Privacy Policy

1. Important Information & Who We Are

Ms Victoria Smith t/a ‘Victoria Medical Aesthetics’ is the "Data Controller" responsible for your personal data. We are committed to protecting your privacy and handling your sensitive information in a safe, transparent, and legally compliant manner.

  • Contact Details: Hello@VictoriaMedicalAesthetics.co.uk

  • Clinic Address: Lower Brockholes House. Lower Brockholes. Halifax. HX2 8XQ

  • ICO Registration Number: ZC211389

2. The Data We Collect About You

We collect, store, and process personal data which is split into two categories:

  • Personal Data: Full name, date of birth (for age verification), billing/home address, telephone number, and email address.

  • Special Category Data (Medical & Health): Comprehensive medical histories, allergy records, current medications, previous aesthetic history, and clinical before-and-after photographs.

3. How and Why We Use Your Data

Under UK GDPR, we must have a "lawful basis" to process your data. We rely on the following legal grounds:

  • Contractual Necessity: To book your consultation and full fill your treatment plan.

  • Legal & Regulatory Obligations: To comply with healthcare record-keeping standards as mandated by our professional bodies and insurers.

  • Special Category (Healthcare Provision): We process medical histories and photos under Article 9(2)(h) of the GDPR for the purposes of preventive or occupational medicine and clinical diagnostics.

  • Explicit Consent: We will only use your photos on social media/website galleries or send you marketing emails if you tick a separate, optional, non-bundled consent box.

4. How Your Data is Secured & Shared

Your clinical data is never sold. It is shared only with essential, GDPR-compliant third parties, including:

  • Our dedicated, encrypted aesthetic medical software platform

  • Our independent Nurse Prescriber for the purpose of face-to-face prescribing

  • Professional medical authorities or insurers, only if legally required.
All digital records are securely encrypted, protected by multi-factor authentication (MFA), and backed up automatically.

5. Data Retention: How Long We Keep It

Unlike standard businesses, aesthetic clinics handle medical data. We retain your data in accordance with medical record retention timelines and insurance requirements, which is typically a minimum of 10 years following your last clinical treatment. After this point, records are securely permanently deleted.

6. Your Legal Rights

Under the UK GDPR, you hold rights over your data, including the right to:

  • Request access to your clinical records (Subject Access Request).

  • Request corrections to any inaccurate data.

  • Withdraw marketing or photographic consent at any time. (Please note: You cannot withdraw consent to delete active medical histories if they are required to protect our legal insurance standing).

If you believe we are mishandling your data, you have the right to lodge a formal complaint with the Information Commissioner’s Office (ICO).