Privacy Policy

1. Introduction

Beautilicious Aesthetics (“we”, “us”, “our”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website at beautilicious-aesthetics.co.uk, contact us, or receive treatments at our clinic.

Please read this policy carefully. By using our website or services you acknowledge you have read and understood this policy. This policy is written in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data Controller

The data controller responsible for your personal information is:

As a provider of aesthetic and health-related treatments, we may process special category data (health information) about you. We take this responsibility very seriously and handle such data with the highest level of care.

3. Information We Collect

We may collect and process the following categories of personal data:

3.1 Information you provide directly

• Identity data: full name, date of birth, gender
• Contact data: email address, phone number, postal address
• Health & medical data: medical history, allergies, contraindications, current medications, and treatment records collected during consultations and as part of your treatment record
• Booking & appointment data: treatment history, appointment dates, preferences, and consultation notes
• Communications: messages sent via our contact form, emails, or social media
• Financial data: payment records (we do not store full card details; payment processing is handled by authorised third-party providers)

3.2 Information collected automatically

• Technical data: IP address, browser type and version, device type, operating system
• Usage data: pages visited, time on site, referring URL, interactions
• Cookie data: as described in our Cookie Policy

4. How We Use Your Information

We use your personal data for the following purposes:

• To provide, manage, and deliver aesthetic treatments and related services
• To carry out pre-treatment consultations and health assessments
• To maintain accurate treatment records for your safety and continuity of care
• To respond to your enquiries and communications
• To send appointment confirmations, reminders, and aftercare instructions
• To process payments and maintain financial records
• To comply with legal and regulatory obligations (including healthcare record-keeping requirements)
• To send marketing communications where you have given your consent (you can withdraw consent at any time)
• To improve our website and services through analytics
• To investigate and respond to complaints

5. Legal Basis for Processing

Under UK GDPR, we must have a lawful basis for processing your personal data. The bases we rely on are:

• Contract: Processing is necessary to fulfil a contract with you (e.g., providing treatments you have booked)
• Legal obligation: We are required to process certain data to comply with laws and regulations applicable to healthcare providers
• Legitimate interests: We process some data for our legitimate business interests (e.g., fraud prevention, improving our services), provided these are not overridden by your interests or rights
• Consent: For marketing communications, cookies (other than essential cookies), and in certain other situations. You have the right to withdraw consent at any time
• Vital interests: In emergency situations where processing is necessary to protect your vital interests or those of another person

5.1 Special Category Data (Health Information)

Health information is classified as “special category” data under UK GDPR and requires additional legal justification. We process this data on the basis of:

• Explicit consent: obtained before each consultation and treatment
• Healthcare provision: processing is necessary for the provision of health or social care treatment (Article 9(2)(h) UK GDPR)
• Legal obligation: requirements under healthcare regulations and professional standards

6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share data in the following limited circumstances:

• Service providers: Third-party processors who assist us in operating our business (e.g., payment processing, appointment scheduling, email systems), subject to data processing agreements and strict confidentiality obligations
• Healthcare professionals: With your explicit consent, where referral to another practitioner is in your clinical interest
• Legal authorities: Where required by law, court order, or to protect the rights and safety of individuals
• Business transfers: In the event of a sale or transfer of the business, your data may be transferred to the new owner subject to this policy

All third parties are required to handle your data securely and only for the specified purpose, in accordance with UK GDPR.

7. Data Retention

We retain your personal data only for as long as is necessary for the purposes set out in this policy. Our retention periods are as follows:

• Medical and treatment records: Retained for a minimum of 7 years from the date of last treatment, in line with healthcare record-keeping requirements. Records relating to minors are retained until the individual reaches age 25, or 7 years after the last treatment, whichever is later
• Financial records: 6 years from the relevant transaction, as required by HMRC and tax legislation
• Contact enquiries (no treatment taken): 12 months from the date of the enquiry
• Marketing consent records: Until you withdraw your consent, plus 2 years thereafter as evidence of consent
• Website usage data: Up to 13 months (analytics) and 12 months (server logs)

When data is no longer required, it is securely deleted or anonymised.

8. Your Rights Under UK GDPR

You have the following rights in relation to your personal data. To exercise any of these rights, please contact us at info@beautilicious-aesthetics.co.uk. We will respond within 30 days.

• Right of access: You may request a copy of the personal data we hold about you (a Subject Access Request)
• Right to rectification: You may ask us to correct inaccurate or incomplete data
• Right to erasure: You may ask us to delete your data in certain circumstances (this right may be limited by our legal obligations to retain treatment records)
• Right to restrict processing: You may ask us to limit how we use your data in certain circumstances
• Right to data portability: Where processing is based on consent or contract, you may request your data in a commonly used, machine-readable format
• Right to object: You may object to processing based on legitimate interests, and you have an absolute right to object to direct marketing at any time
• Rights relating to automated decision-making: We do not carry out automated decision-making or profiling that produces legal or similarly significant effects
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

9. International Transfers

We store and process your data primarily within the United Kingdom. Where we use third-party service providers based outside the UK, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA), standard contractual clauses, or adequacy decisions, to protect your information in line with UK GDPR requirements.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

• Encrypted transmission of data over secure (HTTPS) connections
• Access controls limiting data access to authorised personnel only
• Regular review of security practices and procedures
• Secure disposal of data no longer required

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and, where required, notify you directly without undue delay.

11. Children

Our aesthetic treatments are intended for individuals aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18 without verifiable parental or guardian consent. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will take steps to delete it.

12. Cookies

Our website uses cookies and similar tracking technologies. For full details of the cookies we use, their purpose, and how to manage your preferences, please see our Cookie Policy.

13. Links to Other Websites

Our website may contain links to third-party websites. We have no control over the content or privacy practices of those sites and accept no responsibility for them. We encourage you to read the privacy notice of any website you visit.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page with an updated effective date. We encourage you to review this page periodically. Continued use of our website or services after changes are posted constitutes acceptance of the updated policy.

15. How to Contact Us & Make a Complaint

If you have any questions about this Privacy Policy or wish to exercise any of your rights, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):