Privacy Policy
| Data controller | Oximis Aesthetic Ltd |
| Companies House no. | 15994295 |
| Registered address | 93 Thornton Road, Carshalton, England, SM5 1NN |
| lanakornijcuka@gmail.com | |
| Phone | 07743 750 230 |
| Website | oximisaesthetic.co.uk |
Oximis Aesthetic Ltd ("we", "us", "our") is the data controller for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy explains what information we collect, why, who we share it with, how long we keep it and your rights.
Information we collect
1.1 Contact details
Your name, date of birth, address, phone number, email address, emergency contact and GP details.
1.2 Appointments and communications
Treatments booked and provided, appointment history, and messages and emails you send us.
1.3 Health information
Your medical history, medicines, allergies, pregnancy or breastfeeding status, consultation and treatment notes, consent forms, and details of the products used in your treatment. This is special category data under UK GDPR.
1.4 Clinical photographs
Photographs taken before and after treatment as part of your clinical record.
1.5 Payment information
Payments are handled by third-party payment providers. We do not store your full card details.
1.6 Website data
Information collected through cookies when you visit our website. See section 7.
Why we use your information and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Booking and providing your treatment, and communicating with you about it | Contract (Article 6(1)(b)) |
| Keeping clinical records, tax and accounting records, and meeting insurance and regulatory requirements | Legal obligation (Article 6(1)(c)) |
| Running and improving our business, and dealing with complaints or claims | Legitimate interests (Article 6(1)(f)) |
| Marketing emails, marketing use of photographs, and non-essential cookies | Your consent (Article 6(1)(a)), which you can withdraw at any time |
We process your health information because it is needed to provide your health care: Article 9(2)(h) UK GDPR and Schedule 1, paragraph 2 of the Data Protection Act 2018. It is handled by, or under the responsibility of, a registered healthcare professional who has a duty of confidentiality. Where needed to deal with a legal claim, we also rely on Article 9(2)(f).
We do not rely on your consent to keep your clinical records, because we are required to keep them. This means we cannot delete them on request before the end of the retention period in section 6.
How we use your information
- To assess whether a treatment is suitable and safe for you
- To provide your treatments and aftercare
- To manage and confirm your appointments and take payments
- To keep accurate clinical records
- To meet our legal, insurance and regulatory obligations
- To send you marketing, only if you have agreed to receive it
Who we share your information with
We never sell your personal data. We only share it where necessary:
- Independent prescriber: where a treatment involves a prescription-only medicine, the prescriber who assesses you receives the medical information needed to do so
- Acuity Scheduling and Squarespace: our booking system and website provider, acting as our data processor
- Google: email, and website analytics and advertising where you have accepted those cookies
- Payment providers: to process your payments
- Our insurer and professional advisers, such as our insurance broker, accountant or solicitor, where needed
- Your GP or the NHS: where needed for your safety, or with your agreement
- Regulators, the police or the courts: where the law requires it
Our processors may only use your data on our instructions and must keep it secure.
International transfers
Some of our providers, including Squarespace (Acuity Scheduling) and Google, store data in the United States. Where this happens, your data is protected by the UK-US data bridge, where the provider is certified, or by the International Data Transfer Agreement or Addendum approved by the Information Commissioner.
How long we keep your information
| Information | How long we keep it |
|---|---|
| Clinical records, consent forms and clinical photographs | 10 years after your last treatment |
| Booking and appointment records | 7 years after your last appointment |
| Payment and accounting records | 7 years, to meet HMRC requirements |
| Enquiries that did not lead to a booking | 12 months |
| Marketing preferences | Until you unsubscribe or withdraw consent |
| Website analytics data | Up to 14 months, in line with our Google Analytics settings |
At the end of these periods, data is securely deleted or anonymised.
Cookies
Our website uses essential cookies to work properly. With your permission, we also use analytics and advertising cookies, including Google Analytics and Google Ads, to understand how the site is used and to measure our advertising. These are only set if you choose "Accept all" in the cookie banner.
You can change your choice at any time using the "Manage cookies" option on our website, or by clearing cookies in your browser.
Keeping your information secure
- Password-protected systems with access limited to the people who need it
- Reputable providers with their own security certifications
- Encrypted storage and transmission where available
- Paper records kept securely and locked away
If a personal data breach is likely to put your rights at risk, we will report it to the Information Commissioner's Office within 72 hours and tell you where the law requires.
Your rights
- Access: ask for a copy of the information we hold about you
- Correction: ask us to correct information that is wrong or incomplete
- Erasure: ask us to delete your information. Clinical records must be kept for the period in section 6, but we can restrict how they are used
- Restriction: ask us to limit how we use your information
- Objection: object to our use of your information based on legitimate interests, and to marketing at any time
- Portability: ask for information you gave us in a portable format
- Withdraw consent: where we rely on consent, you can withdraw it at any time
To use any of these rights, contact us at lanakornijcuka@gmail.com. We will reply within one month, and there is normally no charge.
You can complain to the ICO at any time at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve your concern first.
Children
Our services are for adults aged 18 and over only. We do not knowingly collect information about anyone under 18. If you think we have, please contact us and we will delete it.
Changes to this policy
We may update this policy. The current version is always published on this page with the date it was last updated. If we make an important change, we will tell you by email or on our website.
Contact us
| Company | Oximis Aesthetic Ltd |
| Companies House no. | 15994295 |
| Registered address | 93 Thornton Road, Carshalton, England, SM5 1NN |
| lanakornijcuka@gmail.com | |
| Phone | 07743 750 230 |
| Website | oximisaesthetic.co.uk |