Privacy Policy

Elevate Aesthetics (“we”, “us” or “our”) provides aesthetic and hair restoration consultation services in Andover, Hampshire.

For the purposes of applicable data protection legislation, Elevate Aesthetics is responsible for deciding how and why personal information is used for its business activities, subject to the specific arrangements applicable to third-party services.

Business name: Elevate Aesthetics

Business address: 10 Stratford Road, Andover, Hampshire, SP11 6XX

Privacy contact: james@elevateaesthetics.co.uk

Website: https://elevateaesthetics.co.uk/

If you have questions about this policy or how your information is handled, contact us using the email address above.

We may collect the following information, depending on how you interact with us.

Contact information: Your name, email address, telephone number and information you provide when contacting us.

Booking information: Appointment dates and times, services requested, booking history, cancellation details, deposits, payments and refunds.

Health and consultation information: Where relevant, medical history, allergies, medications, treatment suitability assessments, consultation notes, treatment records, aftercare notes and clinical photographs.

Website information: Depending on the technologies enabled, we may collect technical information such as IP address, browser type, device information, pages visited and cookie identifiers.

Marketing preferences: Where applicable, your communication preferences, consent records, unsubscribe requests and information necessary to respect your marketing choices.

Please avoid sending detailed medical information through a general website enquiry form unless it is specifically designed for that purpose.

We use personal information where necessary to:

• Respond to enquiries and provide information about our services.
• Arrange and manage consultations and appointments.
• Assess treatment suitability and support safe treatment delivery.
• Maintain appropriate clinical and treatment records.
• Process bookings, payments, deposits, refunds and cancellations.
• Send appointment confirmations, reminders and relevant service messages.
• Manage complaints and respond to requests.
• Maintain website security and improve our services.
• Meet applicable legal, professional, insurance and accounting obligations.
• Send marketing communications where permitted by law.
• Establish, exercise or defend legal claims where necessary.

We aim to collect only the information needed for the relevant purpose and will not use it for incompatible purposes without an appropriate legal basis.

Under UK data protection law, we must identify an appropriate lawful basis for processing personal information.

Depending on the circumstances, we may rely on:

Contract or steps before a contract: To arrange bookings and provide agreed services.

Legitimate interests: To manage enquiries, administer our business, maintain security and improve our services, where our interests do not override your rights.

Legal obligation: To comply with applicable legal and regulatory requirements.

Consent: Where required for particular activities, such as certain marketing communications or non-essential cookies.

Health information

Health information is special-category personal data and requires additional protection. We will identify both an appropriate lawful basis under Article 6 of the UK GDPR and a separate condition under Article 9, together with any additional requirements that apply.

The appropriate basis and condition depend on the specific purpose and circumstances of the processing. We will document these requirements and apply suitable safeguards.

Where processing relies on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

We use Pabau for online bookings and client-management functions.

Information entered into Pabau may include contact details, appointment information, booking history and, where relevant to the services provided, consultation and clinical records.

We use this information to manage appointments, communicate with clients and support the delivery and administration of our services.

Pabau may process personal information on our behalf as a service provider or data processor, depending on the applicable contractual arrangements. Its own processing activities are also subject to its published privacy information.

You can read more in Pabau's Privacy Policy.

We will use appropriate contractual and security measures when working with service providers that process personal information on our behalf.

We do not sell your personal information.

Where necessary, we may share relevant information with:

• Pabau and other booking or practice-management providers.
• Website hosting, IT support and data-storage providers.
• Payment processors and accounting providers.
• Email, messaging and appointment-reminder providers.
• Insurers, professional advisers and accountants.
• Healthcare professionals or prescribers involved in your care, where appropriate and lawful.
• Legal or regulatory authorities where required or permitted by law.

We aim to share only the information necessary for the relevant purpose.

Some service providers may process information outside the United Kingdom.

Where a transfer is subject to UK data protection law, we will ensure that the applicable transfer requirements are met, including using an adequacy regulation or appropriate safeguards where required.

The countries involved and the safeguards used will depend on the services and systems we use.

We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, alteration, disclosure or destruction.

Measures may include access controls, password protection, appropriate system permissions, secure handling of clinical records and appropriate arrangements with service providers.

No electronic system can be guaranteed to be completely secure, but we take reasonable steps to protect the information entrusted to us.

We retain personal information only for as long as necessary for the purposes for which it was collected, taking account of applicable legal, clinical, accounting, insurance and professional requirements.

Different types of information may need different retention periods. These include general enquiries, booking and payment records, clinical records and marketing preferences.

Our retention periods will be determined according to the information held and the requirements applicable to our business. When information is no longer required, we will securely delete it or anonymise it where appropriate, unless there is a lawful reason to retain it.

Our website may use cookies and similar technologies for essential website functions, preferences, analytics or marketing, depending on the services enabled.

Strictly necessary technologies may be used where required for the website to function. Non-essential cookies and similar technologies will be used only where the required consent has been obtained.

You can manage your choices through the cookie consent tool where available, and through your browser settings.

We will ensure that this section and any accompanying cookie information accurately identify the technologies actually used on our website.

We may send marketing communications about our services where permitted by law.

Where consent is required, we will obtain it before sending marketing messages. Where another legal route is available, we will use it only when its requirements are satisfied.

You can opt out of marketing emails using the unsubscribe link or by contacting james@elevateaesthetics.co.uk.

We may retain limited suppression information so that we can respect your decision not to receive marketing.

Appointment confirmations, reminders and other necessary service communications may continue where appropriate, even if you opt out of marketing.

We will not use clinical information for marketing purposes without establishing an appropriate lawful basis and meeting any additional requirements that apply.

Where photographs are needed for consultation, treatment documentation or follow-up, we will handle them as confidential records and restrict access to authorised purposes.

Using identifiable photographs for advertising, social media, testimonials or other promotional activities is separate from using them for clinical care. Where required, we will obtain separate and appropriate permission before using photographs for promotional purposes.

Refusing promotional use of your photographs will not, by itself, prevent you from receiving treatment.

Subject to applicable law and certain exemptions, you may have the right to:

• Access your personal information.
• Correct inaccurate or incomplete information.
• Request erasure where the legal conditions are met.
• Restrict processing in certain circumstances.
• Object to certain processing, including direct marketing.
• Request data portability where applicable.
• Withdraw consent where processing relies on consent.

These rights are not absolute. For example, certain records may need to be retained to comply with legal obligations or establish, exercise or defend legal claims.

To exercise your rights, contact james@elevateaesthetics.co.uk. We may need to verify your identity before responding.

If you have concerns about how we handle your personal information, please contact us first so that we can investigate.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

Website: https://ico.org.uk/

Telephone: 0303 123 1113

Our website may link to external services, including Pabau, social media platforms and other websites.

Those organisations may handle your information under their own privacy policies. We are not responsible for the privacy practices of websites we do not control.

Our services are intended for individuals who meet the applicable age and eligibility requirements for the relevant consultation or treatment.

We will handle information relating to children in accordance with applicable legal requirements and appropriate safeguarding procedures.

We may update this Privacy Policy when our services, website, systems or legal obligations change.

The latest version will be published on our website with an updated review date.

For questions about this Privacy Policy or to exercise your data protection rights, contact:

Elevate Aesthetics

10 Stratford Road, Andover, Hampshire, SP11 6XX

Email: james@elevateaesthetics.co.uk

Website: https://elevateaesthetics.co.uk/