Privacy Policy

Last updated: 16 October 2026

This Privacy Policy explains how DermMED Aesthetics ("we", "us", "our") handles personal information about visitors to this website and patients of the clinic. We are committed to protecting your privacy and to processing your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

1. Who we are (data controller)

DermMED Aesthetics is the data controller for the personal information we collect through this website and through our clinic.

• Trading name: DermMED Aesthetics
• Practitioner: Dr Maria Shakoor, GP and Aesthetic Practitioner
• Address: 6 Portchester Close, Ingleby Barwick, Stockton-on-Tees, TS17 5LQ, United Kingdom
• Email: dermedaesthetics@outlook.com
• Phone: 01642 638541
• WhatsApp: 07405 105987

If you have any questions about this policy or how your data is handled, please contact us using the details above.

2. The personal data we collect

Depending on how you interact with us, we may collect the following categories of information.

Information you give us directly

• Contact details: name, email address, phone number, postal address.
• Enquiry content: any information you choose to share when emailing, messaging us on WhatsApp or contacting us by phone.
• Booking information: appointment date and treatment requested, submitted through our third-party booking provider.
• Health and consultation information (special category data): medical history, medications, allergies, skin concerns, photographs taken with your consent, and clinical notes recorded during consultation. This data is handled under strict medical confidentiality.
• AI skin scan submissions (special category data): if you choose to use the optional AI skin scan, the answers you give, the photograph you upload or capture, the report generated from them and any contact details you choose to enter. Because it describes your skin, this is treated as health information and given the same care as our clinical records. Using the scan is entirely voluntary — section 4 explains it in full.
• Patient app account, orders and treatment plans: if you use our patient app, your name, email address, a securely stored password, the treatments and treatment plans you buy, and the confirmations you give at checkout. Because a list of treatments can reveal information about your health, we treat order history as special category data. Section 4A explains this in full.

Information collected automatically

• Technical and usage data: IP address (in truncated form where possible), browser type and version, device type, operating system, referring page, pages viewed and approximate location (city / region) derived from your IP address.
• Data visible to our scan provider: the page loads the scan from our provider, Dermis. This means your IP address, browser and device information are visible to them whenever that page is opened, even if you do not go on to complete a scan.
• Cookies and similar technologies: see our Cookie Policy for full details.

We do not knowingly collect personal data from children under 18. Aesthetic treatments are only offered to adults.

3. How and why we use your data (lawful bases)

We only use your personal data when we have a lawful basis to do so under UK GDPR.

Purpose	Data used	Lawful basis
Responding to enquiries by email, phone or WhatsApp	Contact details, enquiry content	Legitimate interests (responding to a request you have made); consent where applicable
Arranging and managing consultations and appointments	Contact details, booking details	Steps taken at your request prior to entering a contract; performance of a contract
Providing the optional AI skin scan and your personalised report	Scan answers, photograph, report, technical data	Consent (UK GDPR Art. 6(1)(a)); for special category (health) data: your explicit consent (UK GDPR Art. 9(2)(a)). You can withdraw at any time — see section 4
Providing aesthetic and skin health treatment, keeping clinical records	Contact details, health information, photographs, clinical notes	Performance of a contract; for special category (health) data: provision of healthcare and management of healthcare systems (UK GDPR Art. 9(2)(h))
Patient safety, follow-up care and adverse-event reporting	Health information, treatment records	Legal obligation; substantial public interest in the area of public health
Operating, securing and improving this website	Technical / usage data, strictly necessary cookies	Legitimate interests (running and securing our website)
Optional analytics or marketing cookies	Usage data, online identifiers	Consent (you can withdraw at any time via the "Cookie settings" link)
Sending marketing emails or messages, where you have asked to receive them	Contact details, marketing preferences	Consent
Running your patient app account, and taking payment for treatments and monthly treatment plans	Name, email, phone number, order and treatment plan history, checkout confirmations	Performance of a contract; for special category (health) data revealed by your orders: provision of healthcare (UK GDPR Art. 9(2)(h)), under the confidentiality duty of a registered doctor
Preventing fraud and misuse of payments and accounts	Account, payment and technical data	Legitimate interests (protecting our patients and business)
Complying with legal, regulatory and accounting obligations	Records of treatments, financial information	Legal obligation

4. The AI skin scan explained

The AI skin scan is no longer offered on our website. This section is kept so that anyone who used it before it was withdrawn can see how their submission is handled; the retention and deletion commitments below still apply to those submissions.

The optional AI skin scan involves a photograph of your face and information about your skin, so we set out separately how it works, what happens to what you submit, and what the scan can and cannot do.

4.1 What the scan is

The scan is a free, optional educational tool. You answer a few short questions about your skin, then upload or capture a photograph, and software produces a personalised report with suggested next steps to discuss at a consultation. It is delivered on our website by our provider, Dermis, and runs inside a frame served from their systems.

Using the scan is entirely voluntary. You do not need to use it to book a consultation, to be treated, or to contact us, and you will not be treated any differently if you choose not to.

4.2 What the scan collects

• Your answers about your skin concerns, your routine and what you would like to change.
• Your photograph, either uploaded from your device or captured with your camera. Your browser will always ask your permission before the camera is used, and you can refuse and upload a photo instead.
• Your report, generated from the above.
• Contact details, only where the scan asks for them and you choose to give them — for example so your report can be emailed to you.
• Technical data needed to deliver the scan, such as your IP address, browser and device type.

Because it describes your skin, everything above is health information — special category data under Article 9 UK GDPR — and we treat it with the same care as our clinical records.

4.3 Our legal basis, and how to withdraw

We rely on your consent (Article 6(1)(a) UK GDPR) and your explicit consent (Article 9(2)(a) UK GDPR) to process your scan. Choosing to start the scan and submit your photograph, having been told in this section and on the scan page what will happen to it, is how that consent is given. We do not rely on any other basis, and we do not treat your visit to the page as consent.

You can withdraw your consent at any time, free of charge. Contact us using the details in section 1 and we will stop using your submission and arrange for it to be deleted. Withdrawing consent does not affect processing that was lawful before you withdrew it, and it does not remove clinical records that we are separately obliged to keep if you have since been treated.

4.4 The scan is not a diagnosis

This matters as much as the data protection points, so we say it plainly.

• The scan is educational and preparatory. It is not a medical diagnosis, not a substitute for examination by a clinician, and not a regulated medical device.
• It cannot detect, rule out or screen for skin cancer or any other disease.
• Its accuracy depends on photograph quality, lighting and camera, and automated skin analysis can perform less consistently across different skin tones, ages and skin conditions. Please treat your report as a prompt for discussion rather than a conclusion about your skin.
• If you have a mole or lesion that is new, changing, bleeding, itching or otherwise worrying you, do not rely on the scan. Please see your GP or an appropriate clinician promptly, or contact NHS 111 if you need advice sooner.

4.5 Automated processing and human oversight

Your report is produced automatically by software. It is not a decision about you within the meaning of Article 22 UK GDPR: nothing is decided by automated means that has a legal effect on you or that similarly significantly affects you. No treatment is approved, refused, prescribed or priced on the strength of a scan, and no care is withheld or altered because of one.

Any treatment plan is decided by Dr Maria Shakoor at a consultation on the basis of her own clinical assessment. Where you share your scan with us, she reads it as background, not as a finding. You are always entitled to ask a person about your report — just contact us and we will talk it through with you.

4.6 We do not use your photograph to identify you

Your photograph is analysed for skin characteristics only. We do not use it for facial recognition, we do not use it to create a biometric template or to identify or verify who you are, and we do not match it against other images or databases.

4.7 Who processes your scan, and the limits we place on it

Dermis operates the scan on our behalf as our processor. We only use providers who agree in writing to terms meeting Article 28 UK GDPR, which means they may process your submission solely to provide the scan and report to you and to us, must keep it confidential and secure, must appoint sub-processors only on equivalent terms, and must delete or return it when we ask.

We do not sell your scan submission, and we do not use your photograph, answers or report for advertising or to build a marketing profile about you. Dermis publishes its own privacy information about its role in running the service, available from dermis.ai and from within the scan itself. If you would like to know more about how Dermis handles scan images — including whether they are used to develop or improve its software, and how to object — contact us using the details in section 1 and we will obtain an answer for you.

4.8 The scan is for adults

The scan is for people aged 18 or over, in line with the rest of our services. Please do not submit a scan for, or a photograph of, a child. If we become aware that a scan relates to someone under 18, we will delete it.

4.9 The AI chat assistant

Every page of our website offers an optional AI chat assistant that answers general questions about our treatments and prices and can suggest treatments that might suit the concerns you describe.

• We do not store your conversation. It is kept only in your browser while the page is open and disappears when you close or leave the page. It is not saved in cookies or local storage, not written to a database, and not recorded in our logs.
• Please do not enter your name, contact details or other identifying information. The assistant does not ask for them and does not need them. To book, or to discuss your details, please use our online booking system or WhatsApp.
• To produce each reply, your messages are passed through our website host, Netlify, to the AI model provider, Anthropic, and the reply is returned straight to your browser. These providers may keep request data briefly under their own terms for security and abuse monitoring, which can involve processing outside the UK (see section 6).
• The assistant is not a doctor and does not give a diagnosis. Its suggestions are AI-generated recommendations only. Your treatment plan is decided by Dr Maria Shakoor after a consultation, based on her own clinical assessment. If you have an urgent or worrying symptom, contact your GP or NHS 111, or call 999 in an emergency.

4A. The patient app and online payments

Our patient app lets you see our treatments and prices, buy skin treatments and monthly treatment plans online. You can browse it without an account.

• Your account: if you create an account we hold your name, email address and password. Your password is stored in encrypted (hashed) form by Netlify Identity and nobody at the clinic can see it. You must be 18 or over to create an account.
• Payments: you pay by bank on a secure payment page run by Tide, which provides our business bank account. Your online banking login and card details are never seen or stored by us. We receive the payer's name, the amount, the payment reference and the date. Tide processes payments for its own regulatory, fraud-prevention and legal obligations as a separate controller under Tide's Privacy Policy. When you email us after paying, we use your email address and the details you give us to send your order confirmation and arrange your treatment.
• Orders and treatment plans: we keep a record of what you bought, when, and the confirmations you gave at checkout (that you are 18 or over, that you accepted our online purchase terms, whether you asked for treatment to start within the 14-day cancellation period, and, where relevant, that you have had a laser patch test or that Dr Maria recommended your treatment plan). If you pay without an account, we record your order against your email address so it appears if you sign up later.
• On your device: the app stores your basket and sign-in session on your device, and keeps a copy of pages you have viewed so they work offline. See our Cookie Policy.
• PLIM payment plans: if you choose to apply for a PLIM payment plan, you give your details directly to PLIM Limited, which is a separate controller and may carry out credit checks. We don't receive your application through the app. PLIM's own privacy policy applies.
• No marketing: we do not use app data for marketing, and we don't send marketing emails unless you separately ask us to.
• Deleting your account: you can delete your account at any time from the Account screen, or by contacting us. This deletes your login and treatment plan records. We keep order and payment records for 6 years because the law requires us to (see section 7).

4B. Launch event tickets

When you book a ticket for our Sectum RF launch event on 10 November 2026, DermMED Aesthetics is the controller of the details you give us.

• What we collect: the guest's name, the email address the ticket is sent to, the time slot chosen, and (only if you choose to give it) a mobile number. We also record the confirmations you gave when booking (that the guest is 18 or over and that you accepted the ticket terms), the payment reference, whether and when payment was confirmed, the time the guest was checked in on the day, and when the £25 ticket credit was used. We do not ask for any health information to book a ticket.
• Why, and our lawful basis: to reserve the guest's place, match their payment, send and check their ticket, and contact them about the event (for example if timings change). This is necessary to perform our contract with you (UK GDPR Article 6(1)(b)). Payment records are kept to meet our legal accounting obligations (Article 6(1)(c)).
• Marketing is optional: we only email you about future events and news if you tick the separate, unticked box when booking (consent, Article 6(1)(a)). You can withdraw consent at any time by replying to any email or contacting us, and it doesn't affect your ticket.
• Your ticket and QR code: your ticket link and QR code contain a long random code, not your name or any personal details. Anyone who has the link can see the guest's name, slot and payment status, so please keep it private. When scanned at the door, only clinic staff signed in to our dashboard can check a guest in.
• Payment: you pay through Tide's secure payment page. We never see your banking login or card details. See section 4A.
• Who sees it: only Dr Maria and authorised clinic staff. Your booking is stored by Netlify (our website host) on our behalf. We don't share it with anyone else and we never sell it.
• How long we keep it: 30 days after the event we automatically delete bookings that were never paid, and delete the mobile number, ticket link and check-in time from paid bookings. We keep the guest's name, email, payment reference and amount for 6 years as financial records, then delete them. See section 7.
• Your rights: you can ask to see, correct or delete your booking details at any time, as explained in section 9. If you ask us to delete a paid booking before the event, the ticket will no longer be valid.

5. Sharing your data

We do not sell your personal data. We only share it where necessary, with appropriate safeguards in place. Recipients may include:

• Our website host (Netlify): hosts this website and processes server logs on our behalf. For the patient app, Netlify also stores your account (Netlify Identity) and your orders and treatment plan (Netlify Database) on our behalf.
• Payment provider (Tide): provides our business bank account and the secure payment page used in the patient app. See section 4A.
• PLIM Limited: only if you choose to apply for a PLIM payment plan, in which case you share your details with PLIM directly.
• Booking platform (Aesthetic Nurse Software): processes online bookings made through the "Book Online" link.
• AI skin scan provider (Dermis): operates the optional scan on our page as our processor, and processes the answers, photograph and technical data you submit through it solely to generate your report and make it available to you and to us. See section 4 for the limits that apply.
• Communication tools: WhatsApp / Meta and our email provider, where you choose to contact us through these channels.
• Pharmacies and laboratories: where prescriptions or testing are clinically required.
• Insurers, regulators and professional bodies: such as the General Medical Council, the CQC, the Joint Council for Cosmetic Practitioners (where applicable) or our medical indemnity insurer, when required.
• Professional advisers: accountants and legal advisers, under strict confidentiality.
• Law enforcement and public authorities: where we are legally required to disclose information.

6. International transfers

Some of the providers above may process data outside the UK. Where this happens we rely on appropriate safeguards, such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or transfers to countries with UK adequacy regulations, to make sure your data continues to receive an essentially equivalent level of protection.

The same applies to the AI skin scan. If you would like to know where your scan submission is processed and which transfer safeguard applies to it, contact us using the details in section 1 and we will tell you.

7. How long we keep your data

We only keep personal data for as long as necessary for the purposes described in this policy.

• Clinical and consultation records: retained in line with current professional and regulatory guidance for medical and aesthetic records, generally for at least 8 years from the date of last treatment, and longer for patients who were under 18 at the time of treatment.
• Financial and accounting records: retained for at least 6 years to comply with HMRC requirements. This includes patient app orders and payments.
• Patient app account: kept until you delete it, or deleted automatically if you haven't signed in for 3 years (unless you have an active treatment plan).
• Treatment plan records: kept while your plan is active and for 6 years after it ends, as financial records.
• Launch event tickets: unpaid bookings are deleted 30 days after the event. For paid tickets, the mobile number, ticket link and check-in time are deleted 30 days after the event, and the name, email, payment reference and amount are kept for 6 years as financial records. If you opted in to event and news emails, we keep your email for that purpose until you unsubscribe.
• Website enquiries that do not lead to treatment: retained for up to 24 months, unless we need to keep them longer.
• AI skin scan submissions: your photograph, answers and report are kept only for as long as needed to give you your report and to discuss it with you. If you do not go on to become a patient, we delete the copy we hold, and ask Dermis to delete theirs, within 12 months of your scan — or sooner if you ask. If your scan forms part of your clinical assessment, it is retained with your clinical records as set out above.
• Cookie and consent records: retained for up to 12 months, after which we will ask for your preferences again.

8. How we protect your data

We apply technical and organisational measures appropriate to the sensitivity of the data we hold. These include access controls, encrypted storage and transmission where appropriate, secure clinical record keeping and confidentiality obligations on everyone who handles patient information.

For the AI skin scan specifically, your submission is sent over an encrypted connection; this website's content security policy restricts the scan page so that it can only load the scan from our provider and nothing else; and camera access is granted only to the scan, only on the scan page, and only after your browser has asked you. No other page on this site can use your camera, microphone or location.

9. Your rights

Under UK data protection law you have the following rights, free of charge in most cases:

• Right to be informed about how your data is used (this policy).
• Right of access to a copy of the personal data we hold about you.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") in certain circumstances.
• Right to restrict processing in certain circumstances.
• Right to data portability for data you provided to us electronically.
• Right to object to processing based on our legitimate interests, and to direct marketing.
• Right to withdraw consent at any time, where we rely on consent.
• Rights relating to automated decision-making and profiling. We do not carry out automated decision-making that produces legal or similarly significant effects. The AI skin scan generates a report automatically, but it is not a decision of that kind and a person is always available to discuss it — see section 4.5.

To exercise any of these rights, please contact us using the details in section 1. We will respond within one month.

10. How to complain

We hope to resolve any concerns directly. You also have the right to complain to the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

11. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of the page shows when it was last revised. Where changes are material we will take reasonable steps to bring them to your attention.