2.1 Our Commitment to Your Privacy

At The Body Face & Wellness Clinic & Academy, we respect your privacy and understand the importance of protecting the personal information you share with us.

This Privacy Policy explains how we collect, use, store and share your information when you visit our website, contact us, book a consultation, receive treatment or enrol in training.

We process personal information in accordance with applicable UK data protection legislation, including the UK GDPR and Data Protection Act 2018, as amended.

2.2 Who Is Responsible for Your Information?

The data controller is:

2.3 Information We May Collect

Depending on your interaction with us, we may collect:

• Your name and contact information.
• Appointment, enquiry and booking details.
• Relevant consultation and treatment information.
• Medical history, health information and contraindications where necessary.
• Treatment measurements and progress photographs, where appropriate.
• Payment and transaction records.
• Academy enrolment, assessment and course progress information.
• Website usage information and cookie preferences.
• Communications sent through our website, email or messaging channels.

We aim to collect only information reasonably necessary for the relevant purpose.

2.4 How We Use Your Information

We may use your information to:

• Respond to enquiries and appointment requests.
• Arrange and manage consultations and treatments.
• Assess treatment suitability and maintain relevant client records.
• Process payments and maintain business records.
• Deliver Academy training and manage student enrolments.
• Communicate important booking or course information.
• Meet applicable legal and regulatory obligations.
• Maintain website security and improve our services.
• Send optional marketing communications where legally permitted.

2.5 Our Lawful Bases for Processing

Depending on the purpose, we may rely on the following lawful bases:

Contract: To provide services you have requested or take steps before entering into an agreement.

Legal obligation: To meet applicable legal, tax and record-keeping responsibilities.

Legitimate interests: Where necessary and appropriate for activities such as responding to enquiries, maintaining business security and administering our services, subject to your rights.

Consent: Where consent is required, such as certain marketing activities or specific uses of personal information.

Health information is classed as special category personal data. Before collecting or using it, we will identify an appropriate lawful basis and an additional condition under Article 9 of the UK GDPR. Where explicit consent is the appropriate condition, we will request it separately.

2.6 Consultation Records & Photography

Consultation records may include relevant health information, treatment plans and measurements.

Progress photographs will only be taken where appropriate and with your informed agreement.

We will obtain separate permission before using identifiable client photographs or testimonials for marketing, social media or promotional purposes.

Declining promotional photography will not prevent you from receiving an otherwise suitable treatment.

2.7 How We Share Your Information

Where necessary, personal information may be processed by trusted providers supporting our website, booking arrangements, payment processing, training platform, communications or IT services.

These may include our website hosting provider, booking system, payment providers, learning management platform and messaging services.

We do not sell your personal information.

Where information is transferred internationally, we will assess and apply the safeguards required by applicable data protection law.

2.8 How Long We Keep Your Information

We retain personal information only for as long as necessary for its purpose, applicable legal requirements and legitimate business needs.

Different categories of information may have different retention periods.

When information is no longer required, it will be securely deleted or anonymised, where appropriate.

2.9 Your Data Protection Rights

Subject to applicable legal conditions, you may have the right to:

• Request access to your personal information.
• Ask us to correct inaccurate information.
• Request deletion of information in certain circumstances.
• Request restriction of processing.
• Object to certain processing activities, including direct marketing.
• Request transfer of eligible personal information.
• Withdraw consent where processing is based on consent.

You may contact us using the privacy contact details provided above.

You also have the right to raise concerns with the Information Commissioner's Office (ICO) at www.ico.org.uk .

2.10 Marketing Communications

We may occasionally share information about services, training opportunities or relevant updates where permitted by law.

Where consent is required, we will ask for it separately.

You can opt out of marketing communications at any time.

2.11 Protecting Your Information

We take reasonable technical and organisational measures to protect personal information from unauthorised access, loss, misuse and disclosure.

Please avoid sending sensitive medical information through ordinary website enquiries or WhatsApp messages unless we have specifically provided an appropriate process for doing so.