Privacy Policy

Last updated: April 2025

Who we are

bfree operates this website and the bfree skin picking recovery programme. We are the data controller for the personal data described in this policy.

If you have any questions about how we handle your data, please contact us at hello@bfreeskin.com.

What data we collect and why

Account and subscription data

When you create an account or subscribe to bfree, we collect:

• Your name and email address
• Payment information (processed securely by our payment provider, we do not store your card details)
• Subscription status and billing history

We collect this data because it is necessary to perform our contract with you, to provide the bfree programme and manage your subscription.

Programme usage data

As you use the bfree programme, we may collect information about your engagement and progress. This helps us deliver the programme and improve it. The legal basis for this is our legitimate interest in providing a quality service.

Communications

If you contact us by email or through the site, we keep a record of that correspondence. We may send you emails about your subscription, programme updates, and (with your consent) newsletters or recovery guidance. You can unsubscribe from marketing emails at any time.

Website usage data

We collect standard technical information when you visit the site, including your IP address, browser type, and pages visited. This is used only for security, troubleshooting, and understanding how the site is used in aggregate.

Sensitive data

bfree is a programme for people who experience dermatillomania (skin picking). Information you share about your skin picking or mental health is considered sensitive personal data under UK GDPR. We treat it with the highest level of care. We will never share this information with third parties for any purpose other than delivering your programme, and only with your explicit consent.

Who we share your data with

We work with a small number of trusted third-party services to operate bfree:

• Payment processor, to handle subscription billing securely. They receive your payment data only for this purpose.
• Email service provider, to send transactional emails (receipts, account notices) and, with your consent, programme content.
• Hosting provider, our website and platform are hosted on secure UK or EEA infrastructure.

We do not sell your personal data. We do not share it with advertisers. All third parties we use are contractually required to protect your data and use it only as instructed by us.

How long we keep your data

• Account and subscription data is kept for the duration of your subscription and for six years after it ends, for financial and legal record-keeping purposes.
• Programme usage data is kept for as long as your account is active and for up to two years after.
• Marketing consent records are kept for as long as you remain subscribed to marketing, and for one year after you unsubscribe.
• Website log data is retained for a maximum of 90 days.

Your rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access, you can ask for a copy of the personal data we hold about you.
• Right to rectification, you can ask us to correct inaccurate data.
• Right to erasure, you can ask us to delete your data in certain circumstances.
• Right to restrict processing, you can ask us to limit how we use your data.
• Right to data portability, you can ask for your data in a portable format.
• Right to object, you can object to processing based on legitimate interests or for direct marketing.
• Rights related to automated decision-making, we do not make decisions about you using automated systems.

To exercise any of these rights, email us at hello@bfreeskin.com. We will respond within one month.

Cookies

We use essential cookies to keep you logged in and to make the site function. We may use analytics cookies to understand how the site is used in aggregate. We do not use advertising or tracking cookies.

You can control cookies through your browser settings. Disabling essential cookies will affect your ability to use the site.

Security

We take reasonable technical and organisational steps to protect your data from unauthorised access, loss, or disclosure. Payment data is handled exclusively by our PCI-DSS compliant payment processor and is never stored on our systems.

Changes to this policy

We may update this policy from time to time. If we make significant changes, we will let you know by email or by a notice on the site. The date at the top of this page shows when it was last updated.

How to complain

If you have concerns about how we handle your data, please contact us first at hello@bfreeskin.com and we will do our best to resolve it.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.