1. Who We Are

Three Medical Aesthetics ('we', 'us', 'our') is a medical aesthetics practice operating at 102A Chilwell Rd, Chilwell, Beeston, Nottingham NG9 1ES. We are the data controller for the personal data described in this policy.

We are registered with the Information Commissioner's Office (ICO) under registration reference ZB796394. For data protection queries, contact us at: [email protected]

2. What Personal Data We Collect

2.1 Personal and Contact Information

• Full name and date of birth
• Email address and postal address
• Booking and appointment details

2.2 Health and Medical Information (Special Category Data)

As a medical aesthetics practice, we necessarily collect and process special category data relating to your health. This includes:

• Medical history, current health conditions, and medications
• Allergies and sensitivities
• Pregnancy and breastfeeding status
• Previous aesthetic treatments received
• Clinical photographs taken before and after treatment

Special category health data is processed on the basis of Article 9(2)(h) UK GDPR (health or social care purposes), and is held strictly for the purpose of providing safe and appropriate treatment.

2.3 Financial Information

Card payments are processed securely by Stripe. We do not store full card details on our own systems. Stripe's privacy policy is available at stripe.com/gb/privacy.

2.4 Website and Communications Data

• Email enquiries and correspondence
• Online booking information submitted via our website
• Anonymous website usage data collected via Google Analytics (see Section 7)

3. Legal Bases for Processing

We process your personal data on the following legal bases:

• Contract performance — to process bookings and provide treatments you have requested.
• Health or social care (Article 9(2)(h)) — to process special category health data in connection with the delivery of aesthetic treatments by our nurse prescriber.
• Legal obligation — to retain records as required by NMC and HMRC.
• Legitimate interests — for business administration and to send marketing communications to existing clients (where you have not opted out).
• Consent — for any use of your data beyond the above, such as use of photographs in marketing materials.

4. How We Use Your Data

• To assess your suitability for treatment and deliver safe, personalised care
• To process and manage bookings and payments
• To contact you about your appointments, follow-up care, and results review
• To send you information about our services and promotions (you may opt out at any time)
• To maintain accurate clinical records as required by professional regulations
• To comply with our legal and regulatory obligations

5. Data Processors and Third Parties

We do not sell your personal data. We share it only with the following trusted third-party processors, under appropriate data processing agreements:

• Stripe — secure card payment processing.
• Our booking system — appointment scheduling and client records management.
• Mailchimp (Intuit Inc.) — email marketing. You may unsubscribe at any time via the link in any marketing email.
• Google Analytics (Google LLC) — anonymous website usage analytics (see Section 7).

We may disclose your data if required to do so by law, or to protect the rights and safety of others.

6. How Long We Keep Your Data

• Clinical records (including medical history forms and consent forms) are retained for a minimum of 8 years from the date of your last treatment, in line with NMC guidance for nursing records.
• Financial transaction records are retained for 7 years in accordance with HMRC requirements.
• Marketing preferences are held until you withdraw consent or opt out.

After the applicable retention period, your data is securely and permanently deleted or anonymised.

7. Cookies and Google Analytics

Our website (threeaesthetics.co.uk) uses Google Analytics to collect anonymous data about how visitors interact with the site (pages visited, time on site, referral source). This data is aggregated and cannot be used to identify you personally.

You may opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout, or by adjusting your browser's cookie settings. For full details on all cookies we use, please refer to our Cookie Policy.

8. Your Rights

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your data (subject to our legal retention obligations).
• Restriction — ask us to restrict how we use your data in certain circumstances.
• Data portability — receive your data in a portable, machine-readable format.
• Object — object to processing based on legitimate interests; and opt out of marketing at any time.

To exercise any of these rights, email us at [email protected]. We will respond within one calendar month.

9. Data Security

We use appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. Access to clinical records is restricted to the treating practitioner and authorised administrators.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The current version is always available at threeaesthetics.co.uk.

11. Complaints

If you have concerns about how we handle your personal data, please contact us first at [email protected]. You may also complain to the ICO at any time:

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF