N7 Aesthetics ("we", "us", "our") is the data controller for the personal information we hold about you. We are committed to protecting your privacy and handling your data in line with the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
Who we are
N7 Aesthetics is a private aesthetics clinic based in the United Kingdom. For any data protection queries, contact us at info@n7aesthetics.co.uk.
Information we collect
- Identity & contact details (name, date of birth, email, phone, address)
- Medical history, medications, allergies and treatment notes (special category data)
- Clinical photographs taken for record keeping (with your explicit consent)
- Booking, consent and payment information processed via our clinical system
- Correspondence with us by email, web form or messaging
- Limited website usage data (see our Cookie Policy)
Lawful bases for processing
- Contract: to provide the treatments and services you book with us.
- Legal obligation: clinical record keeping, safeguarding, insurance and regulatory requirements (e.g. GMC, NMC, JCCP).
- Vital interests: to protect your health in a clinical emergency.
- Legitimate interests: running, securing and improving the clinic and this website.
- Consent: for clinical photography, marketing communications and non-essential cookies. You can withdraw consent at any time.
- Explicit consent / provision of healthcare (Art. 9 UK GDPR): for processing health data.
Where your data is stored
We host this website and our backend services in the United Kingdom and/or European Economic Area. Our clinical records are held in AesthetiDocs, a UK-based clinical management platform. We do not transfer your personal data outside the UK or EEA unless covered by an adequacy decision or appropriate safeguards (e.g. UK Standard Contractual Clauses).
How long we keep it
- Adult clinical records, consent forms and clinical photographs: a minimum of 10 years after your last treatment, in line with professional guidance and the record-keeping requirements of our medical indemnity cover.
- Records relating to under-18s: until the patient's 25th birthday, or 10 years after the last treatment, whichever is later.
- Accounting and tax records: 6 years.
- Marketing data: until you unsubscribe or we review the list (whichever is sooner).
- Website analytics: aggregated and retained for up to 14 months.
Who we share data with
We never sell your data. We share it only where necessary with:
- Our regulated clinicians and support staff involved in your care
- AesthetiDocs (clinical records), our payment processor and email/SMS providers acting as processors on our behalf
- Your GP or another healthcare professional, only with your consent or where clinically necessary
- Our medical indemnity insurer and its claims handlers (Hamilton Fraser / Cosmetic Insure), where we are required to notify a complaint, incident or potential claim
- Regulators or law enforcement where we are legally required to do so
Your rights
Under UK GDPR you have the right to:
- Be informed about how your data is used
- Access a copy of the data we hold about you
- Have inaccurate data corrected
- Request erasure where there is no overriding clinical or legal reason to retain it
- Restrict or object to processing
- Data portability where applicable
- Withdraw consent at any time (without affecting prior processing)
To exercise any of these rights, email info@n7aesthetics.co.uk. We will respond within one month.
Security
We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls, audited clinical software and staff training. No system is 100% secure, but we take our duty of care seriously.
Complaints
Please contact us first if you have any concerns. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
Changes to this policy
We may update this policy from time to time. The "last updated" date at the top of this page reflects the latest version.