Privacy Policy

1. Who we are

This Privacy Policy explains how London Skin Bar ("London Skin Bar", "we", "us" or "our") collects, uses, stores and protects personal information.

London Skin Bar is the trading name of:

London Skin Bar
Company number: 14137481

For privacy and data-protection purposes, London Skin Bar is generally the data controller responsible for personal information processed in connection with our website, bookings, payments and services.

Contact details

Telephone: 07873 754324
Email: info@londonskinbar.com

Our medical practitioner is:

Dr Maral Taghadosi
GMC-registered Medical Doctor
Full GMC registration
8+ years' experience in aesthetic medicine.

A second London Skin Bar location in Esher is planned but is not currently open.

2. What this Privacy Policy covers

This Privacy Policy applies to personal information collected when you:

• visit our website;
• contact us;
• make or manage an appointment;
• make a payment;
• attend a consultation;
• receive treatment;
• communicate with us; or
• otherwise interact with London Skin Bar.

Our website does not directly ask you to enter medical or health information.

Clinical and health information is collected during your consultation and treatment and is currently recorded using paper-based clinical and consent documentation completed in person.

3. Information we collect

3.1 Contact and booking information

When you contact us or make an appointment, we may collect:

• name;
• email address;
• telephone number;
• appointment details;
• booking history;
• communications with us;
• payment and transaction information;
• cancellation or rescheduling information; and
• information necessary to administer your appointment.

Appointments are currently managed through Square Appointments.

3.2 Clinical and health information

During consultation and treatment, we may collect information necessary to provide safe and appropriate care, including:

• medical history;
• relevant medical conditions;
• allergies;
• medication;
• previous aesthetic treatments;
• relevant lifestyle information;
• clinical observations;
• treatment plans;
• treatment records;
• information concerning adverse reactions or complications;
• aftercare information; and
• clinical photographs where appropriate.

Health information is special category personal data under the UK GDPR.

This information is not collected directly through the website.

4. How we use your information

We may use your personal information to:

• respond to enquiries;
• arrange and manage appointments;
• provide consultations;
• assess treatment suitability;
• provide medical aesthetic treatments;
• maintain clinical records;
• provide aftercare;
• communicate with you about appointments and treatment;
• process payments;
• manage cancellations and refunds;
• maintain accounting and business records;
• comply with legal and regulatory obligations;
• maintain patient and staff safety;
• deal with complaints and disputes;
• establish, exercise or defend legal claims;
• maintain and secure our website;
• improve our services; and
• send marketing communications where we have obtained the required consent.

We will not use your clinical information for unrelated marketing purposes.

5. Lawful bases for ordinary personal data

Depending on the circumstances, we may process ordinary personal data on the following lawful bases:

Contract

Where processing is necessary to arrange or provide services you have requested, including managing appointments and payments.

Legal obligation

Where processing is necessary for us to comply with a legal or regulatory obligation.

Legitimate interests

Where processing is necessary for our legitimate business interests and those interests are not overridden by your rights and interests.

This may include:

• administering our business;
• maintaining business records;
• improving services;
• preventing fraud;
• maintaining website security;
• handling complaints; and
• establishing, exercising or defending legal claims.

Consent

Where applicable law requires consent, we will obtain consent before processing.

You may withdraw consent at any time where consent is the lawful basis for the relevant processing.

6. Health and special category data

Information concerning your health is special category personal data under the UK GDPR.

For clinical care and treatment, we will use an applicable Article 6 lawful basis together with an applicable Article 9 condition.

Where appropriate for the provision of healthcare or treatment, this may include Article 9(2)(h) UK GDPR, subject to the applicable conditions and safeguards under UK law.

We process clinical information only where necessary and proportionate for purposes such as:

• assessing treatment suitability;
• providing treatment;
• protecting patient safety;
• providing appropriate aftercare;
• maintaining clinical records;
• complying with legal or professional requirements; and
• dealing with clinical complaints, incidents or claims.

Clinical information is subject to additional confidentiality and security safeguards.

Dr Maral Taghadosi is subject to professional duties concerning patient confidentiality and the secure handling of patient information. GMC guidance requires doctors providing cosmetic interventions to keep patient records securely and in accordance with data-protection and confidentiality requirements.

7. Treatment consent is separate from data protection

Your consent to medical or aesthetic treatment is a separate clinical process.

Accepting this Privacy Policy does not constitute consent to treatment.

Before treatment, the practitioner will discuss the proposed treatment and relevant matters including benefits, risks, alternatives and expected outcomes.

Appropriate treatment consent will be obtained separately during the clinical process.

8. Booking and payment providers

We use Square Appointments for appointment booking and related services.

Square may process information required to provide its booking and payment services, including contact, appointment and transaction information.

Payments may be processed through Square.

We do not intend to store your full payment-card details ourselves where these are processed by Square.

If you choose to pay using Clearpay, Clearpay will process information necessary to provide its payment service, subject to Clearpay's own terms and privacy information.

Third-party providers may process information under their own privacy policies and/or as service providers to London Skin Bar, depending on the particular service.

9. Information we share

We may share personal information where reasonably necessary with:

• Square and Square Appointments;
• Clearpay where you choose Clearpay;
• payment providers;
• IT, hosting and website providers;
• professional advisers, including accountants and solicitors;
• insurers;
• healthcare professionals where necessary for your care or safety;
• regulatory or professional bodies where required;
• law-enforcement or government authorities where legally required; and
• other service providers acting on our behalf.

We do not sell your personal information.

Clinical information will only be disclosed where there is an appropriate lawful basis and where the disclosure is necessary and proportionate.

Where identifiable patient information is disclosed for purposes outside direct care, we will generally seek appropriate consent unless disclosure is required or otherwise permitted by law. GMC confidentiality guidance requires disclosures to be limited to what is necessary and appropriate.

10. International transfers

Some service providers we use may process information outside the United Kingdom.

Where personal information is transferred internationally, we will ensure that the transfer is made in accordance with applicable UK data-protection law and using an appropriate lawful transfer mechanism where required.

The precise countries and safeguards may depend on the providers and services in use.

11. How long we keep your information

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, unless a longer period is required or justified by law, professional requirements, insurance requirements or the establishment, exercise or defence of legal claims.

Clinical records

Clinical records will be retained in accordance with applicable legal, professional, regulatory and clinical record-keeping requirements.

[TO CONFIRM: London Skin Bar should establish and document its exact clinical-record retention policy before publication.]

Where no specific retention period is stated, we will determine the appropriate period by considering:

• applicable law;
• GMC and relevant professional guidance;
• the nature of the clinical record;
• patient safety;
• insurance requirements;
• potential complaints or claims; and
• our legal obligations.

Booking and contact information

Booking and contact information may be retained for as long as reasonably necessary to:

• administer our relationship with you;
• maintain financial and business records;
• deal with complaints;
• establish, exercise or defend legal claims; and
• comply with legal obligations.

Marketing information

Where you have consented to marketing, we will retain relevant marketing preferences for as long as necessary to administer those preferences and demonstrate compliance.

12. Data security

We take appropriate technical and organisational measures to protect personal information against:

• unauthorised access;
• accidental loss;
• destruction;
• alteration;
• unauthorised disclosure; and
• other unlawful processing.

Access to clinical information is restricted to people who need access for legitimate clinical, administrative, legal or regulatory purposes.

Paper clinical records will be stored securely and protected against unauthorised access.

No method of storing or transmitting information can be guaranteed to be completely secure.

13. Your rights

Subject to applicable legal conditions and exemptions, you may have the right to:

• request access to your personal information;
• request correction of inaccurate information;
• request deletion in certain circumstances;
• request restriction of processing;
• object to certain processing;
• request data portability where applicable;
• withdraw consent where processing is based on consent; and
• object to direct marketing.

Some rights are subject to legal exemptions.

For example, clinical records may need to be retained where there is a legal, professional, insurance or other legitimate requirement to do so.

To exercise your rights, contact:

Email: info@londonskinbar.com
Telephone: 07873 754324

We may need to verify your identity before processing a request.

14. Marketing

We may send information about London Skin Bar's services where permitted by law.

Where consent is required, we will obtain consent before sending marketing communications.

Marketing consent is separate from consent to treatment.

You can withdraw marketing consent at any time.

You can also unsubscribe using the instructions included in marketing communications or by contacting us.

Appointment reminders and necessary service communications are not marketing communications.

15. Cookies

Our website may use cookies and similar technologies.

[TO CONFIRM BEFORE PUBLICATION]

Our final cookie and analytics configuration has not yet been confirmed.

Before publication, this section must be updated to identify:

• strictly necessary cookies;
• analytics cookies;
• marketing cookies;
• third-party cookies;
• cookie duration;
• the purpose of each cookie; and
• how visitors can manage their cookie preferences.

Where required by law, we will obtain consent before using non-essential cookies or similar technologies.

The ICO states that non-essential cookies generally require clear information and consent, subject to applicable exceptions.

16. Children's information

London Skin Bar provides its aesthetic treatment services to adults aged 18 and over only.

We do not knowingly accept bookings for injectable aesthetic treatment for anyone under 18.

If we become aware that personal information relating to a child has been collected in circumstances where it should not have been, we will take appropriate steps to address the situation.

17. Journal and educational content

Our website may contain a Journal/blog containing general information about aesthetic treatments, skin health and related subjects.

This content:

• is for general educational purposes;
• is not personalised medical advice;
• does not constitute a diagnosis;
• does not establish a doctor-patient relationship; and
• should not be relied upon as a substitute for professional medical advice.

Treatment suitability can only be determined following appropriate clinical assessment and consultation.

18. Automated decision-making

London Skin Bar does not currently make decisions about treatment suitability or eligibility solely through automated decision-making or profiling.

Treatment suitability is assessed by the practitioner.

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

The latest version will be published on our website together with its effective date.

We will update our privacy information where our processing activities materially change.

The ICO recommends keeping privacy information under regular review and informing individuals before introducing new uses of their personal data.

20. Complaints

If you have a concern about how we have handled your personal information, please contact us first:

Email: info@londonskinbar.com
Telephone: 07873 754324

You also have the right to complain to the UK's data-protection regulator:

Information Commissioner's Office (ICO)

Website: ico.org.uk

21. Contact

London Skin Bar
Company number: 14137481

Telephone: 07873 754324
Email: info@londonskinbar.com

Privacy Policy effective date: [date to be confirmed at launch]