Privacy Policy

How we collect, use and protect your personal data.

1. INTRODUCTION

Campbell Aesthetics Studio (“we”, “us”, “our”) is committed to protecting and safeguarding your personal data.

This Privacy Policy explains how we collect, use, store, and protect your personal information when you interact with our website, booking system, and clinical services.

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using our website or services, you acknowledge that you have read and understood this Privacy Policy.

2. DATA CONTROLLER

Campbell Aesthetics Studio

Operated by Dr Daniel Campbell MBBS

📍 Newcastle upon Tyne
📧 [Insert Email Address]
📞 [Insert Phone Number]
ICO Registration Number: [Insert if applicable]

We are the data controller responsible for your personal data.

3. dATA PROTECTION RESPONSIBILITY & ACCOUNTABILITY

We are not required to appoint a Data Protection Officer (DPO). However, responsibility for data protection compliance rests with the business.

We maintain internal records of data processing activities in accordance with Article 30 of the UK GDPR and uphold appropriate accountability measures.

4. wHAT DATA WE COLLECT

We may collect and process the following categories of personal data:

Personal Information

Full name
Date of birth
Gender (where relevant)
Email address
Telephone number
Address (where required)

Booking & Communication Data

Appointment details and history
Enquiries and preferences
Communication records (email, phone, WhatsApp, social media)
Notes relating to customer service interactions

Medical Information (Special Category Data)

Medical history
Current and past medical conditions
Allergies and sensitivities
Medications (current and recent)
Previous aesthetic or medical treatments
Lifestyle factors relevant to treatment (e.g. smoking, pregnancy status)
Clinical notes, treatment records, and practitioner observations

This data is processed strictly for the purpose of:

Assessing treatment suitability
Ensuring patient safety
Maintaining accurate medical records
Providing appropriate clinical care

Emergency Contact Information

Where required for clinical safety, we may collect:

Name
Relationship to you
Contact telephone number

This information is used only where necessary to protect your health or vital interests.

Technical and Usage Data

Automatically collected data relating to your use of our website, including:

IP address
Browser type and version
Device type and operating system
Pages visited and time spent on site
Interaction data (clicks, navigation behaviour)

This data is collected via cookies and similar technologies in accordance with your consent preferences.

Marketing and Preference Data

Where you have provided consent, we may collect:

Preferences for receiving marketing communications
Engagement with emails, offers, or promotions
Feedback, reviews, or testimonials

You may withdraw your consent for marketing at any time.

Images & Media

Where applicable, we may collect:

Before-and-after photographs
Treatment-related images or video recordings

This data may be used for:

Clinical records
Treatment planning and progress tracking
Educational or marketing purposes (only with explicit written consent)

Payment & Transaction Data

We may process limited payment-related data, including:

Transaction details
Payment confirmation records

We do not store full payment card details. Payments are processed securely via third-party payment providers.

5. HOW WE COLLECT YOUR DATA

We collect personal data through a variety of methods in order to provide our services safely, effectively, and in compliance with legal and regulatory obligations.

Direct Collection from You

We primarily collect personal data directly from you when you:

Complete forms on our website
Make or manage bookings via our online booking system
Contact us via email, telephone, WhatsApp, or social media
Attend consultations or receive treatments
Provide information during medical assessments or consent processes

All information provided must be accurate, complete, and up to date.

We accept no responsibility for any issues arising from inaccurate or incomplete information supplied by you.

Automated Collection via Website

When you use our website, we may automatically collect certain technical data, including:

IP address
Browser type and device information
Pages visited and user behaviour

This information is collected through cookies and similar technologies in accordance with your consent preferences.

Third-Party Platforms

We may collect data through third-party systems used to operate our services, including but not limited to:

Website and booking platforms (e.g. Wix)
Payment processors
Communication platforms (e.g. email, WhatsApp, social media messaging)

These providers may independently collect and process your data in accordance with their own privacy policies.

We recommend that you review their policies before using these services.

Social Media Interactions

Where you interact with us via social media platforms (including direct messages, comments, or replies), any information you provide is considered voluntarily disclosed.

We strongly advise against sharing sensitive personal or medical information via social media channels.

Medical & Clinical Data Collection

During consultations and treatments, we will collect medical information necessary to:

Assess suitability for treatment
Ensure patient safety
Maintain accurate clinical records

This data is collected directly from you and forms part of your confidential medical record.

Failure to disclose relevant medical information may impact the safety and effectiveness of your treatment, and we accept no liability for complications arising from such non-disclosure.

Indirect or Incidental Data

In limited circumstances, we may receive data indirectly, for example:

When another individual provides your details to make a booking on your behalf
Through publicly available platforms where you have chosen to share information

In such cases, we will process data only where lawful and necessary.

You should ensure that any emergency contact whose details you provide is aware that their information has been shared for this purpose.

6. HOW WE USE YOUR DATA

We process personal data only where it is necessary, lawful, and proportionate for the operation of our clinic and the provision of safe, effective medical aesthetic services.

Your personal data will not be used for purposes beyond those set out below without your knowledge or, where required, your consent.

Provision of Medical & Aesthetic Services

We process your data to:

Assess your suitability for treatment
Provide safe and appropriate medical aesthetic procedures
Maintain accurate clinical records
Monitor treatment outcomes and patient safety

Processing for these purposes is essential for the delivery of healthcare services and cannot be restricted where treatment is provided.

Appointment & Booking Management

We use your data to:

Schedule and manage appointments
Send booking confirmations and reminders
Communicate changes or updates to your appointment

Communication & Patient Support

We process your data to:

Respond to enquiries
Provide pre- and post-treatment advice
Deliver important service-related communications
Contact an emergency contact where necessary to protect your health or safety

We will only use appropriate communication channels and will not disclose sensitive information through insecure platforms where possible.

Legal, Regulatory & Professional Obligations

We process and retain your data to:

Comply with healthcare regulations and professional standards
Maintain medical records in accordance with legal requirements
Respond to regulatory, legal, or insurance-related requests

We reserve the right to retain and process data where required to meet these obligations, even where a request for deletion is made.

Business Operations & Service Improvement

We may process limited data to:

Improve our services and patient experience
Analyse website performance and user behaviour
Maintain internal administrative records

This processing is carried out on the basis of legitimate interests and will not override your rights or freedoms.

Marketing & Promotional Communications

Where you have provided explicit consent, we may use your data to:

Send updates, offers, or relevant information
Share news about our services

You may withdraw your consent at any time.

We will not send unsolicited marketing communications without your permission.

Image & Media Use

Where separate explicit consent has been provided, we may process your images for:

Clinical documentation
Educational use
Marketing and promotional purposes

No identifiable images will be used for marketing without your explicit written consent.

Protection of Legal Rights

We may process your data where necessary to:

Establish, exercise, or defend legal claims
Protect the rights, safety, and interests of our patients, staff, and business

Data Limitation

We will not:

Use your data for unrelated or incompatible purposes
Share your data for third-party marketing
Process your data in a manner inconsistent with this policy

7. REQUIREMENT TO PROVIDE DATA

Where personal or medical information is required:

Failure to provide this information may result in our inability to offer treatment
This is necessary to ensure patient safety and compliance with professional standards

8. LEGAL BASIS FOR PROCESSING

We process personal data only where there is a lawful basis to do so under the UK General Data Protection Regulation (UK GDPR).

Depending on the nature of your interaction with us, we rely on one or more of the following legal bases:

Contractual Necessity

We process your personal data where it is necessary to:

Provide services you have requested
Manage and fulfil bookings and appointments
Communicate with you regarding your treatment or enquiry

Without this data, we may be unable to provide our services.

Legal Obligation

We process and retain personal data where required to comply with:

Healthcare regulations and professional standards
Medical record-keeping obligations
Legal, regulatory, or insurance requirements

Where processing is required by law, you do not have the right to request deletion of such data.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests, including:

Operating and managing our clinic
Improving our services and patient experience
Ensuring the safety and integrity of our business
Maintaining accurate internal records

We ensure that such processing does not override your rights and freedoms.

Consent

We rely on your consent for:

Marketing communications
Certain non-essential data processing
Use of images for promotional purposes

Consent can be withdrawn at any time.

Withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal.

Special Category Data (Medical Information)

As a medical aesthetics clinic, we process special category data under Article 9 of UK GDPR.

This includes medical and health-related information necessary to:

Assess treatment suitability
Provide safe and appropriate care
Maintain accurate clinical records

We process this data under the following conditions:

Explicit consent (Article 9(2)(a))
Provision of healthcare services (Article 9(2)(h))

Processing of this data is essential for clinical safety and cannot be restricted where treatment is provided.

Establishment, Exercise, or Defence of Legal Claims

We may process personal data where necessary to:

Establish, exercise, or defend legal claims
Respond to complaints, disputes, or regulatory investigations

Data Retention & Legal Rights

We reserve the right to retain and process personal data where required to:

Comply with legal or regulatory obligations
Protect our legal position
Maintain appropriate medical records

Requests for erasure or restriction may be refused where such data must be retained for lawful purposes.

Limitation of Reliance on Consent

Where possible, we rely on legal bases other than consent (such as contractual necessity or legal obligation) to ensure continuity of care and compliance with professional standards.

Withdrawal of consent will not affect:

Data required for medical records
Data required for legal compliance
Data necessary to protect patient safety

Emergency Contact Data

Emergency contact information is processed under:

Vital interests
Legitimate interests

9. LAWFUL BASIS SUMMARY

For clarity:

Booking and contact data → Contractual necessity
Medical data → Healthcare provision and legal obligations
Emergency contact data → Vital interests / legitimate interests
Marketing → Consent
Website analytics → Consent / legitimate interests

10. PHOTOGRAPHY, IMAGES & MEDIA

As part of your treatment journey, clinical photographs and/or video recordings may be taken for the purposes of:

Medical assessment and treatment planning
Clinical records and monitoring of results
Professional training and quality assurance

These images form part of your confidential medical record.

Consent for Marketing & Educational Use

We may request your separate, explicit written consent to use your images for:

Website content
Social media platforms (e.g. Instagram, Facebook)
Marketing materials
Educational and professional purposes

Your images will never be used for marketing purposes without your prior written consent.

Anonymity & Identification

Where consent is provided:

We will take reasonable steps to minimise identification where appropriate
However, full anonymity cannot be guaranteed, particularly in facial treatments
By consenting, you acknowledge and accept this risk

Right to Withdraw Consent

You have the right to withdraw your consent for marketing use at any time.

Upon withdrawal, we will remove your images from future use
However, we cannot guarantee removal from materials already published or shared prior to withdrawal

Ownership & Usage Rights

All images taken remain the property of Campbell Aesthetics Studio

By providing consent, you grant us a non-exclusive, royalty-free right to use the images for the purposes agreed.

Patient Responsibility

By consenting to photography:

You confirm that you understand how your images may be used
You agree not to hold Elysian Aesthetics liable for third-party sharing once content is published publicly
You acknowledge that images may be shared across digital platforms where redistribution cannot be fully controlled

Refusal of Consent

You are under no obligation to consent to the use of your images for marketing purposes.

Refusal will not affect your treatment in any way
Clinical photography for medical records may still be required

11. PROFESSIONAL CONFIDENTIALITY

All personal and medical information is treated as confidential in accordance with:

Data protection laws
Professional and ethical standards
Medical confidentiality obligations

All data is handled in line with clinical governance principles expected within medical practice.

12. COOKIES

We use cookies and similar technologies to:

Ensure website functionality
Analyse usage and performance
Improve user experience

Non-essential cookies are only used with your consent via our cookie banner.

You can manage your cookie preferences at any time through your browser settings or our cookie consent tool.

For full details on the cookies we use, including types, purposes, and how to manage them, please see our Cookie Policy.

Our Cookie Policy forms part of this Privacy Policy and should be read alongside it.

14. DATA SHARING

We do not sell, rent, or trade your personal data.

We will only share your personal data where it is necessary, lawful, and proportionate for the provision of our services, compliance with legal obligations, or protection of our legitimate interests.

Service Providers & Third-Party Processors

We may share your data with trusted third-party providers who support the operation of our clinic, including:

Website and booking platforms (e.g. Wix)
Payment processing providers
Communication services (email, SMS, WhatsApp)
IT and system administration providers

These providers process data on our behalf and are required to:

Comply with applicable data protection laws
Process data only in accordance with our instructions
Implement appropriate security measures

Healthcare, Legal & Regulatory Requirements

We may disclose personal data where required to:

Comply with legal or regulatory obligations
Respond to lawful requests from authorities
Meet professional healthcare standards
Defend or pursue legal claims

Such disclosures will be limited to what is necessary and lawful.

Clinical Safety & Patient Care

Where necessary for patient safety, we may share relevant information with:

Other healthcare professionals involved in your care
Emergency services where required
Your Emergency Contact

This will only occur where it is in your vital interests or necessary for safe clinical practice.

Third-Party Platforms & Independent Controllers

Where you interact with us via third-party platforms (including social media, messaging apps, or external booking systems):

These platforms may independently collect and process your data
They act as separate data controllers
Their use is subject to their own privacy policies

We are not responsible for how these platforms handle your data outside of our control.

Data Minimisation in Sharing

We will only share the minimum amount of data necessary for the relevant purpose.

We do not share your data for:

Third-party marketing
Unrelated commercial purposes

Patient Responsibility

Where you choose to share your personal data through external platforms (e.g. social media, messaging apps), you acknowledge that:

Such platforms may not offer the same level of security
You provide information at your own discretion

We strongly advise against sharing sensitive medical information via these channels.

Limitation of Liability

While we take reasonable steps to ensure that third parties handle your data securely:

We do not control the security practices of external providers
We are not liable for data breaches, loss, or misuse arising from third-party systems beyond our reasonable control

15. INTERNATIONAL DATA TRANSFERS

Some third-party providers may store or process data outside the UK.

Where this occurs, we ensure that:

Appropriate safeguards are in place (e.g. adequacy regulations or standard contractual clauses)
Data is transferred in accordance with GDPR requirements

16. COMMUNICATIONS (EMAIL, WHATSAPP & SOCIAL MEDIA)

We are committed to ensuring that any marketing communications are conducted in a lawful, transparent, and respectful manner in accordance with the UK GDPR and the Privacy and Electronic Communications Regulations (PECR).

Consent-Based Marketing

We will only send marketing communications where you have provided explicit, informed consent.

This may include:

Promotional offers
Updates about services
News, events, or announcements

Consent will be obtained through clear, affirmative action (e.g. ticking an opt-in box) and will not be assumed or pre-selected.

Separation from Clinical Communication

Marketing communications are entirely separate from essential service communications.

We may contact you without consent where necessary to:

Confirm or manage appointments
Provide treatment-related information
Deliver important clinical or safety updates

These communications are not considered marketing and cannot be opted out of where required for service delivery.

Communication Channels

Where consent has been provided, we may contact you via:

Email
SMS
Telephone
WhatsApp
Social media messaging platforms

You may specify your preferred method(s) of communication where applicable.

Right to Withdraw Consent

You have the right to withdraw your consent to marketing at any time.

You can do this by:

Clicking “unsubscribe” in any email communication
Replying “STOP” to SMS or messaging services where applicable
Contacting us directly

Upon withdrawal, we will cease marketing communications promptly.

Record of Consent

We maintain records of:

When and how consent was obtained
What you were told at the time of consent

This is to demonstrate compliance with GDPR requirements.

Opt-Out & Suppression

Where you opt out of marketing:

We will retain minimal data necessary to ensure you are not contacted again (suppression list)
This data will not be used for any other purpose

Third-Party Marketing

We do not:

Sell your data to third parties
Share your data for third-party marketing purposes

You will not receive marketing communications from external organisations as a result of interacting with us.

Social Media & Messaging Platforms

Where you contact us via social media or messaging platforms:

Responses to your enquiries are not considered marketing
We will not send unsolicited promotional messages via these platforms without your consent

You should be aware that these platforms operate independently and may process your data under their own policies.

Limitation of Liability

While we take reasonable steps to ensure compliance with applicable laws:

We are not responsible for messages sent via third-party platforms where such platforms operate independently
We are not liable for any unauthorised access to communications outside of our control

Misuse & Abuse Prevention

We reserve the right to:

Restrict or cease communications where misuse, abuse, or inappropriate behaviour occurs
Retain communication records where necessary to protect our legal rights

Interaction via Social Media

Campbell Aesthetics Studio maintains a presence on social media platforms, including but not limited to Instagram, Facebook, and other digital channels.

If you contact us via social media (e.g. direct message, comments, or replies), we may collect and process:

Your name or username
Contact details you provide
Any information you voluntarily share

This information will be used solely to:

Respond to your enquiry
Provide information about services
Arrange consultations or appointments

Transition to Secure Channels

Where appropriate, we may request that conversations involving personal or sensitive information are moved to more secure channels (such as email or our booking system).

We strongly advise against sharing sensitive personal or medical information via social media platforms.

Platform Responsibility

Please note that social media platforms operate independently and have their own privacy policies.

We are not responsible for how these platforms collect, use, or store your data. We recommend reviewing their privacy policies before interacting with us.

User Responsibility

By contacting us via social media, you acknowledge that:

Any information you share is provided voluntarily
You should avoid sharing sensitive or confidential information
You understand that social media platforms may not be fully secure

17. DATA MINIMISATION

We only collect personal data that is necessary, relevant, and proportionate.

We will not process your data for purposes incompatible with this Privacy Policy.

18. DATA SECURITY

We are committed to ensuring that your personal data is processed securely and protected against unauthorised access, loss, misuse, or disclosure.

We implement appropriate technical and organisational measures in accordance with the UK GDPR, taking into account the nature, scope, and sensitivity of the data processed, including special category (medical) data.

Security Measures

We maintain appropriate safeguards, including but not limited to:

Secure, password-protected systems and devices
Restricted access to personal data on a need-to-know basis
Use of reputable, GDPR-compliant third-party service providers (e.g. Wix, booking systems, payment processors)
Regular review of data handling practices
Secure storage of clinical and administrative records

Where applicable, we take reasonable steps to ensure that data is encrypted or otherwise protected during transmission and storage.

Access Control

Access to personal data is limited to authorised personnel only, including:

The treating practitioner
Administrative staff where necessary

All individuals with access to personal data are required to handle it confidentially and in accordance with data protection principles.

Electronic Communications

While we take reasonable steps to protect data transmitted electronically:

No method of transmission over the internet is completely secure
We cannot guarantee absolute security of data transmitted via email, website forms, or messaging platforms

Where possible, sensitive medical information should not be shared via unsecured channels such as social media or messaging apps.

Data Storage & Retention Security

We ensure that:

Data is stored securely for the duration of the retention period
Access is controlled and monitored
Data is securely deleted or anonymised when no longer required

Data Storage Location

Personal data may be stored using secure digital systems, including cloud-based platforms, which may involve storage within or outside the UK, subject to appropriate safeguards.

Accountability & Record Keeping

We maintain appropriate records of our data processing activities in accordance with GDPR accountability requirements.

This includes records of:

Data processing activities
Consent where applicable
Data protection measures

Patient Responsibility

You are responsible for:

Ensuring that any personal data you provide is accurate
Protecting your own devices and communication channels
Avoiding the transmission of sensitive information via insecure platforms

We accept no liability for data breaches or unauthorised access arising from factors beyond our reasonable control, including user negligence or third-party system failures.

Limitation of Liability

While we take all reasonable and appropriate steps to protect your personal data:

We do not guarantee absolute security of any data
We are not liable for indirect, incidental, or consequential losses arising from data breaches beyond our control
Use of our website and services is at your own risk in relation to data transmission

19. DATA BREACH NOTIFICATION

In the event of a data breach, we will:

Take immediate steps to contain and assess the breach
Notify affected individuals where required
Report the breach in accordance with applicable legal timeframes, including notification to the Information Commissioner’s Office (ICO) within 72 hours where legally necessary

20. DATA RETENTION

We retain personal data only for as long as is necessary, proportionate, and lawful, taking into account:

The purpose for which the data was collected
Legal, regulatory, and professional obligations
The need to maintain accurate medical records
The protection of our legal rights

Medical Records

As a provider of medical aesthetic treatments, we are required to retain medical records for an appropriate period in accordance with professional and legal standards.

Medical records will be retained for a minimum of 7–8 years from the date of your last treatment
Where clinically or legally necessary, records may be retained for a longer period

Medical records will not be deleted upon request where retention is required for:

Legal compliance
Clinical safety
Defence of potential legal claims

Appointment & Booking Data

We retain booking and appointment-related data:

For operational and administrative purposes
To maintain continuity of care
To manage future bookings and patient history

This data will be retained only as long as reasonably necessary.

Enquiries & Non-Patient Data

Where you contact us but do not proceed with treatment:

Your data will be retained only as long as necessary to respond to your enquiry
It may be deleted where no longer relevant or required

Marketing Data

Where you have consented to receive marketing communications:

Your data will be retained until you withdraw your consent
Upon withdrawal, you will no longer receive marketing communications

We may retain a record of your opt-out to ensure compliance with your preferences.

Technical & Website Data

Website usage data (e.g. cookies, analytics) is retained in accordance with:

Cookie settings
Third-party provider policies

You may control this through your cookie preferences.

Image & Media Data

Clinical images form part of your medical record and will be retained in line with medical record retention periods
Images used for marketing will be retained only while consent remains valid

If consent is withdrawn:

We will cease future use
We cannot guarantee removal from materials already published

Legal & Regulatory Retention

We may retain personal data for longer periods where necessary to:

Comply with legal or regulatory obligations
Respond to complaints, disputes, or claims
Protect the rights, safety, and integrity of our business

Secure Deletion

When data is no longer required, we will:

Delete or anonymise it securely
Ensure it cannot be reconstructed or accessed

Limitation of Erasure Requests

While you have the right to request deletion of your data, this right is not absolute.

We reserve the right to refuse or limit such requests where data must be retained for:

Medical record-keeping obligations
Legal or regulatory compliance
Establishment, exercise, or defence of legal claims

21. AUTOMATED DECISION-MAKING

We do not carry out automated decision-making or profiling.

22. LIMITATION OF LIABILITY

While campbell Aesthetics studio takes all reasonable and appropriate steps to ensure that personal data is processed securely and in accordance with applicable data protection laws, the transmission and storage of data via electronic systems carries inherent risks.

No Absolute Security Guarantee

We implement appropriate technical and organisational measures to safeguard personal data. However:

No system or method of data transmission over the internet is completely secure
We do not guarantee the absolute security of data transmitted to or from our website, booking systems, or communication platforms

By using our services, you acknowledge and accept these inherent risks.

Third-Party Systems

Our services rely on third-party providers, including but not limited to:

Website and booking platforms (e.g. Wix)
Payment processors
Email, messaging, and communication services

While we take reasonable care in selecting reputable providers:

We do not control the security or data handling practices of third-party systems
We are not liable for data breaches, loss, or unauthorised access arising from systems outside our direct control

User Responsibility

You are responsible for:

Ensuring the accuracy of any personal data you provide
Maintaining the security of your own devices and communication channels
Avoiding the transmission of sensitive or confidential information via insecure platforms (e.g. social media or messaging apps)

We accept no liability for data loss or misuse resulting from user negligence or actions beyond our control.

Communication Risks

Where you choose to communicate with us via:

Email
Website forms
WhatsApp or messaging platforms
Social media

You acknowledge that:

Such methods may not be fully secure
Information transmitted may be subject to interception or unauthorised access

We recommend limiting the sharing of sensitive information through such channels

Indirect & Consequential Loss

To the fullest extent permitted by law, Elysian Aesthetics shall not be liable for:

Indirect, incidental, or consequential loss or damage
Loss of data, business, revenue, or reputation
Loss arising from unauthorised access to data beyond our reasonable control

Events Beyond Our Control

We shall not be liable for any failure or delay in protecting or processing data where such failure arises from events beyond our reasonable control, including but not limited to:

Cyberattacks or hacking
System failures
Third-party service outages
Internet or telecommunications disruptions

Legal Compliance & Limitation

Nothing in this section excludes or limits liability where it cannot be excluded under applicable law, including liability arising from:

Negligence resulting in personal injury
Fraud or fraudulent misrepresentation

22. YOUR RIGHTS

Under the UK General Data Protection Regulation (UK GDPR), you have certain rights in relation to your personal data. These rights are subject to limitations, particularly where data is required for medical, legal, or regulatory purposes.

Right of Access

You have the right to request access to the personal data we hold about you.

Requests must be made in writing
We may require proof of identity before releasing data
We will respond within the legally required timeframe

Right to Rectification

You have the right to request correction of:

Inaccurate or incomplete personal data

It is your responsibility to ensure that the information you provide to us is accurate and up to date.

Right to Erasure (“Right to be Forgotten”)

You may request that we delete your personal data.

However, this right is not absolute, and we may refuse such requests where data must be retained for:

Medical record-keeping obligations
Legal or regulatory compliance
Establishment, exercise, or defence of legal claims
Protection of patient safety

In particular, medical records will not be deleted where retention is required by law or professional standards.

Right to Restrict Processing

You have the right to request that we restrict the processing of your data in certain circumstances.

This right may be limited where processing is necessary for:

Ongoing medical care
Legal or regulatory obligations
Protection of our legitimate interests

Right to Object

You have the right to object to the processing of your personal data where it is based on legitimate interests.

We may continue processing where we can demonstrate:

Compelling legitimate grounds
Legal or regulatory requirements

Right to Data Portability

You may request to receive your personal data in a structured, commonly used format, or request that it be transferred to another provider where technically feasible.

This right applies only to data processed on the basis of consent or contract.

Right to Withdraw Consent

Where processing is based on your consent (e.g. marketing or image use), you have the right to withdraw that consent at any time.

Withdrawal of consent will not affect:

Processing already carried out
Data required for medical records
Data required for legal or regulatory compliance

Right to Complain

If you are dissatisfied with how your data is handled, you have the right to lodge a complaint with:

Information Commissioner’s Office (ICO)

https://www.ico.org.uk

We encourage you to contact us first so we can address your concerns.

Verification & Administration

To protect your data, we:

May request proof of identity before processing any request
Reserve the right to refuse or limit requests that are excessive, unfounded, or repetitive
May charge a reasonable administrative fee where permitted by law

Limitation of Rights

Your rights under GDPR are not absolute and may be restricted where necessary to:

Comply with legal obligations
Maintain accurate medical records
Protect patient safety
Safeguard the rights and freedoms of others
Defend legal claims

23. CHILDREN'S DATA

Elysian Aesthetics does not knowingly collect or process personal data relating to individuals under the age of 18 nor do we knowingly accept bookings from individuals under the age of 18 years.

Our services are intended for adults only, and we do not provide aesthetic treatments to minors.

If we become aware that personal data relating to a person under the age of 18 has been collected, we will take reasonable steps to delete such data.

24. BUSINESS TRANSFERS

In the event of a sale, merger, restructuring, or transfer of the business, personal data may be transferred as part of that transaction.

Any such transfer will be carried out in accordance with applicable data protection laws.

25. WEBSITE INFORMATION

Information provided on this website is for general guidance only and should not be relied upon as medical advice.

26. CHANGES TO THIS POLICY

CAMPBELL AESTHETICS STUDIO reserves the right to update, amend, or replace this Privacy Policy at any time to reflect:

Changes in legal or regulatory requirements
Updates to our services or business practices
Improvements to data protection procedures

Publication of Updates

Any changes to this Privacy Policy will be:

Published on our website
Effective immediately upon publication, unless otherwise stated

The most current version will always be available on our website and will supersede all previous versions.

User Responsibility

It is your responsibility to review this Privacy Policy periodically to remain informed of any updates.

Your continued use of our website or services following the publication of changes constitutes your acceptance of the updated policy.

No Obligation for Individual Notification

We are not obliged to notify you individually of changes to this Privacy Policy, except where required by law.

Material Changes

Where significant changes are made that materially affect how your personal data is processed, we will take reasonable steps to:

Highlight the changes on our website
Provide additional notice where appropriate

Previous Versions

We may retain previous versions of this Privacy Policy for record-keeping and compliance purposes.

However, only the current version published on our website shall apply to your use of our services.

27. CONTACT & COMPLAINTS

CAMPBELL AESTHETICS STUDIO

Dr Daniel Campbell MBBS

📍 Newcastle upon Tyne

📧 [Insert Email Address]

📞 [Insert Phone Number]

Data Protection Requests

You may contact us to exercise your rights under data protection law, including requests for:

Access to your personal data
Correction of inaccurate data
Restriction or objection to processing
Withdrawal of consent

All requests must:

Be made in writing (email is acceptable)
Include sufficient information to identify you
Be accompanied by proof of identity where requested

We reserve the right to refuse or delay responding to requests until identity has been satisfactorily verified.

Response Timeframes

We will respond to legitimate requests within the timeframe required by applicable law.

Where requests are:

Complex
Numerous
Require additional verification

We reserve the right to extend response times in accordance with legal allowances.

Administrative Fees & Refusal of Requests

We reserve the right to:

Charge a reasonable administrative fee where permitted by law
Refuse requests that are manifestly unfounded, excessive, or repetitive

This includes requests that:

Would compromise legal or medical record-keeping obligations
Are intended to disrupt or misuse our services

Complaints Procedure

If you have concerns about how your data is handled, we encourage you to contact us first so we can:

Investigate your concern
Attempt to resolve the issue promptly and fairly

Escalation to the ICO

If you are not satisfied with our response, you have the right to lodge a complaint with:

Information Commissioner’s Office (ICO)

Website: https://www.ico.org.uk

Limitation of Liability in Complaints Handling

While we aim to handle all enquiries and complaints efficiently:

We do not guarantee resolution outcomes to your satisfaction
We are not liable for delays caused by factors beyond our reasonable control, including third-party systems or verification processes

Misuse of Contact Channels

We reserve the right to:

Restrict or refuse communication where behaviour is abusive, excessive, or inappropriate
Retain records of communications where necessary to protect our legal rights

Version Information

Effective Date: [Insert Date]
Last Updated: [Insert Date]

This Privacy Policy represents the current and authoritative version governing the processing of personal data by Campbell Aesthetics Studio.

NEW CLIENT? NOT SURE WHICH TREATMENT IS RIGHT FOR YOU?LOOKING FOR PERSONALISED DOCTOR-LED ADVICE?

CAMPBELL

CAMPBELL

AESTHETICS STUDIO

SUBTLE. REFINED. RESULTS.

Privacy Policy