4. Who We Share Your Data With (Our Data Processors)We will never sell your personal data. However, we must share your data with trusted third-party companies to provide our services. These companies are "Data Processors" and are legally bound to protect your data.
We share data with:
Booking & Patient Management: Aesthetic Nurse Software (to manage your appointments and clinical records).
Website Host: Webflow (to host and maintain our website).
Analytics: Google Analytics (to understand website traffic).
Maps: Google Maps (to provide our location map).
Email & Comms: Fasthosts (our email host) and Gmail (our email client).
Payment Processors: Stripe, Klarna, PayPal, and Clearpay (to securely process your payments. We do not see or store your full card details).
Reviews Widget: Trustindex (to display service reviews).
Legal & Regulatory Bodies: We may be legally required to share your data with regulators (such as the CQC), our insurers, or law enforcement.
5. International Data TransfersSome of our third-party processors are based outside the UK (e.g., in the USA). This means your data may be transferred internationally.
We only use processors that provide a level of data protection equivalent to UK law. We ensure this by using mechanisms like the UK-US Data Privacy Framework or Standard Contractual Clauses (SCCs), which legally require them to protect your data to UK standards.
6. How We Protect Your DataWe have implemented robust technical and organisational security measures to protect your data. This includes:
Technical Measures: Using SSL (encryption) on our website, secure cloud storage, password protection, and access controls on all systems.
Organisational Measures: Limiting access to your personal data to staff who need it, providing data protection training, and ensuring strict confidentiality agreements are in place.
7. How Long We Keep Your DataWe only keep your data for as long as is necessary.
Patient Medical Records: In line with our legal and professional obligations, we are required to retain your medical records (including photos and consent forms) for 10 years after your last treatment.
Marketing Data: We will keep your details for as long as you have consented. If you unsubscribe, we will delete your data from our marketing lists.
Enquiries: If you enquire but do not become a patient, we will delete your data after one year.
8. Your Data Protection RightsUnder UK GDPR, you have rights over your personal data. These include:
The right to access: You can request a copy of the data we hold about you.
The right to rectification: You can ask us to correct any data that is inaccurate.
The right to erasure (the "right to be forgotten"): You can ask us to delete your data. (Note: This right is not absolute and does not apply to patient medical records that we are legally required to keep for 10 years.)
The right to restrict processing: You can ask us to stop processing your data in certain circumstances.
The right to data portability: You can ask us to transfer your data to another service.
The right to object: You can object to us processing your data (e.g., for marketing).
To exercise any of these rights, please contact our Data Protection Lead at contact@dgaesthetics.uk.
9. CookiesOur website uses cookies. A cookie is a small file placed on your device that helps us analyse web traffic and improve our site. For full details, please see our separate
Cookie Policy10. How to ComplainWe hope to resolve any query or concern you raise. However, if you are not satisfied with our response, you have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office (ICO).
Website: https://www.ico.org.uk
11. Changes to This Privacy PolicyWe may update this policy from time to time. Any changes will be posted on this page, and the "Last Updated" date will be revised.
