Dermal Health Privacy Policy

Last updated: 8 September 2026

This policy explains what personal information Dermal Health collects, why we collect it, how long we keep it, and what rights you have over it. It covers our website, our clinic, and the way we handle your clinical records.

Read it alongside our Cookie Policy.

1. Who we are

Dermal Health is a CQC-registered aesthetic and dermatology clinic at 28 Queen Street, London EC4R 1BB.

We are the data controller for the information described in this policy.

Controller	Dermal Health Limited, trading as Dermal Health
Company number	12915201
Clinic address	28 Queen Street, London EC4R 1BB
ICO registration reference	ZB160199
Contact for data protection	Úna Jefford, una@dermalhealth.co.uk, 020 3405 4655

Úna Jefford is a registered nurse and independent prescriber, and is our Medical Director. She is our point of contact for anything in this policy. We are not required to appoint a statutory Data Protection Officer and we have not appointed one.

2. What we collect

If you contact us or enquire

Your name, email address, phone number, and whatever you tell us in your message.

If you become a patient

Everything above, plus:

date of birth and address
your medical history, medication, allergies and relevant lifestyle information
consultation notes, treatment records, consent forms and aftercare records
clinical photographs, where you have agreed to them
laboratory and test results
appointment history and payment records

If you use our website

Technical information about your visit, but only if you accept analytics cookies. See the Cookie Policy for the detail. If you reject cookies, no analytics data is collected about you at all.

We do not collect information about children. Our services are for adults aged 18 and over.

3. Health information gets extra protection

Most of what we hold about a patient is health information. UK data protection law calls this “special category data” and gives it stronger protection than ordinary personal information. Clinical photographs count as health information too.

We treat it accordingly. It is stored in our practice management system with access limited to clinical staff, it is only used for marketing where you have explicitly consented (see sections 4 and 9), and it is never sold or shared with anyone outside the list in section 5.

4. Why we are allowed to process it

What we do	Our lawful basis (Article 6)	For health information, also (Article 9)
Answering your enquiry	Legitimate interests: responding to someone who has contacted us	Explicit consent, where you have told us about a condition in your message
Providing consultations and treatment	Performance of a contract with you	Article 9(2)(h), the provision of health care and treatment by a health professional under a duty of confidentiality, with the condition in Schedule 1 Part 1 paragraph 2 of the Data Protection Act 2018
Keeping clinical records	Legal obligation, and our legitimate interest in defending our clinical practice	Article 9(2)(h) as above
Taking payment and keeping accounts	Legal obligation under tax law	Not applicable
Clinical photography	Performance of a contract with you	Explicit consent, Article 9(2)(a). You can refuse and still be treated
Using photographs in marketing	Consent	Explicit consent, Article 9(2)(a). Separate from clinical photography consent, always optional, and withdrawable at any time
Sending marketing emails and text messages	Consent	Explicit consent, Article 9(2)(a). If you consent, we may use the treatments you have had to send you relevant recall reminders and reactivation messages. You can withdraw consent at any time and it will not affect your care.
Website analytics	Consent	Not applicable
Meeting our CQC and professional obligations	Legal obligation	Article 9(2)(h)

Marketing photographs are a separate decision. Saying yes to a clinical photograph for your records does not mean yes to it appearing on our website or social media. We ask separately, and you can say no to one and yes to the other, or no to both.

5. Who we share it with

We do not sell, rent or trade your information. We share it only where we have to, and only with organisations bound by a written contract to protect it.

Who	What they do	What they see
Pabau	Our practice management system, where clinical records and appointments are held	Your full clinical record
The Doctors Laboratory Limited (TDL), 76 Wimpole Street, London W1G 9RT	UKAS-accredited laboratory that processes clinical samples	Name, date of birth, test requested, relevant clinical details
Stripe	Payment processing	Payment details and transaction records. We do not store your full card number
Mailchimp	Sends marketing emails to people who have opted in and manages unsubscribes	Your email address and marketing subscription status
Google (Analytics)	Website analytics, and only if you accept analytics cookies	Anonymous website usage data. Never your clinical record
Google (reCAPTCHA)	Protects our forms from spam and automated submissions	Your IP address and how you interact with the page, on pages that carry a form
Google (YouTube)	Hosts the videos embedded on some of our pages	Nothing unless you press play. We use YouTube’s privacy-enhanced mode, which sets no tracking cookies until you start a video
Cloudflare	Sits in front of our website to keep it fast and to block automated attacks	Your IP address and connection details, in transit only
Elfsight	Displays our Google reviews on some pages	Nothing you give us. It stores a short-lived entry on your device
Our website and email suppliers	Hosting, contact form delivery and email sending	Enquiry details only
Our insurers and professional advisers	Only if there is a claim or complaint	Only what is relevant to that matter

We will also disclose information where the law requires it, for example to a court, to the Care Quality Commission, or to the Nursing and Midwifery Council in the course of a regulatory investigation.

We will never share your information with an advertising network.

6. Sending information outside the UK

Some of our suppliers store or process data outside the UK.

Where that happens, we make sure the transfer is protected by one of the following:

UK adequacy regulations, where the destination country has been assessed as providing equivalent protection
the UK Extension to the EU-US Data Privacy Framework
the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses

Your clinical records are held in the UK. The transfers above relate to website analytics, payment processing and email.

You can ask us for details of the safeguards for any specific supplier by emailing una@dermalhealth.co.uk.

7. How long we keep it

Record	How long	Why
Adult clinical records	8 years after your last treatment	NHS Records Management Code of Practice, applied as best practice by independent clinics
Clinical photographs	Kept with the clinical record, so 8 years after last treatment	Part of the record
Marketing photographs	Until you withdraw consent, then removed from anything we control	Consent
Enquiries that do not become appointments	24 months	Long enough to answer a follow-up, short enough not to hoard
Financial and payment records	6 years plus the current financial year	HMRC requirement
Marketing contact details	Until you unsubscribe, and reviewed every 24 months	Consent
Complaints records	8 years from closure	Aligned with the clinical record
Website analytics	14 months in Google Analytics	Enough for a year-on-year comparison, no longer

When a retention period ends, we delete the record or anonymise it so it can no longer identify you.

8. Your rights

You have the right to:

be told what we do with your information, which is what this policy is for
access the information we hold about you, including your clinical record
have it corrected if it is wrong or incomplete
have it erased in some circumstances. This right is limited for clinical records, because we have a legal and professional duty to keep them
restrict what we do with it while a dispute is resolved
object to processing based on legitimate interests
object to direct marketing at any time, which is an absolute right with no exceptions
withdraw consent at any time where we rely on consent, including for photographs. Withdrawing consent does not affect anything we did before you withdrew it
data portability, meaning we give you a copy in a machine-readable format where processing is based on consent or contract and is automated
not be subject to decisions made purely by automated means with legal or similarly significant effect. We do not make any such decisions. Where you have explicitly consented, our practice management system uses the treatments you have had to send relevant recall and reactivation messages.

To use any of these, email una@dermalhealth.co.uk. We will respond within one month. If your request is complex we may extend that by two further months, and we will tell you if we do. There is no charge.

We may ask you to confirm your identity before we release clinical information. That is to protect you, not to obstruct you.

9. Marketing

We only use your clinical information for marketing where you have explicitly consented to it. With that consent, your treatment history may determine what you are sent – for example a recall reminder when a repeat treatment may be due. Without it, we never use your clinical information for marketing.

We send marketing by email and, where you have agreed to it, by text message. We do not make marketing phone calls. Every marketing email has an unsubscribe link, and every marketing text tells you how to stop receiving them. You can also email una@dermalhealth.co.uk at any time and ask to be removed, and we will action it.

10. Complaints

If you are unhappy with how we have handled your personal information, complain to us first and we will try to put it right.

How to complain: email una@dermalhealth.co.uk with “Data protection complaint” in the subject line, or write to Data Protection Complaint, Dermal Health, 28 Queen Street, London EC4R 1BB.

What happens next:

We will acknowledge your complaint within 30 days of receiving it.
We will investigate without undue delay and keep you informed of progress.
We will tell you the outcome and what we have done about it.

You can complain to the Information Commissioner’s Office at any point, including before you have come to us. You do not have to complain to us first.

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
ico.org.uk
0303 123 1113

This complaints route is for how we handle your personal information. If your complaint is about your treatment or our service, our clinical complaints procedure is in our Terms and Conditions.

11. Website and cookies

Our Cookie Policy explains every cookie this site uses.

The short version: Google Analytics only runs if you accept it, and we run no advertising or marketing tracking of any kind. A small number of other cookies keep the site working and secure, and support the Google reviews and videos shown on some pages. All of them are listed by name, purpose and duration in the Cookie Policy.

12. Changes to this policy

We review this policy at least once a year, and whenever we change how we handle information. The date at the top shows when it was last changed. If we make a significant change, we will tell patients directly rather than relying on you to check this page.