Privacy notice

01Who we are

Oatley Medical Aesthetics is the data controller for the personal information described in this notice. That means we decide what information is collected about you and what happens to it.

Treatments are provided by Hayley Oatley-Davies, an Independent Midwife Prescriber, across the clinic locations listed at the end of this notice.

Organisations handling health information in the United Kingdom are normally required to register with the Information Commissioner’s Office and pay the data protection fee. Hayley Louise Davies, trading as Oatley Medical Aesthetics, is registered with the Information Commissioner’s Office as a data controller. Our registration number is ZB966079.

02The information we collect

Information you give us

• Your name, date of birth, email address, telephone number and postal address.
• The details of your enquiry, and any correspondence between us.
• Which clinic you would prefer to be seen at.

Health information

At consultation we ask about your medical history, current medication, allergies, previous aesthetic treatments, pregnancy and breastfeeding status, and anything else relevant to whether a treatment is safe and appropriate for you. Health information is a special category of personal data under UK data protection law and is treated with additional care.

Photographs

We take clinical photographs before and after treatment as part of your record. These are used to plan treatment and to assess results. Photographs are only used for marketing, teaching or social media where you have given separate, specific written consent, and you can withdraw that consent at any time.

Information we collect automatically

When you visit this website we collect limited technical information about your visit. This is explained in our cookie policy.

03Why we use it, and our lawful basis

Under UK GDPR we must have a lawful basis for using your information. Ours are as follows.

• To respond to your enquiry and arrange an appointment — because it is necessary to take steps at your request before entering into a contract, and to perform that contract.
• To assess, prescribe and provide treatment safely — processing of health information for the provision of health care and treatment by a regulated health professional, under Article 9(2)(h) of the UK GDPR.
• To keep clinical records and manage aftercare — because we are required to keep accurate records, and because it is necessary for reasons of public interest in the area of public health.
• To take payment and keep accounting records — because we have a legal obligation to do so.
• To send you marketing, where you have asked for it — with your consent, which you can withdraw at any time.
• To handle complaints, insurance matters and legal claims — for our legitimate interests in defending our position and running the clinic responsibly.

04Who we share it with

We do not sell your information, and we do not share it for anyone else’s marketing. We share it only where it is necessary:

• Hosting. The website is hosted by Vercel Inc.
• Database. Information you send us through the website is stored by Supabase, on servers in the United Kingdom (London region).
• Booking system. Appointments are managed through Aesthetic Nurse Software. When you follow a booking link you leave this website, and anything you enter there is handled under their privacy notice rather than ours.
• Pharmacies. Where a prescription-only medicine is required, we share the information necessary to dispense it with a registered pharmacy. We use more than one pharmacy depending on the medicine and availability. Each is independently regulated and has its own obligations to keep your information safe.
• Payments. We do not take card payments through this website. Payment is taken in clinic or through the booking system, which handles card details under its own arrangements. We never see or store your card number.
• Our insurer and, where relevant, our legal advisers, if a claim or complaint is made.
• Your GP or another healthcare professional, where this is necessary for your safety. We will normally discuss this with you first.
• A public authority, where we are required to disclose information by law.

05Where your information is held

The systems that hold your information are named in section 04. Paper consent forms and treatment notes are kept securely at the clinic.

Some of the providers named in section 04 are based in, or may access information from, outside the United Kingdom. We only use providers where that transfer is covered by UK adequacy regulations, or by standard contractual clauses together with the UK International Data Transfer Addendum.

06How long we keep it

• Clinical records, consent forms and clinical photographs — 8 years from the date of your last treatment. For patients under 18, until their 25th birthday, or their 26th birthday if they were 17 at their last treatment. These records are held in our clinical booking system, not on this website.
• Enquiries sent through the website form — kept for 24 months and then deleted.
• Accounting records — six years from the end of the financial year they relate to.
• Marketing consent records — until you withdraw consent, and then a short period afterwards so we can evidence that you asked to be removed.

07Your rights

You have the right to:

• ask for a copy of the information we hold about you;
• have inaccurate information corrected;
• ask us to delete information, where there is no continuing reason for us to keep it;
• ask us to restrict how we use your information while a concern is looked into;
• object to us using your information for our legitimate interests;
• ask us to transfer certain information to another provider;
• withdraw your consent at any time, where consent is our basis for using the information.

Some of these rights are limited where we are required to keep clinical records. If a right does not apply to your request we will explain why.

To exercise any of these rights, contact us using the details below. We will respond within one month.

08Complaints

If you are unhappy with how we have handled your information, please tell us first — see our complaints procedure. You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection, at ico.org.uk.

09Changes to this notice

We review this notice regularly. Where we make a significant change we will update the date at the top and, where appropriate, tell you directly.