Privacy Policy

Hillsborough Aesthetics Limited ("Hillsborough Aesthetics", "we", "our" or "us") is committed to protecting and respecting your privacy.

As a doctor-led medical aesthetics clinic, we recognise that patients place significant trust in us when sharing personal and sensitive medical information. We are committed to ensuring that your information is handled lawfully, fairly, transparently and securely at all times.

This Privacy Policy explains:

• what personal information we collect;
• why we collect it;
• how we use it;
• who we may share it with;
• how we protect it;
• how long we keep it; and
• your legal rights regarding your personal information.

This Privacy Policy applies whenever you:

• visit our website;
• contact us by telephone, email, social media or our website;
• book an appointment;
• attend a consultation or treatment;
• purchase products or gift vouchers;
• communicate with us after treatment; or
• otherwise use any of our services.

Please read this Privacy Policy carefully. If you have any questions, please contact us using the details below.

For the purposes of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and all applicable data protection legislation in Northern Ireland, the Data Controller is:

As the Data Controller, Hillsborough Aesthetics Limited determines the purposes for which, and the manner in which, your personal information is processed.

We understand that the information you provide includes confidential medical information and other sensitive personal data.

All personal information is handled in accordance with:

• UK General Data Protection Regulation (UK GDPR);
• Data Protection Act 2018;
• Privacy and Electronic Communications Regulations (PECR);
• Common law duty of confidentiality;
• General Medical Council (GMC) guidance on confidentiality;
• applicable legislation and guidance within Northern Ireland.

Our policies and procedures are designed to ensure that personal information is processed lawfully, securely and only where there is a legitimate clinical or business need to do so.

This Privacy Policy applies to all personal information collected by Hillsborough Aesthetics Limited, including information collected:

• through our website;
• via online booking systems;
• during consultations;
• during treatment;
• through electronic consent forms;
• through email correspondence;
• by telephone;
• through social media messaging;
• through CCTV systems operating at our premises;
• through payment systems;
• through photographs taken for clinical purposes.

It applies whether information is collected electronically, verbally or in writing.

For the purposes of this Privacy Policy:

Personal Data

Information relating to an identified or identifiable individual.

Examples include:

• name;
• address;
• email address;
• telephone number;
• date of birth;
• IP address;
• payment information;
• appointment history.

Special Category Data

Certain categories of personal information receive additional legal protection because they are particularly sensitive.

Within our clinic this includes information relating to:

• medical history;
• health conditions;
• medications;
• allergies;
• previous procedures;
• consultation notes;
• treatment records;
• clinical photographs;
• consent documentation.

Because we provide healthcare services, processing this information is necessary to provide safe clinical care.

Depending upon the services you use, we may collect the following categories of information.

Identity Information

Including:

• full name;
• title;
• date of birth;
• gender.

Contact Information

Including:

• postal address;
• email address;
• telephone number.

Medical Information

Including:

• medical history;
• previous cosmetic procedures;
• medications;
• allergies;
• relevant health conditions;
• consultation notes;
• treatment records;
• consent forms;
• clinical assessments;
• adverse event records.

This information is considered special category personal data under UK GDPR.

Clinical Photographs

Where clinically appropriate, photographs may be taken before, during or after treatment.

These photographs may be used:

• as part of your confidential medical record;
• to monitor clinical progress;
• to assess treatment outcomes;
• to assist with future consultations.

Clinical photographs used for marketing, educational or promotional purposes will only be used where you have provided separate, explicit consent. Declining such consent will never affect the care or treatment you receive.

Appointment Information

Including:

• appointments booked;
• appointment attendance;
• cancellations;
• treatment history;
• communications relating to appointments.

Payment Information

We collect information necessary to process payments.

Card payments are securely processed through our payment providers. Hillsborough Aesthetics Limited does not store full payment card details.

Marketing Preferences

Where you choose to receive marketing communications, we may record your preferences for:

• email;
• SMS;
• WhatsApp communications;
• promotional offers;
• newsletters;
• clinic updates.

You may withdraw your consent at any time.

When you visit our website, certain technical information may be collected automatically.

This may include:

• IP address;
• browser type;
• operating system;
• device information;
• pages visited;
• date and time of visits;
• referring website;
• browsing behaviour;
• cookie information.

We use this information to:

• improve website performance;
• understand how visitors use our website;
• improve user experience;
• maintain website security;
• analyse website traffic.

Further information regarding cookies is provided within our Cookie Policy.

Under the UK General Data Protection Regulation (UK GDPR), we must have a lawful basis for processing your personal information. As a provider of healthcare services, Hillsborough Aesthetics Limited processes personal data under the following lawful bases.

Providing Clinical Care

Most personal information is processed because it is necessary for the provision of healthcare services.

The lawful basis is:

• Article 6(1)(b) UK GDPR — Processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.

For special category health information, the additional lawful basis is:

• Article 9(2)(h) UK GDPR — Processing is necessary for the provision of health care or treatment and the management of health services.

This allows us to safely assess your suitability for treatment, prescribe medicines where appropriate, provide treatment, maintain accurate clinical records and deliver ongoing care.

Compliance with Legal Obligations

We may process personal information where required to comply with legal or regulatory obligations.

This includes obligations relating to:

• taxation and accounting;
• fraud prevention;
• court orders;
• regulatory investigations;
• public health requirements where applicable;
• professional standards required by regulatory bodies.

The lawful basis is:

• Article 6(1)(c) UK GDPR — Processing is necessary for compliance with a legal obligation.

Legitimate Interests

In some circumstances we process personal information because it is necessary for our legitimate interests, provided these interests do not override your rights and freedoms.

Examples include:

• managing appointments;
• responding to enquiries;
• improving clinic services;
• maintaining website security;
• preventing fraud;
• defending legal claims;
• ensuring patient safety;
• quality assurance;
• clinical governance;
• investigating complaints.

The lawful basis is:

• Article 6(1)(f) UK GDPR — Processing is necessary for our legitimate interests.

Consent

Certain processing activities rely upon your consent.

These include:

• marketing communications;
• promotional emails;
• newsletters;
• SMS promotions;
• WhatsApp marketing;
• use of photographs for advertising;
• publication of testimonials where they identify you.

Where consent is relied upon, you may withdraw it at any time.

Withdrawal of consent will not affect the lawfulness of processing undertaken before consent was withdrawn and will not affect your clinical care.

We only collect information that is necessary for legitimate clinical or business purposes.

Your information may be used to:

• verify your identity;
• arrange consultations;
• manage appointments;
• assess your suitability for treatment;
• provide safe medical care;
• prescribe medicines where clinically appropriate;
• maintain accurate clinical records;
• document consent;
• monitor treatment outcomes;
• provide aftercare;
• communicate regarding appointments;
• respond to questions or complaints;
• administer payments;
• issue invoices and receipts;
• comply with legal obligations;
• improve our services;
• monitor website performance;
• detect fraud or misuse;
• protect staff, patients and visitors.

We do not sell your personal information to third parties.

As a medical clinic, we maintain comprehensive clinical records for every patient.

These records may include:

• consultation notes;
• treatment plans;
• medical history;
• medication history;
• allergies;
• previous procedures;
• consent documentation;
• treatment records;
• prescriptions;
• clinical photographs;
• adverse events;
• follow-up reviews;
• communications relevant to your care.

Clinical records are maintained to ensure continuity of care, patient safety and compliance with professional standards.

Clinical photographs form an important part of many medical aesthetic consultations and treatments.

Photographs may be taken:

• before treatment;
• during treatment;
• after treatment;
• during review appointments.

Clinical photographs are used for:

• documenting your medical record;
• monitoring treatment progress;
• evaluating treatment outcomes;
• planning future treatment;
• maintaining accurate clinical documentation.

Photographs are taken using dedicated company-owned devices and uploaded promptly to our secure clinical records system. Images are not routinely stored on individual staff members' personal devices.

Clinical photographs remain part of your confidential medical record.

Any use of photographs for marketing, educational or promotional purposes will only occur where separate, explicit consent has been obtained. You may decline or withdraw this consent at any time without affecting your care.

We use Aesthetidocs as our secure clinical management system.

Aesthetidocs is used to manage:

• appointment bookings;
• consultation records;
• treatment documentation;
• consent forms;
• prescriptions;
• patient communications;
• clinical photographs;
• follow-up records.

Access to patient information is restricted to authorised personnel who require access for legitimate clinical or administrative purposes.

If you choose to receive marketing communications, we may contact you regarding:

• new treatments;
• clinic news;
• promotions;
• special offers;
• educational information;
• events.

Marketing communications may be sent by:

• email;
• SMS;
• WhatsApp.

Your marketing preferences are recorded during the booking process.

You may withdraw your consent at any time by:

• clicking the unsubscribe link in emails;
• contacting the clinic directly;
• updating your marketing preferences with us.

Withdrawal of marketing consent does not affect essential communications relating to your appointments or treatment.

We treat all patient information as confidential.

However, in certain circumstances we may need to share information with trusted third parties where this is necessary for the provision of healthcare, the operation of our business, or to comply with legal obligations.

These may include:

Clinical Pharmacy Providers

Where medicines require dispensing or supply.

Information shared is limited to what is necessary for the provision of your treatment.

Payment Providers

Payments are processed securely using trusted payment providers including:

• Stripe
• Square
• Worldpay

Payment providers process payment information in accordance with their own privacy policies and applicable data protection legislation.

IT and Technology Providers

We use trusted providers to support our business operations, including:

• Microsoft 365
• GoDaddy
• Aesthetidocs

These providers process information on our behalf under appropriate contractual safeguards.

Professional Advisers

Where necessary, information may be shared with:

• accountants;
• insurers;
• legal advisers;
• auditors.

Only information necessary for the relevant purpose will be disclosed.

Regulators and Public Authorities

Where required by law, we may disclose information to organisations including:

• the Information Commissioner's Office (ICO);
• HM Revenue and Customs (HMRC);
• courts;
• law enforcement agencies;
• other regulatory authorities.

Such disclosures will only be made where legally required or permitted.

To help protect the safety and security of our patients, visitors, staff and premises, Hillsborough Aesthetics Limited operates Closed Circuit Television (CCTV) at the clinic.

CCTV is used for the purposes of:

• crime prevention and detection;
• protecting patients, visitors and staff;
• protecting clinic property;
• assisting with investigations where necessary;
• maintaining a safe clinical environment.

CCTV recordings are accessed only by authorised personnel where necessary and are retained only for as long as reasonably required unless they are required as part of an investigation or legal process.

Clear signage is displayed at the clinic informing visitors that CCTV is in operation.

The lawful basis for processing CCTV footage is our legitimate interests under Article 6(1)(f) UK GDPR.

Our website uses cookies and similar technologies to improve functionality, understand how visitors use our website and enhance user experience.

Where required, you will be asked to provide consent before non-essential cookies are placed on your device.

You can change or withdraw your cookie preferences at any time through your browser settings or our cookie banner.

Essential Cookies

Essential cookies are necessary for the operation of our website.

These cookies allow basic website functionality such as page navigation, security and access to secure areas.

These cookies cannot be disabled because the website would not function correctly without them.

Google Analytics

We use Google Analytics to understand how visitors use our website.

Google Analytics collects information such as:

• pages visited;
• time spent on pages;
• browser type;
• device type;
• approximate geographic location;
• website performance;
• user interactions.

This information is aggregated and anonymised wherever possible and helps us improve our website and patient experience.

Google Analytics does not identify individual users.

Google Search Console

We use Google Search Console to monitor our website's visibility within Google Search and identify technical issues affecting search performance.

Google Search Console provides website performance information including:

• search impressions;
• search queries;
• indexing information;
• technical errors;
• page performance.

It does not identify individual visitors.

Meta Pixel

We use the Meta Pixel to understand how visitors interact with our website after viewing our advertisements on Meta platforms, including Facebook and Instagram.

Meta Pixel may collect information including:

• pages viewed;
• buttons clicked;
• purchases or bookings;
• device information;
• browser information.

This information helps us measure advertising performance and improve future marketing campaigns.

Where required by law, Meta Pixel will only operate after you have consented through our cookie banner.

Protecting your personal information is extremely important to us.

We implement appropriate technical and organisational measures designed to safeguard personal information against:

• accidental loss;
• unauthorised access;
• unlawful disclosure;
• misuse;
• alteration;
• destruction.

Security measures include, where appropriate:

• encrypted systems;
• password protected devices;
• restricted staff access;
• secure cloud storage;
• multi-factor authentication where available;
• regular software updates;
• secure backup procedures.

Only authorised members of staff who require access to your information in order to perform their duties are permitted to access your records.

All staff are expected to maintain patient confidentiality at all times.

Our email services are provided through Microsoft 365.

Whilst we take appropriate steps to protect email communications, email transmission over the internet cannot be guaranteed to be completely secure.

If you choose to communicate with us by email, you acknowledge that there is a small inherent security risk associated with electronic communications.

We encourage patients not to send unnecessary sensitive information via unsecured email where possible.

Some of the third-party service providers we use may process personal information outside the United Kingdom.

Where this occurs, we ensure appropriate safeguards are in place to protect your information, including:

• UK International Data Transfer Agreements (IDTAs);
• UK Addendum to the EU Standard Contractual Clauses;
• adequacy regulations approved by the UK Government;
• other safeguards permitted under UK GDPR.

We will always seek to ensure your information receives an equivalent level of protection wherever it is processed.

We only retain personal information for as long as necessary to fulfil the purposes for which it was collected and to comply with legal, regulatory and professional obligations.

Our retention periods are generally as follows:

*Clinical records may be retained for longer where required by law, professional guidance, insurance requirements or in connection with actual or potential legal claims.

When information is no longer required, it will be securely deleted, anonymised or destroyed in accordance with applicable data protection legislation.

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have a number of rights regarding the personal information we hold about you.

These include the right to:

• request access to the personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request erasure of your personal information where applicable;
• request restriction of the processing of your information in certain circumstances;
• object to processing carried out on the basis of our legitimate interests;
• withdraw consent at any time where processing is based on your consent (this will not affect the lawfulness of processing carried out before consent was withdrawn);
• request the transfer of your personal information to another organisation where applicable.

Please note that these rights are not absolute and may be limited where we have legal, regulatory or professional obligations to retain clinical records or where exemptions under data protection legislation apply.

To exercise any of your rights, please contact us using the details provided at the end of this Privacy Policy.

If you have any questions or concerns about how we handle your personal information, we encourage you to contact us first so that we can investigate and resolve the matter.

You can contact us at:

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent authority responsible for upholding information rights.

As Hillsborough Aesthetics Limited is based in Northern Ireland, the ICO's Northern Ireland office also provides regional support.

Making a complaint to the ICO does not affect your right to seek any other legal remedy.

We may update this Privacy Policy from time to time to reflect changes in legislation, regulatory guidance, technology or the way we provide our services.

The latest version will always be published on our website together with the date it came into effect.

We encourage you to review this Privacy Policy periodically to ensure you remain informed about how your personal information is collected, used and protected.

If you have any questions regarding this Privacy Policy or wish to exercise your rights, please contact: