Privacy Policy
Last updated: 19.08.2026
Ilu Hub collects personal information from you – some of it about your skin and your health. This page sets out what we collect, why we need it, where it’s stored, who can see it, and what you can ask us to do with it.
We handle your information in accordance with the Privacy Act 2020.
1. Who we are
Ilu Hub is a skin therapy studio in Wānaka, New Zealand, owned and operated by Anneli Glazebrook.
2. What we collect
When you book or attend a treatment
- your name, email address, phone number and postal address
- your date of birth
- appointment history and treatment notes
- consultation information: skin concerns and history, general health, medical conditions, medications and supplements, allergies and sensitivities, previous treatments and procedures, pregnancy or breastfeeding status, and lifestyle factors relevant to your skin
- clinical photographs of your skin, where you have consented to them
- skin analysis readings (for example moisture and barrier readings, and Wood’s lamp observations)
- your consent records and signed intake forms
When you buy from our online shop
- your name, email address, phone number, billing address and delivery address
- your order history and what you’ve purchased
- payment confirmation details – we never see or hold your full card number
When you subscribe to our newsletter or read our writing
- your email address, your name if you give it, and which emails you open or click
When you use our website
- your IP address, browser type and device information
- pages you visited and how you arrived at our site
- information stored in cookies (see section 8)
When you contact us
- whatever you choose to tell us in an email, message, form submission or phone call
3. Why we collect it
We use your information to:
- provide your treatment safely and choose products and protocols that suit your skin
- identify contraindications – this is why we ask about medical conditions, medications and pregnancy, and why incomplete answers can put you at risk
- track how your skin responds over time, so we can adjust what we’re doing
- manage your bookings, send confirmations and reminders, and follow up after a treatment
- process and deliver your orders, and handle returns and enquiries
- send you newsletters and skin education if you’ve subscribed
- meet our record-keeping and legal obligations
- improve our website and our services
We don’t use your consultation information for marketing. Health and skin information you give us in a consultation stays in your clinical record – it isn’t used to target you with products or offers.
4. Your health and skin information
Consultation records deserve a separate word, because they’re the most sensitive thing we hold.
- They’re kept confidential and treated to health information standards.
- Access is limited to Anneli. Ilu Hub is a single-practitioner studio, so no one else works with your file.
- We don’t discuss your treatment with anyone else without your permission — including family members.
- Clinical photographs are stored securely and used only for your own record and treatment planning.
Photographs. We will never use your photographs publicly — on our website, on social media, in our newsletter or in Skin Speaks — without asking you first and getting your explicit consent for that specific use. Consenting to photographs for your clinical record is not consent to publish them. You can withdraw consent to publication at any time, and we’ll remove the images from anywhere we control going forward.
If you’d rather not answer something, tell us. You’re entitled to decline. Just be aware that if we don’t have enough information to treat you safely, we may need to modify or decline a treatment.
5. Who we share it with
We don’t sell your information, and we don’t share it for anyone else’s marketing.
We use the following service providers, who hold or process information on our behalf:
| Provider | What it handles |
|---|---|
| SiteGround | Website hosting |
| WordPress / WooCommerce | Website, online shop and order records |
| Stripe | Payment processing |
| [SimplyBook.me / Acuity Scheduling] | Appointment bookings and reminders |
| Airtable | Client records, consultation notes and purchase history |
| MailerLite | Newsletter subscriptions and sending |
| [Beehiiv / Substack] | Public newsletter and article subscriptions |
| NZ Post / [COURIER] | Delivery of your orders |
These providers can only use your information to provide their service to us.
We may also disclose information where the law requires it, where it’s necessary to prevent a serious threat to someone’s health or safety, or to our accountant or professional advisers where needed.
6. Where your information is stored
Most of the services above store data on servers outside New Zealand, including in Australia, the United States and the European Union.
Before using an overseas provider we take reasonable steps to satisfy ourselves that your information will be protected by safeguards comparable to those in the Privacy Act 2020, as required by that Act. That said, information held overseas may be subject to the laws of the country it’s held in.
If you’d prefer your consultation records not be stored on an overseas service, talk to us and we’ll discuss what we can do.
7. How long we keep it
- Consultation and treatment records: at least 10 years from your last treatment, in line with health record retention practice.
- Order and payment records: at least 7 years, as required for tax purposes.
- Newsletter subscriptions: until you unsubscribe.
- Website analytics: typically up to 26 months.
We securely delete or de-identify information once we no longer need it.
8. Cookies and website tracking
Our website uses cookies — small files stored on your device — to keep your shopping cart working, remember you between visits, and understand how the site is used.
We use:
- Essential cookies: required for the shop, cart and checkout to function. The site won’t work properly without these.
- Analytics cookies: Google Analytics to see which pages are visited and how people find us. This data is aggregated, not tied to your name.
- Marketing cookies: Meta Pixel
You can block or delete cookies through your browser settings. Blocking essential cookies will stop the shop from working.
9. Comments and media on our site
If you leave a comment on our site, we collect the information in the comment form, plus your IP address and browser details, to help detect spam.
If you upload images, please avoid uploading images with embedded location data (EXIF GPS), as visitors can download and extract that data.
10. Security
We take reasonable steps to protect your information from loss, misuse and unauthorised access. This includes password protection, secure encrypted connections on our website, restricted access to client records, and reputable service providers.
No system is completely secure. If we ever experience a privacy breach that could cause you serious harm, we’ll notify you and the Office of the Privacy Commissioner as the Privacy Act 2020 requires.
11. Your rights
Under the Privacy Act 2020 you have the right to:
- Ask what we hold about you and request a copy, including your consultation notes and photographs.
- Ask us to correct it if something’s wrong. If we don’t agree a correction is needed, you can ask us to attach a statement of the correction you sought, and we will.
- Withdraw consent to marketing at any time — every newsletter has an unsubscribe link, or just email us.
- Ask us to delete information, though we may need to keep some records for the retention periods in section 7.
Email anneli@iluhub.co.nz to make a request. We’ll respond as soon as we can and within 20 working days. There’s no charge.
12. Complaints
If you’re unhappy with how we’ve handled your information, please tell Anneli first – most things are quickly sorted.
If you’re not satisfied with our response, you can complain to the Office of the Privacy Commissioner:
Website: privacy.org.nz
Phone: 0800 803 909
Email: enquiries@privacy.org.nz
13. Children
Our online shop is intended for adults. We treat clients under 16 only with the consent of a parent or guardian, who we ask to attend the consultation.
14. Changes to this policy
We may update this policy from time to time. The current version is always the one published on this page, and the date at the top tells you when it last changed. If we make a significant change to how we use your information, we’ll let you know.
15. Contact us
Anneli Glazebrook
Email: hello@iluhub.co.nz