Privacy Notice

Dr Charlotte Aesthetics Clinic

Last updated: September 2026

Dr Charlotte Aesthetics Clinic takes your privacy and the confidentiality of your personal and medical information seriously.

This Privacy Notice explains what information we collect about you, why we collect it, how it is used and stored, who it may be shared with, and your rights in relation to your personal information.

1. Who is responsible for your information?

Dr Charlotte Aesthetics Clinic is the data controller for the personal information processed in connection with your care and use of our services.

Data Controller:
Dr Charlotte Aesthetics Clinic
Mytchett, Surrey

For any questions about how your information is used, or to exercise your data protection rights, please contact the clinic.

2. What information do we collect?

We may collect and process information including:

• your name, date of birth and contact details;
• your address;
• emergency contact details where appropriate;
• appointment and booking information;
• medical history;
• current and previous medical conditions;
• medications and allergies;
• pregnancy or breastfeeding status where clinically relevant;
• previous aesthetic treatments;
• information you provide during consultations;
• clinical assessments and treatment plans;
• consent forms;
• prescriptions and information relating to prescribed medicines;
• details of treatments and products administered;
• product information including batch numbers where relevant;
• treatment outcomes and review information;
• clinical correspondence;
• clinical photographs;
• information relating to complications, adverse events or concerns;
• payment and transaction information;
• communications between you and the clinic, including relevant email, telephone, SMS or WhatsApp communications;
• complaints or feedback; and
• marketing preferences.

Some of this information, particularly information about your physical or mental health and treatment, is classed as special category personal data and receives additional protection under data protection law.

3. Why do we collect your information?

We collect and use personal information where necessary to:

• arrange and manage appointments;
• communicate with you about your appointments and care;
• assess whether treatments are appropriate and safe for you;
• provide consultations, treatment and aftercare;
• prescribe and manage medicines where appropriate;
• maintain accurate clinical records;
• monitor treatment outcomes;
• manage complications, adverse events and follow-up care;
• process payments and maintain appropriate financial records;
• respond to questions, concerns and complaints;
• maintain patient safety;
• comply with our professional, regulatory, insurance, tax and legal obligations;
• establish, exercise or defend legal claims where necessary;
• manage and improve the operation of the clinic; and
• send marketing communications where permitted by law.

We will only collect information that is relevant and reasonably necessary for these purposes.

4. Our lawful basis for using your information

Under UK data protection law, we must have a lawful basis for processing your personal information.

Depending on the circumstances, we may process your personal information because:

• it is necessary to provide a service or treatment you have requested or to take steps at your request before providing that service;
• it is necessary to comply with a legal obligation;
• it is necessary for our legitimate interests in operating and protecting the clinic, provided those interests do not override your rights and interests;
• it is necessary to establish, exercise or defend legal claims; or
• you have provided consent where consent is the appropriate lawful basis.

Because we process information concerning your health, we must also satisfy an additional condition for processing special category data. Where applicable, health information is processed where necessary for the provision and management of health treatment or care by, or under the responsibility of, a healthcare professional who is subject to professional confidentiality obligations.

Where another legal condition is more appropriate to a particular situation, we will rely upon that condition.

5. Clinical records

As a medical aesthetics clinic, we have professional and legal responsibilities relating to the information recorded about your care.

Your clinical record may include your consultation, medical history, assessment, treatment plan, consent, prescriptions, treatment provided, product and batch information, clinical photographs, aftercare, reviews and relevant communications.

Clinical records are confidential and are used to support safe and appropriate care.

You cannot normally require information forming part of your clinical record to be deleted simply because you no longer wish to receive treatment from the clinic where we have an ongoing legal, regulatory or professional reason to retain that information.

6. Clinical photographs

Clinical photographs may be taken where appropriate to document your presentation, support assessment and treatment planning, and monitor treatment outcomes.

Where photographs form part of your clinical record, they will be treated as confidential medical information.

Clinical photography is separate from marketing photography.

We will not use identifiable clinical photographs on social media, our website, advertisements or other promotional materials without obtaining separate permission for that use.

You can decline marketing use of your photographs without this affecting your treatment or care.

7. Appointment communications

We may use your contact details to send information necessary for the administration of your care, including:

• booking confirmations;
• appointment reminders;
• requests to complete medical or consent forms;
• information about changes to your appointment;
• aftercare information;
• review reminders; and
• communications relating to your treatment or clinical care.

These are service or clinical communications rather than marketing communications.

8. Marketing communications

We may occasionally send information about clinic services, treatments, events or other relevant updates where you have consented to receive marketing or where another lawful basis for the communication applies.

Where consent is used, agreeing to marketing is optional and is not a condition of receiving treatment.

You can change your mind and unsubscribe from marketing communications at any time.

Opting out of marketing will not stop essential communications relating to your appointments, treatment or care.

9. Who may we share your information with?

Your information will not be sold.

Where necessary and appropriate, information may be shared with carefully selected third parties involved in providing or supporting your care or the operation of the clinic.

This may include:

• prescribing professionals and pharmacies where relevant to your care;
• other healthcare professionals where necessary for your treatment or safety;
• laboratories or clinical service providers where applicable;
• our patient record and booking software provider;
• payment processing providers;
• IT, communications and secure data-storage providers;
• professional advisers, including accountants, insurers and legal advisers, where appropriate;
• complication-management services where clinically necessary;
• professional or regulatory bodies where we are required or professionally obliged to provide information; and
• law enforcement agencies, courts or other authorities where disclosure is required by law.

We only share information that is reasonably necessary for the relevant purpose.

Where organisations process personal information on our behalf, we expect appropriate confidentiality, security and data protection arrangements to be in place.

10. Aesthetidocs and other digital systems

Dr Charlotte Aesthetics Clinic uses electronic systems to help manage patient records, appointments, forms and communications.

This includes Aesthetidocs, which may process personal and health information on behalf of the clinic in order to provide its patient-management services.

We may also use other appropriately selected providers for functions such as payment processing, communications, accounting and secure information storage.

Use of third-party providers does not remove our responsibility for ensuring your personal information is handled appropriately.

11. WhatsApp, email and electronic communication

If you choose to communicate with the clinic by WhatsApp, email, SMS or another electronic method, your information may also be processed by the relevant communications provider.

Although reasonable steps are taken to protect confidentiality, electronic communications can carry privacy and security risks.

Where information from electronic communications is clinically relevant, it may be added to your medical record.

Please avoid sending highly sensitive information through informal communication channels unless necessary.

12. How long do we keep your information?

We keep personal and clinical information only for as long as reasonably necessary to fulfil the purposes for which it was collected and to meet applicable medical, professional, regulatory, insurance, tax and legal requirements.

Different categories of information may therefore be retained for different periods.

When information is no longer required, it will be securely deleted, destroyed or anonymised as appropriate.

13. How do we protect your information?

We take reasonable technical and organisational measures to protect personal information from unauthorised access, disclosure, alteration, loss or misuse.

Measures may include:

• password-protected systems;
• access controls;
• secure electronic record systems;
• appropriate device and account security;
• secure storage of records;
• limiting access to those who need the information; and
• appropriate confidentiality procedures.

No system can guarantee absolute security, but we take the protection of your personal and medical information seriously.

14. International transfers

Some technology or service providers may process or store information outside the United Kingdom.

Where personal information is transferred internationally, we will take appropriate steps to ensure that the transfer complies with applicable UK data protection requirements and that appropriate safeguards are in place where required.

15. Your data protection rights

Depending on the circumstances, you may have the right to:

• ask for confirmation that we hold information about you;
• request a copy of your personal information;
• ask us to correct inaccurate or incomplete information;
• request deletion of your information in certain circumstances;
• request restriction of processing in certain circumstances;
• object to certain uses of your information;
• request transfer of certain information to you or another organisation where the right to data portability applies;
• withdraw consent where processing is based on consent; and
• object to direct marketing at any time.

These rights are not absolute and may not apply in every situation.

For example, we may need to retain clinical records despite a request for deletion where we have a lawful, professional or regulatory reason to do so.

If you would like to exercise any of these rights, please contact Dr Charlotte Aesthetics Clinic.

16. Requests for access to your records

You have the right to request access to personal information held about you, subject to applicable legal restrictions.

We may need to verify your identity before releasing information.

We will respond to requests within the timeframe required by data protection law.

17. Complaints about the use of your information

If you have concerns about how your personal information has been handled, please contact Dr Charlotte Aesthetics Clinic in the first instance so that we can investigate and respond.

You also have the right to raise a concern with the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

Further information is available from the Information Commissioner's Office.

18. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in the law, professional guidance, clinic processes or the services and systems we use.

The current version will be made available through the clinic's booking system and/or other appropriate channels.

Dr Charlotte Aesthetics Clinic
Mytchett, Surrey

Last updated: September 2026