Privacy policy

Who we are

Æmilia Aesthetics ("we", "us") is a nurse-led aesthetics clinic at SSV Suites, 470 Holloway Road, London. We are the data controller for the personal information described in this policy, which means we decide how and why it is used.

You can reach us at Info@aemiliaaesthetics.com or +44 7748 837645 with any question about your information, including to make any of the requests set out below.

What we collect

When you enquire

Your name, email address, phone number, the treatment you asked about and whatever you write in your message.

When you book

Booking is handled through Fresha. They collect your name, contact details, appointment history and payment details in order to take deposits and payments. We see your booking details; we do not see or store your full card number.

When you are treated

A medical history, including current and past health conditions, medication, allergies, pregnancy or breastfeeding status and previous aesthetic treatments. Notes of your consultation, what was discussed, what was agreed and what was declined. Records of the treatment itself, including the product used, batch numbers, doses and injection sites. Your consent forms, aftercare given, and any review or follow-up.

Photographs

Clinical photographs before and after treatment, taken as part of your record. These are only taken with your consent, and consent to clinical photography is separate from consent to use any image publicly.

When you visit this website

This site does not use analytics or advertising cookies. It loads its typefaces from Google Fonts, which means your browser contacts Google's servers and your IP address is visible to Google when a page loads.

Why we use it, and our lawful basis

To answer your enquiry and arrange your appointment, because it is necessary to take steps at your request before entering a contract, and to perform that contract once made.

To assess your suitability, deliver treatment safely and keep clinical records, because this is necessary for the provision of health care and treatment by a health professional bound by a duty of confidentiality. In data protection terms, health information is special category data and we rely on Article 9(2)(h) of the UK GDPR, together with Schedule 1 of the Data Protection Act 2018.

To meet our own legal and professional obligations, including record-keeping duties, insurance requirements and the standards expected of a registered nurse.

To defend or respond to a complaint, claim or regulatory enquiry, because we have a legitimate interest in being able to do so.

To send you appointment reminders and aftercare, as part of providing your treatment.

To send you marketing, only where you have asked us to. You can stop this at any time by replying to any message or telling us at your next appointment, and it will never affect your care.

To use a photograph of you publicly, including on social media, only with your specific written consent, which you may withdraw at any time. Withdrawing your consent stops us using the image from that point on. We will remove it from anywhere we control, but where an image has already been shared onward or saved by someone else, we cannot guarantee it can be recovered.

Who we share it with

Fresha, which runs our booking and payment system.

The prescriber and pharmacy involved in supplying any prescription-only medicine used in your treatment.

Hamilton Fraser, our insurer, and their legal advisers, if a complication or claim arises.

Formspree, which delivers the enquiry form on this website to our email. What you type into that form passes through their servers on its way to us. Formspree is a US provider, so this is a transfer outside the UK, made under the safeguards permitted by UK data protection law.

IONOS, which provides our domain and our email. Anything you email us, and anything sent to us through the enquiry form, is held in a mailbox on their servers.

Other healthcare professionals, including your GP or emergency services, where this is necessary for your care or in an emergency.

Regulators, including the Nursing and Midwifery Council or the Care Quality Commission, where we are required to provide information.

We never sell your information, and we do not share it for anyone else's marketing.

Where it is kept

Records are held electronically: your booking and contact details in Fresha, and your medical history, consultation notes, consent forms and clinical photographs in Faces. Some of our providers process data outside the UK. Where they do, we rely on the safeguards permitted by UK data protection law, such as adequacy regulations or the International Data Transfer Agreement.

How long we keep it

Clinical records, including consent forms, medical history and treatment notes, are kept for 10 years from the date of your last treatment. We treat adults only, so no shorter or longer period applies to anyone under 18.

Clinical photographs are kept for the same period as the record they belong to.

Enquiries that do not lead to an appointment are deleted after 6 months. Enquiries sent through the website form pass through Formspree, which forwards them to us and does not retain a copy.

Records of payments and deposits are kept for 6 years to meet tax and accounting requirements.

How we protect it

Access is limited to the practitioner treating you. Electronic records are protected by passwords and, where available, two-factor authentication. Paper records are kept locked. Devices are encrypted and kept up to date. Fresha and Faces are both accessed with individual accounts and multi-factor authentication, and clinical photographs are stored inside Faces rather than on a camera roll.

Your rights

You have the right to ask for a copy of the information we hold about you, to have inaccurate information corrected, and to ask us to delete information — though we cannot usually delete clinical records before the retention period above has passed, because we are required to keep them.

You can also ask us to restrict how we use your information, object to processing we carry out on the basis of legitimate interests, ask for your information in a portable format, and withdraw any consent you have given.

We will respond within one month. There is no charge.

Complaints

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113.

Changes to this policy

If we change how we use your information, we will update this page and change the date at the top. Where the change is significant, we will tell you directly.