PRIVACY NOTICE
1. ABOUT THIS PRIVACY NOTICE
Enhance Thanet Beauty & Aesthetics Ltd respects your privacy and is committed to protecting your personal information.
This Privacy Notice explains how we collect, use, store and protect personal information when you:
Book or attend an appointment
Receive a consultation or treatment
Purchase a product, gift voucher, package or course
Contact the clinic
Use our website or online booking system
Communicate with us by telephone, email, SMS, social media or other messaging service
Subscribe to marketing communications
Make a complaint or enquiry
Apply for a role or opportunity with Enhance
Otherwise interact with Enhance Medical Aesthetics & Wellness Clinic
It also explains your rights in relation to your personal information.
Enhance Thanet Beauty & Aesthetics Ltd is responsible for determining how and why personal information is processed for the purposes described within this Privacy Notice.
2. INFORMATION WE MAY COLLECT
Depending upon your relationship with Enhance, we may collect and process information including:
Identity and Contact Information
Name
Date of birth
Address
Telephone number
Email address
Emergency contact information where appropriate
Photographic identification where age or identity verification is required
Appointment and Transaction Information
Appointment history
Treatments and services booked
Products purchased
Booking fees and payments
Gift vouchers
Treatment packages and courses
Cancellation and attendance history
Transaction information
Payment-card details are generally processed securely through our authorised payment providers rather than being stored directly by Enhance.
Health and Clinical Information
In order to assess treatment suitability and provide safe care, we may collect information including:
Medical history
Current and previous medical conditions
Medications
Allergies and sensitivities
Pregnancy or breastfeeding status
Previous procedures or treatments
Previous complications or adverse reactions
Treatment contraindications
Consultation information
Consent records
Treatment records
Product, batch and prescribing information
Aftercare and follow-up information
Adverse events or complications
Correspondence relating to your treatment
Health information is classed as special-category personal data and receives additional protection under data-protection law.
Clinical Photographs and Videos
Clinical photographs may be taken where appropriate for:
Assessment
Treatment planning
Clinical documentation
Monitoring progress
Before-and-after comparison
Review
Continuity of care
Clinical photographs forming part of your treatment record are managed as confidential clinical information.
Separate permission will be obtained before identifiable photographs or videos are used for marketing, advertising or social media.
Prescribing Information
Where a Prescription Only Medicine is being considered, we may process information required for an appropriate prescribing assessment.
Relevant information may be shared between the treating practitioner, prescriber and dispensing pharmacy where necessary and lawful for prescribing, supply and treatment.
Technical and Website Information
When you use our website or online services, information may be collected including:
IP address
Browser type
Device information
Website activity
Pages visited
Cookie identifiers
Interaction with online booking or website features
Some of this information may only be collected where you have provided the appropriate cookie or tracking consent.
Communications
We may retain relevant communications including:
Emails
SMS messages
Online booking messages
Social-media messages
Complaints
Enquiries
Treatment-related communications
where these are relevant to providing our services, maintaining appropriate records or managing our relationship with you.
Recruitment Information
Where you apply for employment, self-employed work, training or another role with Enhance, we may collect information including:
Name and contact details
CV
Qualifications
Employment history
Professional registrations
References
Right-to-work information
Insurance information
DBS information where relevant and lawful
Other information supplied as part of the application process
3. HOW WE COLLECT YOUR INFORMATION
We may collect personal information:
Directly from you
Through our online booking system
Through consultation and consent forms
During consultations and treatments
Through telephone, email, SMS or messaging
Through our website
Through payment providers
From a prescribing professional or pharmacy involved in your treatment
From another healthcare professional where you have authorised this or where another lawful basis permits it
From a parent, guardian, carer or authorised representative where appropriate
Through cookies and similar technologies
Through recruitment or practitioner onboarding processes
4. WHY WE USE YOUR PERSONAL INFORMATION
We will only process personal information where we have an appropriate lawful basis for doing so.
Depending upon the circumstances, this may include processing because:
It is necessary to enter into or perform a contract with you
We have a legal obligation
It is necessary for our legitimate business interests and those interests are not overridden by your rights
You have provided valid consent
It is necessary to establish, exercise or defend legal claims
Another lawful basis applies under applicable data-protection legislation
Examples of our legitimate interests may include:
Managing appointments
Maintaining appropriate business and clinical records
Protecting the safety of clients and practitioners
Preventing fraud
Responding to complaints
Improving our services
Protecting the clinic's legal and business interests
Where we rely upon legitimate interests, we will consider whether our interests are balanced appropriately against your rights and freedoms.
5. HEALTH AND SPECIAL-CATEGORY INFORMATION
Medical and health information requires an additional lawful condition before it can be processed.
Enhance will only process health or other special-category information where an appropriate legal condition applies.
Depending upon the circumstances, this may include:
Your explicit consent
Processing necessary for the provision or management of appropriate health or treatment-related services where the legal requirements are satisfied
Processing necessary for establishing, exercising or defending legal claims
Another condition permitted under applicable data-protection legislation
We will not use health information for unrelated marketing purposes.
Where consent is relied upon as the legal basis for processing particular information, you may withdraw that consent.
Withdrawal of consent will not affect processing that was lawful before consent was withdrawn and may not require deletion of information that Enhance must lawfully retain for another reason.
6. BOTULINUM TOXIN AND PRESCRIBING INFORMATION
Where you attend a prescribing consultation for botulinum toxin or another Prescription Only Medicine, relevant personal and health information may be processed by the prescriber in order to undertake an appropriate clinical assessment.
Where prescribing is clinically appropriate, information necessary for the prescription and supply of the medication may be shared with the dispensing pharmacy.
The prescribing professional is independently responsible for their prescribing decision and may have separate professional or data-protection obligations.
Enhance will only share information that is reasonably necessary for safe and lawful prescribing, dispensing and treatment.
7. WHO WE MAY SHARE INFORMATION WITH
We will not sell your personal information.
Where necessary and lawful, information may be shared with organisations or professionals including:
Our booking and practice-management providers
Payment-processing providers
Website and hosting providers
Email and communications providers
IT and data-security providers
Prescribers involved in your care
Pharmacies supplying prescribed medication
Practitioners involved in your treatment or continuity of care
Professional advisers such as insurers, accountants or legal advisers
Regulatory, safeguarding, law-enforcement or government bodies where required or permitted by law
Other healthcare professionals where necessary and lawful
Service providers acting on our instructions
Where third parties process information on our behalf, we expect appropriate contractual, confidentiality and security arrangements to be in place.
We only share personal information where there is an appropriate reason and will seek to limit the information shared to what is reasonably necessary.
8. SELF-EMPLOYED PRACTITIONERS
Some practitioners operating from Enhance may work on a self-employed basis.
Depending upon the circumstances and the way a particular service is provided, Enhance and the practitioner may each have responsibilities under data-protection law.
Where a practitioner independently determines how and why personal information is processed, they may have their own data-protection responsibilities.
Where information needs to be shared between Enhance and a practitioner for legitimate purposes such as appointment administration, treatment, safeguarding, complaints, continuity of care or legal obligations, this will only be done where there is an appropriate lawful basis.
9. MARKETING
We may send information about treatments, products, services, events or promotions where we have an appropriate lawful basis to do so.
Where consent is required, we will ask for it.
You may withdraw your consent or opt out of direct marketing at any time.
You can normally do this by:
Selecting the unsubscribe option within a marketing email
Updating available communication preferences
Contacting Enhance directly
Opting out of marketing will not stop essential communications relating to your appointments, treatment, safety, payments or other services you have requested.
You have the right to object to your personal information being used for direct marketing at any time.
10. EMAIL NEWSLETTERS
Where you subscribe to our newsletters or marketing emails, our email provider may collect information about how you interact with communications, such as:
Whether an email was delivered or opened
Links selected
Date and time of interaction
Where required, such tracking will only be used where an appropriate lawful basis and any necessary consent are in place.
This information may be used to understand the effectiveness of our communications and improve the relevance of future marketing.
You may unsubscribe from marketing emails at any time.
11. APPOINTMENT REMINDERS AND SERVICE COMMUNICATIONS
Appointment confirmations, reminders, consultation forms, pre-treatment information, aftercare information and other necessary communications relating to a service you have requested are service communications rather than marketing communications.
You may therefore continue to receive essential appointment or treatment communications even where you have opted out of promotional marketing.
12. HOW LONG WE KEEP INFORMATION
We will only keep personal information for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal, regulatory, professional, insurance and contractual requirements.
Different information may therefore be retained for different periods.
When determining an appropriate retention period, we may consider:
The nature of the information
The type of treatment or service provided
Clinical and patient-safety requirements
Applicable legislation
Professional standards
Insurance requirements
Limitation periods relating to potential legal claims
Regulatory requirements
Safeguarding considerations
Clinical and treatment records may need to be retained for a significant period after your final treatment and cannot necessarily be deleted immediately simply because a client requests deletion.
At the end of the relevant retention period, records will be securely deleted, destroyed or anonymised unless there is a lawful reason to retain them for longer.
Recruitment records relating to unsuccessful applicants will normally only be kept for an appropriate limited period unless the applicant has consented to longer retention or another lawful reason applies.
13. CHILDREN AND YOUNG PEOPLE
Some non-injectable services may be available to clients under 18 where legally permitted, clinically appropriate and allowed by our insurance and treatment protocols.
Where we process information relating to a child or young person, we will take additional care to ensure that information is handled fairly, lawfully and transparently.
Where parental or guardian consent or involvement is required, this will be obtained as appropriate.
Injectable aesthetic treatments are not provided to clients under 18.
14. WHERE YOUR INFORMATION IS STORED
Personal information may be stored electronically within secure cloud-based systems and, where necessary, in appropriately secured physical records.
We use reasonable technical and organisational measures intended to protect information from:
Unauthorised access
Accidental loss
Destruction
Alteration
Disclosure
Misuse
Access to personal and clinical information should be limited to people who reasonably require access for their role.
No method of electronic transmission or storage can be guaranteed to be completely secure; however, we take proportionate measures to protect the information entrusted to us.
15. INTERNATIONAL TRANSFERS
Some technology providers used by Enhance may process or store information outside the United Kingdom.
Where personal information is transferred internationally, we will take appropriate steps to ensure that the transfer complies with applicable UK data-protection law.
Where required, this may include use of:
UK adequacy regulations
Approved contractual safeguards
The UK International Data Transfer Agreement
The UK Addendum to approved standard contractual clauses
Another lawful transfer mechanism
Further information about relevant safeguards may be requested from Enhance where applicable.
16. COOKIES AND SIMILAR TECHNOLOGIES
Our website may use cookies and similar storage or tracking technologies.
Some cookies are strictly necessary for the website or services to function and may not require consent.
Other technologies may be used for purposes such as:
Analytics
Website performance
Personalisation
Advertising
Social-media functionality
Tracking
Where consent is legally required, non-essential cookies and similar technologies will not be activated solely because you continue browsing the website.
You will be given an appropriate opportunity to accept, reject or manage relevant non-essential cookies.
You can change your cookie preferences where our website provides this functionality.
Your browser may also allow you to block or delete cookies, although doing so may affect certain website functions.
Further details about the particular cookies and technologies used should be available within our Cookie Notice or cookie-management tool.
17. YOUR DATA-PROTECTION RIGHTS
Depending upon the circumstances and the lawful basis being relied upon, you may have rights including:
Right of Access
You may ask us for a copy of the personal information we hold about you.
Right to Rectification
You may ask us to correct inaccurate information or complete information that is incomplete.
Right to Erasure
You may ask us to delete personal information in certain circumstances.
This right is not absolute, and we may need to retain information where there is a legal, regulatory, clinical, insurance or other lawful reason to do so.
Right to Restrict Processing
You may ask us to restrict how we use personal information in certain circumstances.
Right to Object
You may object to certain processing, including processing based upon legitimate interests.
You have the right to object to the use of your personal information for direct marketing at any time.
Right to Data Portability
In certain circumstances, you may have the right to receive information you provided to us in a structured, commonly used and machine-readable format or ask that it is transferred to another organisation.
Right to Withdraw Consent
Where processing is based upon consent, you may withdraw your consent at any time.
Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.
Automated Decision-Making
Where applicable, you may have rights relating to decisions made solely through automated processing.
Enhance does not normally make significant clinical treatment decisions solely through automated decision-making.
18. REQUESTING ACCESS TO YOUR INFORMATION
You may contact Enhance to exercise your data-protection rights.
We may need to verify your identity before releasing personal information or acting upon a request.
We will normally respond within the timeframe required by applicable data-protection legislation.
Requests will normally be handled without charge.
However, where permitted by law, a reasonable fee may be charged or a request may be refused where it is manifestly unfounded or excessive.
If we are unable to comply fully with a request, we will explain the reason where required.
19. ACCURACY OF INFORMATION
We want the personal information we hold to be accurate and up to date.
Please inform us if your:
Contact details
Medical history
Medication
Allergy information
Pregnancy or breastfeeding status
Other relevant information
changes.
It is particularly important that medical information is updated before treatment so that practitioners can make an appropriate safety assessment.
20. DATA SECURITY INCIDENTS
Enhance maintains procedures for identifying, assessing and managing personal-data breaches.
Where a personal-data breach creates a risk to people's rights and freedoms, we will take appropriate action in accordance with data-protection requirements.
Where legally required, this may include notifying the Information Commissioner's Office and/or affected individuals.
21. LINKS TO OTHER WEBSITES
Our website, booking system or communications may contain links to third-party websites or services.
Enhance does not control the privacy practices of independent third-party websites.
When following a link to another website or service, you should review that organisation's own privacy information.
22. CHANGES TO THIS PRIVACY NOTICE
We keep this Privacy Notice under review and may update it where necessary to reflect changes in:
Legislation
Regulatory guidance
Clinic services
Technology
Suppliers
Data-processing activities
The latest version will be made available through our website, booking system or another appropriate location.
Where a change materially affects how personal information is used, we will take reasonable steps to bring the change to the attention of affected individuals where required.
23. CONTACTING ENHANCE
For questions about this Privacy Notice, the personal information we hold about you or to exercise a data-protection right, please contact:
Enhance Medical Aesthetics & Wellness Clinic
Enhance Thanet Beauty & Aesthetics Ltd
Email: enhancethanet@gmail.com
You may also contact us using the contact information available through our official website or booking system.
24. COMPLAINTS TO THE INFORMATION COMMISSIONER'S OFFICE
If you have concerns about how Enhance has handled your personal information, we would welcome the opportunity to address them directly.
You also have the right to raise a concern with the Information Commissioner's Office (ICO), the UK's data-protection regulator.
Information about making a complaint and current ICO contact details can be found on the ICO website.
Making a complaint to Enhance does not prevent you from contacting the ICO.
ENHANCE MEDICAL AESTHETICS & WELLNESS CLINIC
Enhance Thanet Beauty & Aesthetics Ltd
PRIVACY • CONFIDENTIALITY • CLIENT SAFETY