How we handle your information

Who we are

By Narjis Limited, trading as By Narjis, 17 Thayer Street, London W1U 3JX. We are the data controller for the information described here. For anything on this page, write to [email protected] or call +44 7888 687194.

The website

There are no accounts, carts or newsletters on this site. The one place you can type anything is the chat, described below. Three things still happen automatically when you visit:

• Hosting. The site is served by Cloudflare Pages. Like any web host, Cloudflare processes your IP address and request details to deliver pages and to protect the site from attacks.
• Typefaces. Our typefaces are loaded from Google Fonts, so Google receives your IP address when a page loads. Nothing else about you is sent, and we can serve them from our own server instead if you would rather that didn't happen — just ask.
• Google Analytics and Google Ads. Google's tag loads on every page so we can see how the site is used and which of our ads work. It sets no cookies unless you accept them, and what it sends Google is limited; see Cookies, Google Analytics and Google Ads.

Booking online

When you choose a time, you go to our online booking pages, run for us by Pabau, the clinic system we use for appointments and records. What you enter there — your name, contact details, the appointment you choose and any forms you complete — comes to us, and Pabau holds it on our behalf under a contract with us. We use it to arrange and confirm your appointment, remind you of it, and prepare for your consultation. Pabau's booking pages are its own website, so they may set cookies of their own to make booking work; its privacy policy explains them. Once your booking is made, they bring you back to a confirmation page on this website.

Cookies, Google Analytics and Google Ads

We use two Google services, both run by Google Ireland Limited. Google Analytics shows us, in totals, how the site is used: which pages are visited, how people arrive (from a search, an ad or Instagram, say), the kind of device and browser, roughly where in the world, and how long visits last. Google Ads shows us which of our ads work: we count three things, a tap on one of our WhatsApp buttons, a tap on our phone number and a booking made online, which is counted when you arrive on that confirmation page. We don't send Google your name, your number, what you booked, your messages, or anything you type into the chat.

If you press Accept on the cookie banner, Google sets cookies in your browser: Google Analytics' (their names begin _ga, and they last up to two years) recognise a returning browser, and Google Ads' (beginning _gcl, up to 90 days) connect a tap or a booking to the ad that brought you here and let Google show our ads to people who have visited this site. Google explains how it uses information from sites like ours, and its privacy policy covers what it receives, which it may process in the United States under its own data-transfer safeguards.

If you press Reject, or never choose, Google sets no cookies. Its tag still sends Google a few cookie-free signals, that a page was viewed, one of those buttons was tapped or a booking was made, along with the details any web request carries, such as your browser type and IP address. Google uses them to estimate, in total, how the site and our ads perform.

Until you choose, a few short codes also travel from page to page in the address of the links you follow on this site, rather than in a cookie: the code Google adds to our ads' links, if an ad brought you here, and random codes for your visit. That way, if you look around first and accept on a later page, Google can still tell which ad brought you. Once you press Reject, they stop.

You can change your mind at any time with Cookie settings at the foot of every page. If you reject after accepting, we remove the Google cookies this site can reach.

The site also keeps two small notes in your browser, and neither leaves your device: one in session storage, that you have seen the opening animation, so it doesn't play again while your tab is open (it disappears when you close the tab); and one in local storage, your cookie choice, so the banner doesn't ask again. The chat's bot check (below) only runs if you open the chat.

We use no analytics, advertising or tracking tools other than these two. If that changes — for example if we add a booking calendar or a live Instagram feed, which set cookies of their own — we will say so here and ask for your consent first where the law requires it.

The chat

The "Ask us" chat answers questions using our treatment menu. Nothing to do with it loads until you open it.

• Your messages are sent to Anthropic, the company that provides the AI, so it can write each reply. Under its commercial terms Anthropic does not use them to train its models, and deletes them within 30 days unless it must keep them longer to enforce its usage policy or by law. We keep no copy: the conversation lives in your browser tab and is gone when you close it.
• If you ask the team to contact you, the details you enter — your name, email, mobile and how you'd like to be contacted — and a short summary of what you asked about go into our clinic system, Pabau, as an enquiry. We use them only to answer that enquiry. Ticking the box agrees to that, not to marketing.
• The bot check. When you open the chat, Cloudflare Turnstile checks that you are a person rather than a program, using technical signals such as your IP address and browser details. Cloudflare describes these as strictly necessary for that check; see its Turnstile privacy addendum.
• Limiting misuse. To stop the chat being misused, we count the messages and enquiries that arrive from each connection each day. We keep only a coded form of your IP address, never the address itself, and it is deleted within two days.

Please don't share medical details in the chat. Our practitioners go through your history with you at your consultation.

When you get in touch

The buttons on this site open WhatsApp, your phone or your email app. Messages you send us that way are handled by those services under their own terms — WhatsApp is operated by Meta. We use what you tell us to answer your question, arrange an appointment and, if you become a client, to give you safe care. We do not sell it, and we do not send marketing you have not asked for.

Becoming a client

If you book a treatment, the clinic keeps consultation and treatment records. Those are held securely, used only for your care and for the legal and insurance obligations that apply to a medical clinic, and kept for as long as those obligations require. Ask us at your appointment and we will explain exactly what is recorded.

Other people's services

Links to Instagram, TikTok, WhatsApp and Google take you to companies with their own privacy policies; once you leave this site you are in their hands, not ours. Reviews shown on this site are copies of public reviews our clients left on Google; we do not load Google's review widget or its scripts.

Your rights

Under UK data protection law you can ask us for a copy of the information we hold about you, ask us to correct or delete it, ask us to restrict or stop using it, and object to how we use it. Email [email protected] and we will respond within one month.

If you are unhappy with our answer, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes

When this page changes, the date at the top changes with it. If we start collecting anything else, we will update this page before it goes live, and ask for your consent first where the law requires it.