Privacy Policy

For the purposes of UK data protection law, the data controller is:

Trading as Privé Skin Clinic
54 Knightsbridge
London
SW1X 7JN
United Kingdom

Email: hello@priveskinclinic.com
Telephone: +44 7570 153825

Website: priveskinclinic.com

References in this policy to “Privé”, “Privé Skin Clinic”, “we”, “us” or “our” mean the data controller identified above.

For privacy-related enquiries or to exercise your data protection rights, please contact us using the details above.

The information we collect depends on your relationship with Privé and the services you use.

Identity and contact information

This may include your:

• name;
• date of birth;
• postal address;
• email address;
• telephone number;
• account and client identifiers; and
• emergency contact details where appropriate.

Booking and account information

This may include:

• appointments and appointment history;
• cancellations, rescheduling and attendance;
• practitioner information;
• deposits and prepayments;
• packages and account balances;
• booking notes;
• communications relating to appointments; and
• information contained within your Privé online account.

Health and clinical information

To provide safe and appropriate treatments, we may collect information concerning your health. This is special category personal data and receives additional protection under data protection law.

Depending on the treatment or service, this may include:

• medical history;
• current and previous health conditions;
• medications and prescriptions;
• allergies;
• contraindications;
• previous treatments and procedures;
• pregnancy or breastfeeding information where clinically relevant;
• consultation and assessment information;
• clinical notes and treatment records;
• treatment plans;
• products, medicines, doses, batch numbers and treatment areas;
• treatment outcomes and responses;
• adverse events or complications;
• aftercare and follow-up information;
• prescriber or other healthcare-professional assessments; and
• other information that is reasonably necessary to assess suitability, provide treatment safely and maintain an appropriate clinical record.

Please provide accurate and current information and tell us if relevant health information changes.

Photographs and images

We may take clinical photographs or other images before, during or after treatment where appropriate for purposes such as:

• clinical assessment;
• treatment planning;
• documenting treatment and progress;
• monitoring outcomes;
• clinical record keeping; and
• managing complications or follow-up care.

Clinical photographs form part of your confidential treatment record where taken for these purposes.

We will obtain appropriate permission before using identifiable client photographs for separate purposes such as advertising, our website, social media, training or promotional materials where consent is required.

Agreeing to treatment does not automatically mean agreeing to the promotional use of your photographs.

Payment and transaction information

We may process information relating to:

• treatment and product purchases;
• invoices and receipts;
• deposits and prepayments;
• refunds;
• transaction amounts and dates;
• payment status; and
• limited payment information supplied by our payment providers.

Card payments may be processed by third-party payment providers. We do not intend to store complete payment-card details within our clinic systems where those details are handled securely by the relevant payment processor.

Communications

We may retain communications you have with us through channels including:

• email;
• telephone;
• SMS;
• WhatsApp or other messaging services;
• website forms;
• online booking;
• social media messages; and
• communications through your client account.

This may include enquiries, appointment discussions, clinical communications, complaints, feedback and customer-service requests.

Website and technical information

When you use our website, we may collect certain technical information, depending on your cookie choices and the technologies in use, such as:

• IP address;
• browser and device information;
• operating system;
• website usage;
• pages viewed;
• referral information;
• approximate location derived from technical information;
• cookie identifiers; and
• analytics information.

Please see our Cookie Policy for further information.

Marketing preferences

We may record whether you have agreed to receive marketing, the channels through which you wish to hear from us, and any subsequent opt-out or unsubscribe request.

Feedback and reviews

If you provide feedback or a review, we may process:

• your feedback;
• ratings;
• review-request history;
• whether a review link was opened where our systems support this;
• correspondence relating to feedback;
• complaint or service-improvement information; and
• whether we have recorded that a public review has been received.

Reviews posted directly to third-party platforms, such as Google, are also subject to that platform’s privacy terms and policies.

We may obtain personal information:

• directly from you;
• through our website;
• through our booking system or client portal;
• during consultations and treatments;
• through telephone, email, SMS or messaging services;
• when you purchase a treatment, package or product;
• from forms and questionnaires you complete;
• from a prescriber or healthcare professional involved in your care where appropriate;
• from payment providers;
• from someone booking on your behalf where appropriate;
• from publicly available sources or review platforms where relevant; and
• automatically through cookies and similar technologies, subject to applicable requirements and your choices.

We may use personal information where necessary to:

• respond to enquiries;
• arrange consultations and appointments;
• create and manage your client account;
• assess treatment suitability;
• provide safe and appropriate treatment and care;
• maintain accurate clinical and treatment records;
• prescribe, supply or administer treatments where applicable;
• provide aftercare and follow-up;
• contact you about clinically relevant matters;
• manage appointments, cancellations and reminders;
• process payments, deposits, prepayments and refunds;
• issue invoices and receipts;
• manage packages and purchases;
• fulfil contractual obligations;
• manage complaints, incidents and adverse events;
• comply with professional, regulatory, insurance, accounting, tax and legal requirements;
• establish, exercise or defend legal claims;
• prevent and investigate fraud, misuse or security incidents;
• operate and secure our website and systems;
• understand and improve our services and client experience;
• request genuine client feedback or reviews where permitted;
• maintain records of marketing preferences and objections; and
• send marketing communications where permitted by law.

We do not sell your personal information.

Under the UK GDPR, we must have a lawful basis for processing personal information.

Depending on the particular activity, our lawful bases may include:

Contract — where processing is necessary to take steps at your request before entering into a contract or to provide services you have agreed to purchase.

Legal obligation — where processing is necessary for us to comply with applicable legal or regulatory requirements.

Legitimate interests — where processing is necessary for our legitimate business or operational interests, provided those interests are not overridden by your rights and freedoms. These interests may include operating and improving our clinic, maintaining appropriate records, protecting our business and systems, managing client relationships and providing effective customer service.

Consent — where we specifically ask for your consent and consent is the appropriate legal basis. Where processing relies on consent, you may withdraw that consent at any time. Withdrawal does not make earlier processing unlawful.

In limited circumstances, another lawful basis recognised by UK data protection law may apply.

Health information is treated as special category personal data under the UK GDPR and receives additional protection.

Where we process health or other special category information, we must have both an appropriate lawful basis under Article 6 UK GDPR and a separate condition under Article 9 UK GDPR.

Depending on the particular processing and the nature of the service, the applicable Article 9 condition may include processing necessary for the provision or management of health care or treatment where the legal requirements for that condition are satisfied, or explicit consent where this is the appropriate condition.

Other conditions may apply where specifically permitted or required by law, including where information is necessary for the establishment, exercise or defence of legal claims.

We limit access to clinical information to those who require it for legitimate clinical, operational or legal purposes.

We may contact you regarding your appointments or care, including:

• booking confirmations;
• appointment reminders;
• requests to confirm attendance;
• changes to appointments;
• deposit or payment information;
• pre-treatment information;
• aftercare;
• review appointments;
• clinically relevant follow-up; and
• communications concerning treatment safety.

These service and clinical communications are different from promotional marketing communications.

Where permitted by law, we may contact you about Privé treatments, services, events, clinic news or other relevant information.

Depending on the circumstances and communication channel, we may rely on your consent or another mechanism permitted under PECR, including the existing-customer “soft opt-in” where all legal requirements are satisfied.

You can opt out of marketing at any time by:

• using the unsubscribe option contained in a marketing communication; or
• contacting us at hello@priveskinclinic.com.

Opting out of marketing will not prevent us from sending necessary administrative, booking, payment, safety or clinical communications.

We may invite genuine clients to provide feedback about their experience or to leave a review.

Where we send you a link to an independent review platform, any review you choose to publish is submitted by you to that platform and is governed by the platform’s own terms and privacy practices.

Private feedback provided directly to Privé may be used internally to understand and improve our service.

We will not publish private feedback identifying you as a testimonial on our website, social media or other promotional materials without an appropriate lawful basis and, where required, your permission.

We do not sell your personal information.

Where necessary and subject to appropriate safeguards, we may share relevant information with trusted organisations or professionals including:

• practitioners involved in your treatment or care;
• prescribers and other healthcare professionals;
• laboratories, pharmacies or treatment-related providers where applicable;
• our CRM, booking and practice-management providers;
• website and hosting providers;
• secure cloud and IT service providers;
• payment processors;
• accounting and professional advisers;
• insurers and insurance advisers;
• communications providers;
• regulatory or professional bodies where required;
• law enforcement, courts or public authorities where disclosure is legally required; and
• other service providers acting on our behalf.

We require service providers processing information on our behalf to protect personal information appropriately and use it only in accordance with our instructions and applicable law.

We may also disclose information where necessary to protect someone’s vital interests, investigate serious wrongdoing, establish or defend legal claims, or comply with a legal obligation.

Some of our service providers may process or store personal information outside the United Kingdom.

Where personal information is transferred internationally, we take steps required by UK data protection law to ensure an appropriate level of protection. Depending on the destination and circumstances, these safeguards may include UK adequacy regulations or approved contractual safeguards and, where required, an assessment of the protections available for the transferred information.

You may contact us for further information about safeguards relevant to your personal information.

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to satisfy applicable clinical, professional, regulatory, insurance, tax, accounting and legal requirements.

Different categories of information may therefore have different retention periods.

Clinical records may need to be retained for longer periods because of professional, regulatory, insurance and legal requirements.

When information is no longer required, we will securely delete, anonymise or otherwise dispose of it in accordance with our retention arrangements, subject to any legal requirement to retain it.

We take appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, destruction, alteration, unauthorised disclosure or access.

Measures may include, where appropriate:

• access controls and user permissions;
• authentication measures;
• secure systems and service providers;
• encryption or secure transmission methods;
• restricted access to clinical records;
• backups and business-continuity measures;
• staff confidentiality requirements;
• audit trails;
• system monitoring; and
• procedures for managing suspected personal-data breaches.

No method of electronic transmission or storage can be guaranteed to be completely secure, but we take proportionate steps to protect the information entrusted to us.

Our website may use cookies and similar technologies for purposes such as:

• providing essential website functions;
• security;
• remembering preferences;
• understanding website performance and usage; and
• advertising or marketing, where applicable.

Where consent is required by PECR, non-essential cookies and similar technologies will not be used until you have made the relevant choice.

You can manage your preferences through our cookie controls.

Further details, including the technologies we use, their providers, purposes and duration, should be provided in our Cookie Policy.

Depending on the circumstances, UK data protection law may give you rights including the right to:

• access personal information we hold about you;
• rectify inaccurate or incomplete information;
• erase your personal information in certain circumstances;
• restrict the processing of your information in certain circumstances;
• object to certain processing, including direct marketing;
• data portability where the legal requirements apply;
• withdraw consent at any time where processing is based on consent; and
• rights relating to certain forms of automated decision-making and profiling.

These rights are not absolute. For example, we may be required to retain certain clinical, financial or legal records even where you request deletion.

To exercise a right, please contact:

hello@priveskinclinic.com

We may need to verify your identity before responding to a request.

We do not intend to make decisions producing legal or similarly significant effects about clients solely by automated means unless we have a lawful basis for doing so and comply with applicable legal requirements.

Our systems may use automated administrative rules, for example to identify when an appointment reminder, review, follow-up or other workflow is due. Such administrative automation does not necessarily constitute solely automated decision-making producing legal or similarly significant effects under data protection law.

Our services are principally intended for adults.

Where we provide an appropriate service to a person under 18, we will handle their personal information with particular care and obtain parent or guardian involvement or consent where legally or clinically required.

Our website or communications may contain links to third-party websites, booking systems, payment services, social media platforms or other external services.

Those organisations may act as independent controllers of information they collect directly from you. Their handling of your information is governed by their own privacy policies. We encourage you to review those policies when using their services.

We may update this Privacy Policy from time to time to reflect changes to our services, systems, legal obligations or data-processing practices.

The latest version will be published on our website and the “Last updated” date will be revised accordingly.

Where a change materially affects how we use your personal information, we will take appropriate steps to bring the change to your attention where required.

If you have a question or concern about how Privé handles your personal information, please contact us first so that we can investigate and respond.

Privé Skin Clinic
54 Knightsbridge
London
SW1X 7JN
United Kingdom

Email: hello@priveskinclinic.com
Telephone: +44 7570 153825

You also have the right to raise a concern with the Information Commissioner’s Office (ICO), the UK’s data protection regulator.

Further information about your data protection rights and how to make a complaint is available from the Information Commissioner’s Office.