own marketing.

If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms and conditions, terms of use and/or any other legal agreements; or to protect our rights, property, safety, our client or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction. In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets, , who will remain bound by this policy or one that offers equivalent protection.

When we use professional advisors in our business such as lawyers, bankers, auditors, and insurers who provide consultancy, banking, legal, insurance and accounting services.

Tax authorities, regulators and other authorities who require reporting of processing activities in certain circumstances.

Where it is included in aggregated and anonymised data that does not identify you or any client, which we may use and share, for example, to show trends in how skincare products are used.

9. Transfers outside the UK

Some of our third party suppliers are based outside of the UK. When we transfer information to countries outside of the UK whose laws do not provide the same level of data protection as the UK, the EU or Switzerland, we always ensure that a similar degree of protection is afforded to your information by ensuring that one of the following applicable safeguards is in place.

We will only transfer UK personal data outside of the UK to: (i) countries deemed by the ICO to provide an adequate level of protection for UK personal data; or (ii) entities located outside of the UK with whom standard contractual terms approved for use in the UK which give the transferred personal data the same protection as it has in the UK have been entered into, for example the International Data Transfer Addendum, (IDTA) to the European Commission’s standard contractual clauses for international data transfers or binding corporate rules (BCRs); or (iii) entities located in the USA certified under the UK Extension to the EU-U.S. DPF; or (iv) any entity located outside of the UK that is subject to any other transfer mechanism, bespoke contract, approved code of conduct or certification scheme approved by the ICO. To obtain a copy of any of the above contractual safeguards, please contact us as set out at the end of this Privacy Policy.

Please note that our website, app and Leida services are accessible via the internet and may potentially be accessed by anyone around the world. Other users may access the website, app and Leida services from outside the EEA, Switzerland or the UK. This means that where you chose to post your information on our website or within the app or the Leida services, it could be accessed from anywhere around the world and therefore a transfer of your personal data outside of the EEA, Switzerland or the UK may be deemed to have occurred.

10. How we keep data secure

We have put in place appropriate security measures to prevent your information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. For example:

• All connections to our services use encryption in transit, including client routine pages

• Passwords are stored hashed, never in plain text

• Access to production systems is limited to those who need it

• Information is encrypted at rest as well as in transit

• Our database is backed up daily by our database provider, and backups are encrypted

• Each practitioner can only see their own clients’ information

• Two-factor authentication is switched on for every account that can access our production systems

Error monitoring. We use Sentry to tell us when part of Leida stops working. When something goes wrong, Sentry receives a technical report of where in the app the error happened. We've set it up so that these reports don't include names, email addresses, client details, what was typed into the app, or anything sent to or from our AI provider. Client ID numbers and email addresses are removed before a report leaves the app. Sentry stores this data in the EU and is listed with our other sub-processors.

No system is completely secure. If a breach occurs that is likely to result in a risk to people's rights and freedoms, we will report it to the ICO within 72 hours and tell affected people where required.

Where we have given you (or where you have chosen) a password which enables you to access certain parts of the website, app or Leida services, you are responsible for keeping this password confidential. We ask you not to share any password with anyone. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process information on our instructions and they are subject to a duty of confidentiality.

Unfortunately, the transmission of information via the Internet is not completely secure. Although we will endeavour to protect your information, we cannot guarantee the security of your personal data transmitted to our website, app or the Leida services. Any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

11. Third party links

Our website, app and Leida services may, from time to time, contain links to and from third party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. Please note that these third party websites, plug-ins and applications have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these third party websites, plug-ins or applications.

12. Data retention

We will only retain your information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements. We have set out in sections 3 - 7 how long this usually is, for each type of information that we collect.

We may however retain some personal data for a longer period, in the event of a complaint, if we reasonably believe there is a prospect of litigation in respect of our relationship with you, to comply with law enforcement requests, maintain security, prevent fraud and abuse, resolve disputes, enforce our legal agreements, or fulfil your request to “unsubscribe” from further messages from us.

Also, by law we have to keep basic information about our customers for 6 years after they cease being customers for tax purposes.

In some circumstances we will anonymise personal data (so that it can no longer be associated with you) after your account has been closed and we may use this anonymised data for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

Please note: After you have closed your account or deleted information from your account, any information you have shared with others will remain visible. We do not control data that other users may have copied from the website, app or Leida services. Your profile may continue to be displayed in the services of others (e.g. search engine results) until they refresh their cache

13. Your legal rights

Under UK data protection law you have the right to:

• Request access to your personal data (commonly known as a “subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

• Request rectification of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

• Request erasure of your personal data in certain circumstances. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

• Request restriction of the processing of your personal data. This enables you to ask us to suspend the processing of your personal data in one of the following scenarios: (i) if you want us to establish the data’s accuracy; (ii) where our use of the data is unlawful but you do not want us to erase it; (iii) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (iv) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

• Object to the processing of your personal data where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your data (including carrying out profiling based on our legitimate interests). In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object.

• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

• Object any time to the processing of your personal data for direct marketing purposes.

• Withdraw consent at any time where we are relying on consent to process your personal data as the legal basis for using your data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

To exercise any of these, email hello@askleida.com.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

We will try to respond to all legitimate requests within 30 days and will deal with requests we receive from you, in accordance with the provisions of applicable data protection laws. Occasionally it could take us longer, if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated..

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

When we respond, we will also remind you of your right to complain to the Information Commissioner's Office if you are located in the UK. That right is not conditional on coming back to us first.

If you are a client of a practitioner rather than a practitioner yourself, contact your practitioner first, since they control that data. We will support them in responding to you.

14. Cookies on our website (askleida.com)

We use cookies and similar technology on our website, askleida.com. Cookies are small text files that a website places on your device. They are widely used to make websites work, or work more efficiently, and to give the owners of the website information about how it is used.

Apart from remembering your cookie choice, we only set cookies if you accept them in our cookie banner. The cookies we use are:

We do not use advertising cookies and we do not track you across other websites.

You can set up your browser options, to stop your computer accepting cookies or to prompt you before accepting a cookie from the websites you visit. If you do not accept cookies, however, you may not be able to use the whole website.

To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit www.allaboutcookies.org. To opt out of being tracked by Google Analytics across all websites visit http://tools.google.com/dlpage/gaoptout.

Pixel tags in emails

Our marketing emails, sent through MailerLite, may contain a small image (a “pixel tag”) that tells us whether an email was opened. You can stop this by turning off image loading in your email app.

Do not track

We do not support Do Not Track (“DNT”).

Do Not Track is a preference you can set in your web browser to inform websites that you do not want to be tracked. You can enable or disable Do Not Track by visiting the “Preferences” or “Settings” page of your web browser.

15. Marketing Communications

We may use your information to form a view on which products, services and offers may be of interest to you so that we can send you relevant marketing communications.

Direct marketing: You will receive marketing communications if you “opt in” to receive marketing communications from us when you registered on our website or within the Leida services, or if you enquired about, or have purchased any of our goods or services and you have not opted out of receiving such marketing.

Third Party Marketing: We will obtain your express opt-in consent before we share your personal data with any third party for their own direct marketing purposes.

Opting out of Marketing: You can ask us to stop sending you marketing communications at any time by following the “opt out” or “unsubscribe” links within any marketing communication sent to you.

Once you “opt out” or “unsubscribe”, you will no longer receive any marketing communications from us. You will however still received service related communications that are essential for administrative or customer service purposes, for example relating to orders, billing, updates, checking that your contact details are up to date and support issues.

16. Complaints

Our intention is to meet the highest standards when collecting and using personal data. For this reason, we take complaints we receive very seriously. We encourage users to notify us if they think that our collection or use of personal data is unfair, misleading or inappropriate.

If you are unhappy with how we have handled your information, please send an email to: hello@askleida.com and we will try to put it right.

You do not need to use any particular words, mention any legislation, or use any particular route. If you tell us by email, in a reply to one of our emails, or by post to the address given at the end of this Privacy Policy, that is a complaint, we will treat it as one. You do not need an account or a login to make a complaint.

We will acknowledge your complaint within 5 working days, investigate it without undue delay, and tell you the outcome within 20 working days. If we are going to need longer, we will tell you before that deadline and give you a new date.

If your complaint is about client information held by a practitioner who uses Leida, for example if your details appear in records a practitioner entered about you, we will tell you promptly who that practitioner is so you can raise it with them directly, because they decide how that information is handled.

You also have the right to complain to the Information Commissioner's Office, whether or not you have contacted us first:

• ico.org.uk

• 0303 123 1113

• Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

17. Age of Users

This website, app and the Leida services are not intended for, and shall not be used by, anyone under the age of 18.

18. Changes to this policy

We keep our privacy policy under regular review. Any changes we may make to our privacy policy in the future will be posted on this page and, where appropriate, notified to registered users by email.

This Privacy Policy was last updated on 16 October 2026 and this version replaces any other Privacy Policy previously applicable, from this date.

19. Your duty to inform us of changes

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example: of a new address or email address.