Book Now
Book Now
How DermMED Aesthetics collects, uses and protects your personal information.
This Privacy Policy explains how DermMED Aesthetics ("we", "us", "our") handles personal information about visitors to this website and patients of the clinic. We are committed to protecting your privacy and to processing your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
DermMED Aesthetics is the data controller for the personal information we collect through this website and through our clinic.
If you have any questions about this policy or how your data is handled, please contact us using the details above.
Depending on how you interact with us, we may collect the following categories of information.
We do not knowingly collect personal data from children under 18. Aesthetic treatments are only offered to adults.
We only use your personal data when we have a lawful basis to do so under UK GDPR.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Responding to enquiries by email, phone or WhatsApp | Contact details, enquiry content | Legitimate interests (responding to a request you have made); consent where applicable |
| Arranging and managing consultations and appointments | Contact details, booking details | Steps taken at your request prior to entering a contract; performance of a contract |
| Providing aesthetic and skin health treatment, keeping clinical records | Contact details, health information, photographs, clinical notes | Performance of a contract; for special category (health) data: provision of healthcare and management of healthcare systems (UK GDPR Art. 9(2)(h)) |
| Patient safety, follow-up care and adverse-event reporting | Health information, treatment records | Legal obligation; substantial public interest in the area of public health |
| Operating, securing and improving this website | Technical / usage data, strictly necessary cookies | Legitimate interests (running and securing our website) |
| Optional analytics or marketing cookies | Usage data, online identifiers | Consent (you can withdraw at any time via the "Cookie settings" link) |
| Sending marketing emails or messages, where you have asked to receive them | Contact details, marketing preferences | Consent |
| Complying with legal, regulatory and accounting obligations | Records of treatments, financial information | Legal obligation |
We do not sell your personal data. We only share it where necessary, with appropriate safeguards in place. Recipients may include:
Some of the providers above may process data outside the UK. Where this happens we rely on appropriate safeguards, such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or transfers to countries with UK adequacy regulations, to make sure your data continues to receive an essentially equivalent level of protection.
We only keep personal data for as long as necessary for the purposes described in this policy.
We apply technical and organisational measures appropriate to the sensitivity of the data we hold. These include access controls, encrypted storage and transmission where appropriate, secure clinical record keeping and confidentiality obligations on everyone who handles patient information.
Under UK data protection law you have the following rights, free of charge in most cases:
To exercise any of these rights, please contact us using the details in section 1. We will respond within one month.
We hope to resolve any concerns directly. You also have the right to complain to the UK Information Commissioner's Office (ICO):
We may update this Privacy Policy from time to time. The "Last updated" date at the top of the page shows when it was last revised. Where changes are material we will take reasonable steps to bring them to your attention.