Eden Aesthetics Clinic: Privacy Policy

Last updated: 10 October 2026

Eden Aesthetics Clinic respects your privacy and is committed to protecting your personal information. This policy explains what we collect, why we collect it, how we keep it safe, and the rights you have over it. It applies to our website, our clinic, and any communication you have with us by email, phone, WhatsApp or social media.

1. Who we are

Eden Aesthetics Clinic ("we", "us", "our") is the data controller for the personal information described in this policy. This means we decide how and why your information is used, and we are responsible for looking after it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Business name: Eden Aesthetics Clinic
Address: THE TANNING STUDIO, 3 Market Street Place Wisbech Cambridgeshire PE13 1DT
Email: edenclinic.aesthetics@gmail.com
Phone / WhatsApp: 07831663356
ICO registration number: ICO Registration Pending.

If you have any questions about this policy or how we handle your information, please contact us using the details above.

2. The information we collect

We only collect information that we need to respond to you, treat you safely and run the clinic. Depending on how you interact with us, this may include:

  • Contact details: your name, email address, phone number and postal address.

  • Identity details: your date of birth, so we can confirm you are over 18.

  • Enquiry and appointment details: the treatments you ask about, appointments you book, and any messages you send us by email, WhatsApp, phone, social media or our website contact form.

  • Health and treatment information: your medical history, medications, allergies, consultation notes, consent forms, the treatments you receive (including products and batch numbers used) and aftercare records.

  • Photographs: before and after photographs taken as part of your treatment record.

  • Payment information: a record of what you have paid and when. Card payments are processed by our payment provider; we do not store your full card details.

  • Website and technical information: your IP address, browser and device type, the pages you visit and how you reached our site, collected through cookies and similar technologies.

  • Marketing preferences: whether you have chosen to receive news and offers from us.

Most of this information comes directly from you. We may also receive limited information from third parties, such as a booking or payment provider, or from your GP or another practitioner where you have asked them to share it with us.

3. How we use your information and our lawful bases

Data protection law requires us to have a lawful basis for each way we use your information. These are:

  • Replying to enquiries and booking, changing or confirming appointments: taking steps at your request before entering into a contract, and performing our contract with you.

  • Carrying out consultations and treatments, and providing aftercare: performance of our contract with you.

  • Keeping accurate treatment records, including consent forms: legal obligation, and our legitimate interest in providing safe care and being able to respond to complaints or claims.

  • Taking payments and keeping financial records: performance of our contract, and legal obligation (tax and accounting rules).

  • Sending appointment reminders and essential service messages: performance of our contract, and legitimate interests.

  • Sending news, offers and updates by email or message: your consent, which you can withdraw at any time.

  • Using non-essential cookies, such as analytics: your consent.

  • Keeping our website secure and working properly: legitimate interests.

  • Using your photographs or testimonial in our marketing: your explicit, separate written consent.

We will only use your information for the purpose we collected it for. If we need to use it for an unrelated purpose, we will tell you first and explain the lawful basis.

We do not use your information for automated decision-making or profiling that has a legal or similarly significant effect on you.

4. Health information and photographs

Information about your health is classed as "special category data" and receives extra protection under UK GDPR. We collect it only because we need it to assess whether a treatment is suitable and safe for you, to carry out that treatment, and to provide aftercare.

We process your health information on the basis that it is necessary for the provision of health care or treatment by, or under the responsibility of, a registered healthcare professional who is bound by a duty of confidentiality. Where that basis does not apply, we will ask for your explicit consent.

Your health information is confidential. It is seen only by the practitioner treating you and is never used for marketing.

Photographs

Before and after photographs are taken as part of your clinical record, so that we can monitor your results and keep an accurate record of your treatment. These are stored securely with your treatment notes.

We will never share your photographs on our website, social media or anywhere else without your separate written consent. You are free to say no, and this will not affect your treatment. If you do agree, you can withdraw your consent at any time and we will remove the images from our own channels. Please be aware that we cannot fully recall images that others have already shared or saved.

5. Email and marketing

We store email addresses securely and in line with UK GDPR and the Privacy and Electronic Communications Regulations (PECR).

We use your email address to:

  • reply to your enquiries;

  • send booking confirmations, reminders and aftercare information; and

  • send news, offers and updates, but only if you have chosen to receive them.

We will only send you marketing emails or messages if you have opted in, or if you are an existing client who was given a clear chance to opt out when we collected your details and in every message since. You can unsubscribe at any time by using the link in any marketing email or by contacting us. Unsubscribing from marketing does not stop essential messages about appointments you have booked.

We never sell, rent or trade your email address or any other personal information.

6. WhatsApp and messaging

You can contact us by WhatsApp to ask questions and arrange appointments. Messages sent between you and the clinic on WhatsApp are protected by WhatsApp's end-to-end encryption. This means they are encrypted while travelling between your device and ours, and cannot be read by WhatsApp or anyone else in transit.

Once a message reaches us, it is stored on the clinic's password-protected device, which only authorised clinic staff can access. If we need to keep something you have sent us as part of your treatment record, we transfer it to your client file and handle it as described in this policy.

When you message us, we will see your phone number, profile name and the content of your messages. We use these only to reply to you and manage your appointments. We will not add you to broadcast lists or send you promotional messages on WhatsApp unless you have agreed to this.

WhatsApp is operated by Meta, which acts as an independent controller of the account and usage information it collects. Its use of that information is covered by the WhatsApp Privacy Policy (https://www.whatsapp.com/legal/privacy-policy).

You are welcome to share only as much as you are comfortable with over WhatsApp. If you would rather discuss your medical history in detail, we can do this in person or by phone at your consultation.

Messages sent to us through other platforms, such as Instagram or Facebook, are subject to those platforms' own privacy policies and are not necessarily end-to-end encrypted.

7. Cookies

Cookies are small text files placed on your device when you visit a website. Our website uses them to work properly and, with your permission, to help us understand how the site is used.

  • Strictly necessary cookies make the site work, keep it secure and remember your cookie choices. These do not need your consent.

  • Analytics cookies tell us, in aggregate, how visitors find and use the site so we can improve it. These need your consent.

  • Functional cookies remember your preferences and support features such as embedded maps or booking tools. These need your consent.

  • Marketing and social media cookies are set by third parties such as Meta or Google when we embed their content or measure our advertising. These need your consent.

When you first visit our website, you will be asked whether you accept non-essential cookies. These will not be set unless you agree, and you can change your mind at any time using the cookie settings link on our website.

You can also block or delete cookies through your browser settings. If you block strictly necessary cookies, parts of the site may not work as intended.

Our website may contain links to other websites, including WhatsApp, social media and booking platforms. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies.

8. Who we share your information with

We do not sell your personal information. We share it only where necessary, and only with:

  • Service providers who work on our behalf, such as our website host, email provider, booking or client record system, payment processor and accountant. They may only use your information on our instructions and must keep it secure.

  • Other healthcare professionals, such as your GP or a prescriber, where this is needed for your care and you have agreed, or in an emergency to protect your health.

  • Our insurers and professional advisers, where needed to handle a complaint or claim.

  • Regulators, HMRC, the police or the courts, where the law requires us to.

How we keep your information secure

We use appropriate technical and organisational measures to protect your information, including password-protected and encrypted devices and systems, secure storage of any paper records, and limiting access to those who need it. No method of sending or storing information is completely secure, but if a data breach is likely to put your rights at risk we will tell you and the Information Commissioner's Office as required by law.

Transfers outside the UK

Some of our service providers may store or process information outside the UK. Where this happens, we make sure your information has equivalent protection, either because the country is covered by UK adequacy regulations or because approved safeguards such as the International Data Transfer Agreement are in place.

9. How long we keep your information

We keep your information only for as long as we need it for the purposes set out in this policy, or as long as the law or our insurers require.

  • Treatment records, consent forms and clinical photographs: [8] years after your last treatment.

  • Enquiries that do not lead to a booking, including WhatsApp and email messages: up to [12] months.

  • Payment and accounting records: [6] years, as required for tax purposes.

  • Marketing contact details: until you unsubscribe or withdraw consent.

  • Website analytics data: up to [26] months.

When information is no longer needed, we delete it securely or anonymise it so that it can no longer be linked to you.

10. Your rights

Under data protection law you have the right to:

  • Access the personal information we hold about you and receive a copy of it.

  • Correct information that is inaccurate or incomplete.

  • Erase your information in certain circumstances. We may need to keep treatment and financial records for the periods above even if you ask us to delete them.

  • Restrict how we use your information in certain circumstances.

  • Object to our use of your information where we rely on legitimate interests, and to direct marketing at any time.

  • Data portability, meaning you can ask for certain information in a commonly used electronic format.

  • Withdraw your consent at any time where we rely on it. This does not affect anything we did before you withdrew it.

To use any of these rights, please contact us using the details in section 1. There is normally no charge, and we will respond within one month. We may need to confirm your identity before acting on your request.

11. Children

Our treatments and website are intended for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us their information, please contact us and we will delete it.

12. Complaints

If you are unhappy with how we have handled your information, please contact us first so that we can try to put things right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:

Website: https://ico.org.uk/make-a-complaint/
Helpline: 0303 123 1113

13. Changes to this policy

We may update this policy from time to time, for example if we introduce new services or the law changes. The latest version will always be available on our website, with the date it was last updated shown at the top. If we make significant changes, we will let you know.