1. Who we are
This policy explains how we (Fitzrovia Clinic) collect, use, share and protect your personal data when you are a patient or prospective patient. We are committed to protecting and respecting your privacy and follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
| Detail | Information |
|---|---|
| Controller | Medical Aesthetic Solutions Ltd, trading as Fitzrovia Clinic, company number 13690127 |
| Address | Fitzrovia Clinic, 5 Percy Street, London W1T 1DG |
| info@fitzroviaclinic.com | |
| Telephone | 020 3608 5908 |
| Information Governance Lead | Dr Toni Burke |
| ICO registration | Reference ZB313244 |
2. What personal data we collect
- Identity data: name, date of birth and gender.
- Contact data: address, telephone number and email address.
- Health data: medical history, medications, allergies, consultation notes, treatment records and consent forms. This is special category data and needs extra protection.
- Photographs: clinical photographs, such as before-and-after photographs, kept securely and linked to your appointment. We only use photographs to promote our services if you give separate consent.
- Financial data: payment details processed securely by our payment provider, and insurance information if applicable. We do not store full card details.
- Communications: emails, messages and notes of calls with the clinic.
- Marketing preferences: whether you wish to receive marketing from us.
- Website and online booking data: technical information such as your IP address and how you use our website.
- For children and young people: details of a parent or guardian.
3. How we collect your data
- When you complete forms, in the clinic or online
- When you contact us by telephone, email or in person
- Through our website and online appointment and consultation systems
- From other healthcare professionals, such as your GP or a pharmacy, with your agreement or where the law allows
4. Why we use your data and our legal basis
We must have a lawful basis for using your personal data. For health data we also need a special condition. The table shows what we rely on.
| Purpose | Lawful basis | Special category condition for health data |
|---|---|---|
| Providing and managing your consultations and treatments, and keeping accurate medical records | Contract (our agreement to provide you with treatment) | Provision of health care by a health professional who owes a duty of confidentiality |
| Complying with legal and regulatory duties, for example CQC requirements, tax law, safeguarding and professional regulation | Legal obligation | Health care, or substantial public interest in safeguarding |
| Managing payments and invoices | Contract | Not applicable |
| Improving our services through audit and quality review, handling complaints, and establishing or defending legal claims | Legitimate interests | Health care, or legal claims |
| Emergencies where you cannot give consent | Vital interests | Vital interests |
| Sending you marketing, and using photographs to promote our services | Your consent, which you can withdraw at any time | Your explicit consent |
Agreeing to treatment is not the same as giving consent under data protection law. We do not rely on consent to keep your medical records, and you do not need to agree to marketing to receive treatment.
5. How we use your data
- to provide and manage aesthetic and dermatology consultations and treatments
- to communicate with you about appointments, treatment and aftercare
- to process payments and invoices
- to maintain accurate medical records
- to meet our legal and regulatory requirements
- to send you marketing, only if you have agreed
6. Who we share your data with
We do not sell or trade your personal data. We share it only where necessary, with:
- other health professionals involved in your care, for example your GP, with your agreement
- pharmacies and laboratories that supply prescribed medicines and skincare, such as Acre Pharmacy, Wigmore Pharmacy, HealthXchange and Roseway
- our practice management and records system, Cliniko (you can access their privacy policy here), and our payment provider, Stripe
- other suppliers who help us run the clinic, such as IT, communications and secure storage providers
- regulators, professional bodies and the police, where required by law
- our insurers, indemnity provider and professional advisers where necessary
Our suppliers act on our instructions under written agreements, or are separately responsible for your data as health professionals. We keep an internal register of suppliers who process patient data.
Online bookings are taken via Cliniko, the online privacy policy for which can be found here.
7. International transfers
We are based in the UK. Where a supplier processes your data outside the UK, we make sure it is protected by a UK adequacy arrangement, or by safeguards such as the UK International Data Transfer Agreement or the UK Addendum.
8. How long we keep your data
- Medical records for adults: 10 years from your last appointment.
- Medical records for children and young people: until at least their 25th birthday, or until their 26th birthday if they were 17 when treatment ended.
- Financial and payment records: 6 years.
- Marketing preferences: until you withdraw your consent.
- Enquiries that do not lead to treatment: up to 12 months.
After this we review and securely destroy or delete the records, unless we are required to keep them, for example for a legal claim or investigation. Details are in our Records Retention Policy.
9. Your rights
- Access: ask for a copy of your data. We reply within one month and do not normally charge.
- Correction: ask us to correct inaccurate or incomplete data.
- Erasure: ask us to delete your data, where it applies. We cannot delete medical records that we must keep.
- Restriction: ask us to limit how we use your data.
- Objection: object to our use of your data in certain circumstances, including marketing.
- Portability: ask for your data to be transferred to you or another provider in a usable format.
- Withdrawing consent: where we rely on consent, withdraw it at any time.
To exercise your rights, contact info@fitzroviaclinic.com or telephone 020 3608 5908.
10. Children and young people
The clinic provides care for adults and only treats under-18s by exception. For a child or young person, we may involve a parent or guardian. Children under 16 who understand their treatment may have their own rights over their data, and we consider each case individually.
11. Data security
We use appropriate technical and organisational measures to protect your personal data, including access controls, encryption, secure storage, staff confidentiality agreements and regular training. If there is a data breach that affects you, we will tell you and the Information Commissioner’s Office where the law requires.
12. Marketing communications
We send marketing only if you have agreed. You can withdraw consent at any time by contacting us or using the unsubscribe link in our emails. Withdrawing consent does not affect your treatment.
13. Complaints and contact
If you have a concern about how we use your data, please contact Dr Toni Burke, our Information Governance Lead, at info@fitzroviaclinic.com or on 020 3608 5908, or write to us at Fitzrovia Clinic, 5 Percy Street, London W1T 1DG. We will respond promptly.
You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
14. Changes to this policy
We review this policy every year and may update it.
Last updated: 27 October 2026.