Rejuvenate Aesthetics & Wellbeing Clinic (“we”, “us”, “the clinic”) is committed to protecting your privacy and handling your personal information with the care that a clinical setting demands. This policy explains what we collect, why we collect it, how we look after it and what rights you have.
Rejuvenate Aesthetics & Wellbeing Clinic 33 Kensington Avenue, Burbage, Hinckley, LE10 3JE Email: hello@rejuvenate-clinic.com Telephone: 07813 080876
Data controller: Victoria Hackett Rejuvenate Skin Aesthetics Limited ICO registration number: 10375783
Our treatments are provided by a registered nurse. Where this policy refers to your clinical records, those records are held under the professional and confidentiality obligations that apply to registered healthcare professionals.
Information you give us when you enquire or book
Your name, telephone number, email address, preferred appointment date and time, and anything you choose to tell us in a message or enquiry form.
Information we collect at consultation and treatment
Information collected automatically
When you visit our website we may collect device and usage information through cookies and similar technologies. This is covered separately in our Cookie Policy.
Information about your health is treated as “special category data” under UK data protection law and carries additional safeguards.
We rely on Article 9(2)(h) of the UK GDPR to process your health information: it is necessary for the provision of health care and treatment, and it is processed by, or under the responsibility of, a professional subject to a duty of confidentiality.
We cannot provide treatment without this information. Assessing your medical history is what allows us to judge whether a treatment is safe and suitable for you, and declining to provide it means we will not be able to treat you.
We may ask to take photographs before and after treatment. These form part of your clinical record and help us assess your results over time.
Photographs used for your clinical record are part of your treatment and are covered by the basis described above.
Photographs used for marketing — on our website, social media or in the clinic — are never used without your separate, specific, written consent under Article 9(2)(a). You may refuse without it affecting your treatment in any way, and you may withdraw that consent at any time by contacting us. On withdrawal we will remove the images from any material we control as soon as reasonably practicable, though we cannot always recall images that others have already shared or saved.
What we do | Legal basis |
Responding to your enquiry and arranging appointments | Steps taken at your request before entering a contract (Article 6(1)(b)) |
Providing treatment and keeping clinical records | Contract (Article 6(1)(b)) and Article 9(2)(h) for health data |
Taking payment and keeping financial records | Contract and legal obligation (Article 6(1)(b) and 6(1)(c)) |
Appointment reminders | Legitimate interests — running the clinic efficiently and reducing missed appointments (Article 6(1)(f)) |
Marketing emails and messages | Your consent (Article 6(1)(a)) |
Using your photographs or testimonial in marketing | Your explicit consent (Article 9(2)(a)) |
Defending a complaint or claim, and meeting insurance requirements | Legitimate interests, and legal claims (Article 9(2)(f)) |
We do not sell your information and we do not share it for anyone else’s marketing.
We share it only where necessary, with:
Any supplier handling personal data on our behalf is bound by a written agreement requiring them to keep it secure and use it only on our instructions.
Your information is held on systems within the UK or the European Economic Area wherever possible. Where a supplier processes data outside these areas, we make sure an appropriate safeguard recognised under UK law is in place, such as an adequacy decision or the International Data Transfer Agreement.
Clinical records are kept for 8 years from the date of your last treatment. This reflects professional record-keeping guidance and the period within which a claim may be brought. For anyone treated under the age of 18, records are kept until their 25th birthday.
Enquiries that do not lead to treatment are kept for 12 months.
Marketing consents are kept until you withdraw them, and for a short period afterwards so that we can evidence your withdrawal.
Financial records are kept for 6 years to meet HMRC requirements.
When these periods end, records are securely destroyed or permanently anonymised.
Records are held on password-protected, encrypted systems with access limited to those who need it to provide your care. Paper consent forms are kept in locked storage. We review our security arrangements periodically and keep our software up to date.
No system is entirely without risk, but we take these obligations seriously and will notify you and the ICO as required if a breach occurs that is likely to affect you.
You have the right to:
To exercise any of these, contact us at info@rejuvenate-clinic.com. We will respond within one month. There is no charge, unless a request is manifestly unfounded or excessive.
We will only send you marketing by email or text if you have agreed to it. Every message includes an unsubscribe option, and you can also ask us to stop at any time by replying or contacting us directly. Withdrawing marketing consent does not affect appointment confirmations, reminders or aftercare messages, which are part of your care.
If you are unhappy with how we have handled your information, please tell us first — we would like the opportunity to put it right.
You also have the right to complain to the Information Commissioner’s Office:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Helpline: 0303 123 1113 ico.org.uk
We may update this policy from time to time. The date at the top shows when it was last revised. Where a change materially affects how we use your information, we will bring it to your attention directly.
