Privacy Policy

1. Who We Are

La Roue Nurse-led Aesthetics is the data controller for the personal information described in this policy.

Contact: Lisa Hill / Clinton Hill · admin@laroue-aesthetics.co.uk · +44 7732 770 517 · 10b Strode Road, Wellingborough, Northants, NN8 1JU

Website: laroue-aesthetics.co.uk

ICO Registration Number: ZC192688

2. Information We Collect

• Contact details: name, address, phone number, email address, and emergency contact details.
• Health and medical information: medical history, medications, allergies, contraindications, and details relevant to your treatment and safety, including information provided at consultation and any prescriber assessment.
• Treatment records: consultation notes, treatment plans, consent forms, products used (including batch numbers), and aftercare records.
• Images: clinical photographs taken for your treatment record, and, only with your separate consent, for training or marketing purposes.
• Payment information: records of payments made, including deposits; we do not store full card details.
• Communication records: messages, emails, or booking correspondence between us.

3. Our Website & Cookies

If you visit or book through our website, we collect some information automatically and use cookies to help our website function and to understand how it is used, including analytics and, where relevant, embedded social media content and marketing cookies. This is explained fully in our separate Website Privacy & Cookie Policy, available on our website, which you should read alongside this policy if you are a website visitor.

4. How We Use Your Information & Our Legal Basis

We use your information for the following purposes, relying on the legal bases shown. Where we refer to UK GDPR Article 6(1)(b) (contract), 6(1)(c) (legal obligation), or 6(1)(f) (legitimate interests), these are the general lawful bases that apply alongside the specific health-data condition referenced in Section 5:

• To assess your suitability for treatment, and to provide safe and appropriate care — necessary for the performance of our contract with you (Article 6(1)(b)), and, for health information, because it is necessary for the provision of health care (Article 9(2)(h)).
• To maintain accurate clinical records, as required by professional and regulatory standards — necessary to comply with our legal and professional obligations (Article 6(1)(c)).
• To contact you about your appointments, aftercare, and follow-up reviews — necessary for the performance of our contract with you (Article 6(1)(b)).
• To process payments — necessary for the performance of our contract with you (Article 6(1)(b)).
• To use clinical photographs for training or marketing purposes — only with your explicit, separate consent, which you may withdraw at any time (Article 6(1)(a)).
• To comply with legal, regulatory, or insurance obligations, or to respond to a genuine emergency — necessary to comply with a legal obligation, or to protect your vital interests (Articles 6(1)(c) and 6(1)(d)).
• To maintain the security of our records and business, and to protect against fraud or misuse — necessary for our legitimate interests, balanced against your rights (Article 6(1)(f)).

5. Special Category (Health) Data

Information about your health is “special category data” under UK GDPR and is treated with particular care. We collect and use this information only where necessary to assess your suitability for treatment and to provide safe clinical care, and in accordance with our professional duty of confidentiality as a registered healthcare professional.

6. How We Store & Protect Your Information

Your information is stored securely, whether in physical (paper) or electronic form, with appropriate technical and organisational measures in place to protect it against unauthorised access, loss, or disclosure.

Examples include password-protected systems, restricted access, encrypted electronic records where appropriate and secure disposal of confidential documents.

Access to your records is limited to those directly involved in your care, such as your treating practitioner and prescriber.

7. How Long We Keep Your Information

We retain clinical records in line with professional record-keeping guidance for healthcare professionals, which generally requires adult clinical records to be kept for a minimum of 8 years from the date of your last treatment. Longer retention periods may apply in specific circumstances (for example, if you were under 18 at the time of treatment, or where required for the defence of a legal claim). Where information is no longer required, it is securely deleted or destroyed.

8. Who We Share Your Information With

We do not sell your information. We may share your information with:

• Your prescriber, for the purpose of assessment and prescribing.
• Your GP or another healthcare professional, where necessary for your safety or continuity of care, or with your consent.
• Our professional indemnity insurer, in the event of a claim or complaint.
• Regulatory or professional bodies (such as the NMC), where we are legally required to do so.
• Trusted service providers who support our business operations, such as booking software, clinical record systems, email providers, secure cloud storage providers, payment providers and IT support, who are contractually required to protect your information and only process it on our instructions.
• Emergency services or medical professionals, in the event of a genuine emergency.

9. International Transfers

Some of our trusted service providers may securely process or store data outside the UK, including where cloud-based software or email providers operate international servers. Where this occurs, appropriate safeguards — such as UK adequacy regulations or approved standard contractual clauses — are used to protect your personal information to the standard required under UK GDPR.

10. Photography & Marketing

Clinical photographs form part of your treatment record and are retained for this purpose regardless of any marketing consent. Photographs will only be used for training or promotional purposes (including on social media or our website) with your prior, explicit, and separate consent. You can withdraw this consent at any time by contacting us; this will not affect images already required to be retained in your clinical record.

11. Marketing Communications

We will only send you marketing communications, such as promotions, newsletters, or treatment offers, where you have given your consent or where otherwise permitted by law. You may opt out or unsubscribe from marketing communications at any time by contacting us or using the unsubscribe link provided, without affecting any other communications relating to your care.

12. Your Rights

Under UK GDPR, you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request erasure of your information, where applicable (this may be limited by our legal and professional obligation to retain clinical records for a set period).
• Request that we restrict or object to certain processing of your information.
• Request a copy of your information in a portable format, where applicable.
• Withdraw consent at any time, where we rely on consent as our legal basis (such as marketing use of photographs), without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us using the details in Section 1.

13. Data Breaches

In the unlikely event of a personal data breach, we have procedures in place to investigate, contain, and, where required under UK GDPR, report the breach to the Information Commissioner's Office and, where appropriate, to you.

14. How to Complain

If you have concerns about how we handle your personal information, please contact us directly in the first instance so we can address this. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent regulator for data protection, at ico.org.uk or by calling 0303 123 1113.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The most recent version of this Privacy Policy will always be available on request and, where applicable, on our website.

16. Contact Us

If you have any questions about this Privacy Policy or how we handle your information, please contact us at:

admin@laroue-aesthetics.co.uk / +44 7732 770 517 / 10b Strode Road, Wellingborough, Northants, NN8 1JU.