CHATSWORTH AESTHETICS  |  AT BEAUTY LIMITED

Privacy Policy

This privacy charter sets out the standards, compliance controls, and data stewardship frameworks applied by Chatsworth Aesthetics to safeguard all personal and clinical information.

Last updated: October 2026

STATUTORY DISCLOSURE & GOVERNANCE

Data Protection & Privacy

This policy sets out the basis on which personal data and special category health information collected through our clinic, website, and digital consultation pathways is managed under UK GDPR and the Data Protection Act 2018.

1. Regulatory Framework & Governance

Chatsworth Aesthetics operates in strict adherence to the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and guidelines issued by the Information Commissioner’s Office (ICO). We process your personal data fairly, transparently, and only for specific, explicit, and legitimate clinical and administrative purposes.

2. Special Category Health & Aesthetic Records

Medical questionnaires, treatment plans, clinical histories, allergy documentation, and pre/post-treatment clinical photographs constitute Special Category Health Data under Article 9 of the UK GDPR. We process this critical information solely under Article 9(2)(h) (provision of health or social care treatment) and explicit clinical consent to guarantee patient suitability and safety.

Clinical Photographs & Consent

Photographs taken before and after aesthetic procedures form part of your private clinical record. They will NEVER be used for marketing, social media, or public display without separate, unbundled, and explicit written consent, which you may withdraw at any time.

3. Website Enquiries & Lead Form Policy

Submitting an enquiry via our digital forms allows us to contact you specifically regarding your consultation request. Please note: form submission does NOT grant automatic consent for marketing communications. You will only receive promotional updates, seasonal offers, or aesthetic newsletters if you have affirmatively opted in via an unchecked consent box.

4. Direct Messaging & WhatsApp Communications

We strictly delineate between clinical/administrative messages and direct promotional broadcasts:

  • Appointment & Clinical Logistics: SMS and WhatsApp notifications confirming bookings, pre-treatment instructions, and post-procedure care check-ins are sent under our legitimate interest and contractual care obligations.
  • Promotional Messaging: Special offers, event invitations, or marketing broadcasts are never sent without your direct opt-in. You may opt out instantly by replying 'STOP' or messaging our front desk.

5. Meta Pixel, Analytics & Cookie Usage

Our website uses tracking technologies, including the Meta Pixel and privacy-focused web analytics, to analyze audience engagement and optimize our digital consultations. Non-essential tracking scripts remain disabled until you provide positive consent via our cookie preferences banner. We never transmit sensitive medical details or clinical consultation inputs to third-party ad networks.

6. Lawful Processing Bases

Under Article 6 of the UK GDPR, our lawful bases for collecting and processing data include: Contractual Necessity (to manage appointments and deliver treatments), Legal Obligation (statutory clinical governance and tax compliance), Legitimate Interests (securing clinic premises and improving clinical workflows), and Explicit Consent (direct marketing broadcasts and public case studies).

7. Data Sharing, International Transfers & Security

We do not sell, rent, or trade your personal records. Data is shared exclusively with vetted clinical software providers, certified prescribing pharmacies, and secure payment processors bound by strict Data Processing Agreements. Where data is processed outside the UK, appropriate safeguards (such as the UK International Data Transfer Agreement or standard contractual clauses) are enforced. While we maintain rigorous administrative, technical, and physical safeguards, no digital system can offer an absolute guarantee against all potential security risks.

8. Retention Standards & Patient Data Rights

Personal data is retained only for as long as necessary to fulfill the purposes for which it was gathered, including satisfying medical, insurance, and statutory accounting requirements. Under UK data protection legislation, you hold the following rights regarding your personal records:

  • Right of Access: You may request a copy of the personal and treatment data we hold about you (Subject Access Request).
  • Right to Rectification: You may request immediate correction of inaccurate or incomplete medical records.
  • Right to Erasure ('Right to be Forgotten'): You may request deletion of your information, subject to mandatory statutory medical record retention obligations.
  • Right to Restrict or Object: You may restrict processing or object to direct communications at any time.
  • Right to Lodge a Complaint: You have the right to submit a formal complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

GOVERNANCE & STATUTORY RIGHTS

Data Controller & Rights

Direct access to our regulatory details, clinic physical premises, and your statutory rights under UK data protection legislation.

Data Controller Details

The statutory entity responsible for processing your clinical records and personal data under UK Data Protection legislation is:

  • Legal Entity: AT BEAUTY LIMITED
  • Registered Address: 1 Loveridge Mews, London NW6 2DP
  • Direct Telephone: 07946 679304
  • Jurisdiction: England & Wales (UK GDPR)

For correspondence concerning your health data or clinical privacy, please reach out via postal mail or phone at the registered clinic address above.

Your Statutory Rights

You maintain enforceable individual privacy rights under UK data protection framework, applicable without administrative fees:

  • Right of Access: Request structured copies of your clinical and personal records.
  • Rectification: Request prompt updates to inaccurate or incomplete details.
  • Erasure & Restriction: Request data deletion, subject to mandatory medical retention rules.
  • ICO Supervisory Authority: Retain the right to lodge a complaint directly with the UK Information Commissioner.

To exercise any statutory right or contact the Information Commissioner's Office, please visit ico.org.uk or call their national helpline on 0303 123 1113.