Version 1.1 — last updated 31 July 2026. This version adds a section on how we handle comments and messages on our social media accounts, and corrects the Enhance-Her web address. Material changes will be notified to active members and customers.

Who we are and what this policy covers

This Privacy Policy is operated by Precision Life&Style Group Ltd (company number 17017520), registered in England and Wales with registered office at 6 Minshull Street, Piccadilly, Manchester, M1 3ED. We are the data controller for personal data collected through the group’s brands and websites.

This single policy covers all PLG brand websites and services, including:

• Menhancements — menhancements.co.uk (men’s aesthetic and sexual-wellness services)
• Wax for Men — waxformen.co.uk (men’s waxing)
• Wax for Women — waxforwomen.co.uk (women’s waxing and the Unlimiwax membership)
• Wax for All — waxforall.co.uk (LGBTQ+ inclusive waxing, launching)
• Enhance-Her — enhance-her.co.uk (women’s skin and aesthetic treatments)
• Unlimiwax, Unlimitox and Unlimitan — subscription products operated under the brands above
• This corporate site at plguk.com

We are registered with the Information Commissioner’s Office as a UK GDPR data controller (registration reference ZC157556). Contact us at info@plguk.com or 0161 564 4406.

What personal data we collect

We collect personal data in the following circumstances:

• When you book a treatment — name, contact details (email, phone), the treatments you book, the studio location, and any relevant medical history we ask about for safety reasons.
• When you sign up to an Unlimiwax, Unlimitox or Unlimitan membership — the above plus payment details (handled by Stripe) and your treatment preferences for the membership.
• When you receive a clinical treatment (at Menhancements or Enhance-Her) — additional medical history, consent records, treatment notes, before/after photographs where you have consented, prescriber correspondence. Clinical records are kept in our regulated clinical system (AestheticsDocs). Pre-treatment health screening may also be held in our own secure systems, where access is restricted to a small number of named directors.
• When you contact us — the contents of your message.
• When you visit any of our websites — non-identifying technical data via cookies and analytics (see our Cookie Policy on the specific brand site).
• When you comment on or message one of our social media accounts — your social media username or display name, the content of your comment or message, and the time you sent it.

Why we use your data and our lawful basis

Under UK GDPR we must have a lawful basis for processing your personal data. We rely on:

• Performance of a contract — to deliver treatments you have booked or subscribed to.
• Legitimate interest — to operate, secure and improve our service, send service-related communications, reply to comments and messages you send us on social media, and manage our business.
• Consent — for marketing communications and non-essential cookies. You can withdraw consent at any time.
• Legal obligation — where we have to keep records for tax, accounting, healthcare regulation or other statutory reasons.
• Vital interests — where processing health-related information is needed to keep you safe during a treatment.

Special category data (health)

Some of our treatments require us to collect health information — allergies, current medication, pregnancy, skin conditions, sexual health where relevant to a Menhancements treatment. This is “special category” data under UK GDPR. We process it on the basis of Article 9(2)(h) (provision of health care) and only to the extent needed to deliver the treatment safely.

Clinical records are held in our regulated clinical system, separately from our customer-marketing database. We do not use health information for marketing.

Comments and messages on our social media accounts

When you comment on a post from one of our brand accounts, we receive your username, the text of your comment, and a link to it. We use this to reply to you. The comment itself stays on the social media platform, which is operated by Meta under its own privacy policy.

We use an AI tool to help draft replies — and a person always checks them

To reply quickly and consistently, we use an artificial intelligence service (Claude, provided by Anthropic PBC) to suggest a draft reply. Nothing is ever posted automatically. A member of our team reads every suggested reply and approves, edits or rejects it before anything appears. No decision that affects you is made by the AI, and no automated decision-making within the meaning of Article 22 of the UK GDPR takes place.

If your comment mentions your health, it is handled differently

Some of our brands deal with men’s health, hair loss, skin and intimate waxing, and people sometimes mention their own health when they comment. We have an automatic screen that looks for this before anything is sent to the AI service. If it detects health information, your comment is not sent to the AI service at all, is not used to shape any future replies, and is passed to a member of our team to answer personally.

Where we do process health information you have included in a public comment, we rely on Article 9(2)(e) of the UK GDPR — information that you have manifestly made public yourself. We do not add it to your customer record, we do not use it for marketing, and we do not share it with our clinical systems or our prescriber.

Our lawful basis, and how to object

We rely on our legitimate interest in replying to people who contact us publicly, and in making sure those replies are accurate and compliant with the rules that apply to health and aesthetics advertising. We have carried out a balancing assessment and you can ask us for a summary of it.

You can object to this processing or ask us to delete your comment data at any time by emailing info@plguk.com with the username you commented under. We will remove it from our systems and stop processing further comments from that username. Deleting the comment from the social media platform itself is something you control directly through the platform.

Who we share data with

We share personal data only with service providers who help us deliver the service. Each is a data processor under written terms and bound by UK GDPR equivalents:

• Fresha — booking system and customer scheduling.
• AestheticsDocs — clinical records system for Menhancements and Enhance-Her medical treatments.
• Stripe — card and Direct Debit payments for treatments and for Unlimi- memberships.
• HubSpot — customer relationship management and customer communications.
• Email and SMS providers — sending booking confirmations and reminders.
• Anthropic PBC — the AI service that drafts suggested replies to social media comments. Bound by a data processing agreement which prohibits using your data to train its models.
• Hetzner Online GmbH — hosting for some of our internal systems, on servers in Germany.
• Our accountants and professional advisers — for compliance with our legal obligations.
• Dr Phillip Lane (GMC registered, our Consultant Medical Adviser) — for prescriber sign-off on Prescription-Only Medicines used at Menhancements and (where relevant) Enhance-Her.

We do not sell or rent personal data to third parties.

International transfers

Some of our service providers store or process data on servers outside the UK. HubSpot, Stripe and Anthropic are in the United States; Hetzner is in Germany. Where data leaves the UK we rely on UK-approved transfer mechanisms — the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, an adequacy decision, or an equivalent safeguard. We have assessed the risks of the transfer to Anthropic in particular and you can ask us for a summary of that assessment.

How long we keep data

• Active customer records — for as long as you are an active customer, plus 7 years for tax and accounting purposes.
• Treatment / clinical history records — minimum 8 years (in line with healthcare records guidance) where retained.
• Marketing data — until you opt out, plus a short period to record that you have opted out.
• Social media comments and our replies — 6 months for the comment record, 12 months for the record of who approved the reply. Anthropic deletes anything sent to it within 30 days.
• Cookies and analytics data — see the Cookie Policy on the specific brand site.

Your rights

Under UK GDPR you have the right to:

• Ask us what personal data we hold about you (Subject Access Request).
• Correct inaccurate data.
• Have your data erased where the law allows.
• Restrict how we use your data.
• Object to processing based on legitimate interests or for marketing.
• Withdraw consent at any time where we rely on consent.
• Receive your data in a portable format and ask us to send it to another controller.

To exercise any of these rights, email info@plguk.com. We will respond within one month.

Complaints

If you are unhappy with how we handle your data, please tell us first — we will do our best to put it right. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk / 0303 123 1113).

Updates

We update this policy from time to time. The current version is shown at the top of this page. Material changes to how we use customer or member data will be communicated by email to active customers and members.