Privacy policy

Last updated 3 October 2026

Who we are

Aneeza Aesthetics is the controller of your personal information. We are a London aesthetics clinic. You can contact us about anything in this policy at [email protected].

What information we collect

• When you enquire: your name, email address, and anything you tell us in your message.
• When you have a consultation or treatment: contact details, date of birth, medical history, medications, allergies, consent forms, treatment notes, and clinical photographs where you agree to them.
• Payments: a record of what you paid. Card details are handled by our payment provider and are not stored by us.
• When you visit this website: basic technical data such as IP address and browser type, held in our hosting provider's server logs. See our cookies notice.

Why we use it, and our lawful basis

• To reply to your enquiry and arrange a consultation (taking steps at your request, and our legitimate interest in running our business).
• To assess your suitability for treatment, carry it out safely, and keep clinical records. Health information is special category data. We use it to provide you with healthcare (UK GDPR Article 9(2)(h)), and, where needed, with your explicit consent.
• To meet legal, insurance and professional record-keeping duties.
• To send you marketing or use your photographs for promotion, only if you have clearly agreed. You can withdraw that agreement at any time.

Clinical photographs

We may take photographs for your clinical record. We will only use them for marketing, on this website or social media, with your separate, written consent, and we will never use them that way otherwise.

Who we share it with

We do not sell your information. We share it only where needed with: service providers who work for us (such as email, website hosting, booking or clinic-records software, and payment providers); an independent prescriber involved in your care, where a prescription is required; our professional indemnity insurer, regulators or accreditation bodies where required; and anyone we are legally required to disclose it to.

Transfers outside the UK

Some of our providers may process data outside the UK. Where they do, we require appropriate safeguards as set out in UK data protection law.

How long we keep it

• Enquiries that do not lead to treatment: up to 12 months.
• Clinical records: at least 8 years after your last treatment (longer for under-18s or where the law requires), then securely deleted.
• Marketing preferences: until you withdraw your agreement.

Your rights

You can ask us to give you a copy of your information, correct it, erase it, restrict how we use it, move it to another provider, or stop using it for certain purposes. Where you agreed to something, you can withdraw that agreement at any time. Some clinical records must be kept for a minimum period, so we may not be able to erase them earlier. Email us and we will respond within one month.

Keeping your information safe

We use appropriate technical and organisational measures, and limit access to the people who need it.

Complaints

If you are unhappy with how we have handled your information, please tell us first so we can put it right (see our complaints policy). You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this policy

We will update this page if our practices change, and show the date above.