top of page

Shop Medical-Grade Skincare Online

 Rated 5★ on Google

Nurse Led Medical Aesthetic Clinic in Hitchin

SKININSPIRE Wellness Medical Aesthetics Skincare logo

SkinInspire Medical Aesthetics – Privacy & GDPR Policy

1. Policy Overview

SkinInspire Medical Aesthetics is committed to protecting and respecting your privacy. We ensure that all personal data is handled securely, lawfully, and transparently at all times.
 

As a medical aesthetics clinic, we process both personal data and special category data (health information). This policy explains how your data is collected, used, stored, shared, and protected in accordance with:

  • The UK General Data Protection Regulation 

  • The Data Protection Act 2018 
     

We comply with the core GDPR principles, ensuring that your data is:

  • Used lawfully, fairly, and transparently 

  • Collected for specific and legitimate purposes only 

  • Limited to what is necessary for your care 

  • Accurate and kept up to date 

  • Stored securely and retained appropriately 

  • Protected against unauthorised access, loss, or misuse 
     

 

2. Data Controller

SkinInspire Medical Aesthetics is the Data Controller, meaning we are responsible for how and why your personal data is processed.

We take this responsibility seriously and ensure:

  • Clear accountability for all data handling 

  • Staff training in confidentiality, safeguarding, and GDPR 

  • Regular review of systems and processes 
     

 

3. What Information We Collect

We collect information necessary to provide safe, effective, and appropriate treatment.

Personal Data

  • Full name 

  • Date of birth 

  • Address 

  • Contact details (telephone number, email address) 
     

Special Category Data (Health Information)
 

This is sensitive data required for your safety:

  • Medical history and health conditions 

  • Medications and allergies 

  • Consultation forms and clinical assessments 

  • Treatment records and outcomes 

  • Photographic records (with consent) 
     

This information is essential to ensure treatments are safe and clinically appropriate.
 

Financial Data

  • Payment records and transaction history 

  • Internal financial records may be held in secure spreadsheets containing limited personal identifiers (name only) for accounting purposes 
     

Communication & Website Data

  • Appointment bookings 

  • Emails, SMS, and communication history 

  • Website usage data (cookies where applicable) 
     

 

4. Why We Collect Your Data

We collect and use your data to:

  • Provide safe and appropriate medical and aesthetic treatments 

  • Carry out consultations, assessments, and clinical decision-making 

  • Maintain accurate medical records as required by law 

  • Communicate with you regarding appointments, treatments, and aftercare 

  • Provide follow-up care and ongoing support 

  • Process payments and manage accounts 

  • Meet legal, regulatory, insurance, and professional obligations 

  • Ensure safeguarding and patient welfare 
     

Your data will never be used for unrelated purposes without a lawful basis.
 

 

5. Lawful Basis for Processing

Under GDPR, we must have a lawful basis to process your data.
 

We rely on:

  • Consent – where you have given clear permission 

  • Contract – to provide the services you have requested 

  • Legal obligation – to comply with healthcare and regulatory requirements 

  • Legitimate interests – for the safe and effective running of the clinic 

  • Healthcare provision – for medical diagnosis, treatment, and care 
     

Special category (health) data is processed under Article 9 of GDPR for healthcare purposes.
 

 

6. Data Sharing & Clinical Communication

Your data will only be shared where necessary and appropriate.
 

This may include:

  • Prescribers and clinicians involved in your care 

  • Pharmacies (for prescription-only medicines) 

  • Laboratories or treatment partners 

  • Insurance providers 

  • Regulatory or legal authorities where required 
     

Where your case may benefit from discussion with another healthcare professional:

  • You will be fully informed beforehand 

  • Your explicit consent will be obtained before sharing identifiable information 
     

All data shared will be:

  • Limited to what is necessary 

  • Shared securely and confidentially 

  • In line with GDPR and professional standards 
     

We do not sell or share your data for third-party marketing.
 

 

7. How Your Data is Stored (Digital Systems)

SkinInspire Medical Aesthetics operates a fully digital clinical record system using Pabau.
 

This system is used to:

  • Store medical records securely 

  • Record consultations and treatments 

  • Manage appointments and communications 
     

Security measures include:

  • Password-protected access 

  • Role-based permissions (only authorised staff can access data) 

  • Secure cloud-based storage systems 
     

In addition:

  • Financial records may be held in secure spreadsheets 

  • These contain minimal personal data (typically name only) 

  • Access is restricted and controlled 
     

We take all reasonable steps to ensure your data is protected at all times.
 

 

8. Data Retention

We retain your data in line with legal and professional requirements.
 

Typically:

  • Adult medical records are retained for 7–8 years after your last treatment 

  • Records for minors are retained until age 18 plus the required retention period 
     

Data may be retained longer where required for:

  • Legal claims 

  • Safeguarding 

  • Regulatory compliance 
     

When no longer required, data is securely deleted or destroyed.
 

 

9. Your Rights

Under GDPR, you have the right to:

  • Access your personal data 

  • Request correction of inaccurate information 

  • Request deletion (where legally permitted) 

  • Restrict or object to processing 

  • Withdraw consent at any time 
     

We will respond to all requests within legal timeframes and may require identity verification.
 

 

10. Consent, Photography & Social Media

As part of your treatment, photographs will be taken for clinical purposes.

These are used to:

  • Monitor treatment progress 

  • Support clinical decision-making 

  • Maintain accurate medical records 
     

Clinical photographs form part of your confidential record.
 

Use of images for marketing, education, or social media is:

  • Completely optional 

  • Requires separate explicit written consent 

  • Not a condition of treatment 
     

You have the right to:

  • Decline use of your images 

  • Withdraw consent at any time 
     

Where consent is given:

  • Images will only be used within the agreed scope 

  • No identifying information will be shared without permission 
     

 

11. Cookies & Website Data

Our website may use cookies to:

  • Improve user experience 

  • Monitor performance 
     

You can control cookie settings through your browser.
 

 

12. Marketing Communications

We will only contact you for marketing where:

  • You have given consent 

  • Or you are an existing patient and it is appropriate 
     

You can opt out at any time.

 

13. Data Breaches

In the event of a data breach, we will:

  • Act immediately to contain and investigate 

  • Assess the impact and risk 

  • Notify affected individuals where required 

  • Report to the Information Commissioner's Office if legally required 

 

14. Complaints

If you have concerns about how your data is handled, please contact the clinic directly.

You have the right to complain to the Information Commissioner's Office.

 

15. Policy Updates

This policy may be updated to reflect changes in:

  • Legal requirements 

  • Clinical practice 

  • Services 

The latest version will always apply.

bottom of page