Privacy Policy
Last update at 27th of July 2026
About this Privacy Policy
Skin & Aesthetics by Haleema Saadia is committed to handling personal information lawfully, fairly, transparently and securely. We understand that clients entrust us with confidential identity, contact, financial and health information.
This policy explains:
- what information we collect and where it comes from;
- why we use it and the legal grounds we rely upon;
- how information is used for clinical care, bookings, payments, communications and marketing;
- who may receive it and when it may be processed outside the United Kingdom;
- how long it is normally retained;
- the rights available to you and how to exercise them; and
- how to raise a data protection complaint.
This policy is a privacy notice, not a request for consent merely because you use our website. Where consent is legally required, we will ask for it separately and clearly.
Who is responsible for your personal information
Skin & Aesthetics by Haleema Saadia is a trading name. The legal organisation responsible for your information depends on how and where you interact with us.
Activity/location | Data controller |
|---|---|
Website, central enquiries and central marketing | My Skin Remedy LTD |
Edgbaston clinic records and services | My Skin Remedy LTD ICO registration number: ZB931398
Edgbaston laser services: operated by HS KD Laser LTD ICO registration number: ZC027099 |
Sutton Coldfield clinic records and services | My Laser Remedy LTD |
The relevant controller decides why and how your personal information is used. Where information is transferred from one clinic company to another, we will do so only where there is a lawful reason, such as managing a requested transfer of care, central administration, resolving a complaint, or complying with legal or insurance obligations.
You may send any privacy request to our central Privacy Lead using the contact details in section 21. We will ensure it reaches the correct controller.
Who this policy covers and where information comes from
This policy principally covers:
- clients and former clients;
- prospective clients and people making enquiries;
- website visitors and people interacting with our online advertising or social-media pages;
- people purchasing products, packages, memberships or gift vouchers;
- parents, guardians, emergency contacts and authorised representatives; and
- healthcare professionals, referrers and others communicating with us about a client.
Separate privacy information may apply to employees, workers, contractors and job applicants.
We usually obtain information directly from you. We may also receive it from:
- a parent, guardian, attorney or other person authorised to act for you;
- a healthcare professional, prescriber, pharmacy, hospital or referrer;
- our booking, payment, finance, website, communications or customer-management providers;
- social-media or advertising lead forms that you choose to submit;
- cookies, pixels, tags and similar technologies, subject to your cookie choices;
- publicly available sources where use is lawful and appropriate; and
- our practitioners and staff when they create consultation, treatment, follow-up, incident or communication records.
Where we obtain your information from another source, we will provide appropriate privacy information within the period required by law, normally no later than one month, at our first communication with you, or before the information is first disclosed, unless an exemption applies
Personal information we collect
Category | Examples |
|---|---|
Identity and contact | Name, preferred name, title, date of birth, address, email, telephone number, emergency contact, signature and, where necessary, identity evidence. |
Enquiry and booking | Treatments of interest, preferred location and practitioner, appointment history, booking source, consultation requests, waiting-list details, cancellations and communications. |
Health and clinical | Medical history, diagnoses, medications, allergies, pregnancy or breastfeeding status, contraindications, GP or specialist information, consultation findings, clinical notes, treatment settings, outcomes, complications, aftercare and follow-up. |
Images and recordings | Clinical before-and-after photographs, progress images, voluntarily submitted photographs, treatment-planning images and, where separately agreed, marketing photographs, video, testimonials or reviews. |
Payment and commercial | Payment status, booking fees, invoices, receipts, refunds, package or membership information, finance-provider references and transaction records. We do not normally store complete card details. |
Website and device | IP address, device and browser information, approximate location, pages visited, referrals, form activity and cookie or analytics identifiers, subject to applicable consent requirements. |
Communications | Emails, SMS, WhatsApp messages, social-media messages, telephone notes, preference records, complaints, feedback and evidence of consent or objections. |
Security and incident | CCTV images where used, fraud-prevention information, access logs, adverse-event records, incident reports, insurer correspondence and legal-claim information. |
We ask only for information that is reasonably necessary. Certain information is required to enter into or perform a contract, process payment, meet legal or professional obligations, or assess whether treatment can be provided safely. If required information is not provided, we may be unable to book, assess or treat you. Marketing information is optional.
This policy allows us to manage our schedule fairly and continue offering the best possible service to all clients.
Why we use personal information and our lawful bases
We need a lawful basis under Article 6 UK GDPR for all personal information. When we use health information or other special category data, we also need a separate condition under Article 9 UK GDPR.
Purpose | Article 6 basis | Article 9 condition where relevant |
|---|---|---|
Responding to enquiries and taking steps before a booking | Contract or steps requested before entering a contract; legitimate interests in responding efficiently. | Health data is normally avoided at enquiry stage. If voluntarily supplied, explicit consent or another applicable Article 9 condition may apply. |
Consultations, treatment, prescribing, aftercare and clinical records | Contract; legitimate interests in safe service delivery and accurate records; legal obligation where applicable. | Health or social care under Article 9(2)(h) where processing is carried out by or under the responsibility of a health professional subject to confidentiality; otherwise explicit consent under Article 9(2)(a) or another applicable condition. |
Clinical photographs and treatment monitoring | Contract and legitimate interests in assessment, safety, continuity and evidence of care. | Article 9(2)(h), explicit consent, or legal claims as appropriate. Marketing use requires separate permission. |
Bookings, memberships, packages, payments and debt management | Contract; legal obligation for accounting and tax; legitimate interests in administration and fraud prevention. | Normally not applicable, unless records include relevant health information. |
Appointment reminders, aftercare and safety communications | Contract; legitimate interests in attendance, continuity of care and patient safety. | Article 9(2)(h) or another applicable condition where health information is included. |
Complaints, adverse events, insurance and legal claims | Legal obligation and legitimate interests in investigating concerns, defending rights and maintaining safety. | Article 9(2)(f) for legal claims; Article 9(2)(h) where relevant to ongoing care. |
Security, fraud prevention and CCTV where used | Legitimate interests in protecting people, premises, systems and property; legal obligation where applicable. | Usually not applicable; legal claims or substantial public interest may apply in limited cases. |
Direct marketing | Consent or legitimate interests, together with PECR consent or the products-and-services soft opt-in where all requirements are met. | We do not use health information for direct marketing unless you have given valid explicit consent and the use is fair and lawful. |
Non-essential analytics and advertising technologies | Consent where required under PECR; legitimate interests may support the related processing after a valid choice. | We do not intentionally use clinical health information for advertising audiences. |
Emergencies and safeguarding | Vital interests, legal obligation or legitimate interests, depending on the circumstances. | Vital interests, health care or substantial public interest where the relevant legal conditions are met. |
Consent to receive a treatment is different from consent under data protection law. We will not rely on data-protection consent where another lawful basis is more appropriate. Where we do rely on consent, it can be withdrawn at any time, although withdrawal does not invalidate processing already carried out lawfully.
Where we rely on legitimate interests, our interests may include delivering and improving our services, maintaining accurate records, preventing fraud, protecting clients and staff, responding to complaints and running an efficient clinic. We balance these interests against your rights and reasonable expectations.
Health information and other special category data
Health information receives additional protection. We may need it to assess suitability, identify contraindications, prescribe or administer medicines, plan treatment, provide aftercare, manage complications and maintain a complete clinical record.
Depending on the circumstances, this may include:
- medical conditions, symptoms, previous procedures and treatment history;
- medications, supplements, allergies and sensitivities;
- pregnancy or breastfeeding status;
- skin type, skin conditions and clinically relevant lifestyle information;
- prescribing assessments, weight-management information and monitoring;
- clinical photographs, treatment settings, outcomes and adverse reactions; and
- communications with healthcare professionals, insurers or legal advisers where necessary.
Where the health-care condition is relied upon, processing must be carried out by, or under the responsibility of, an appropriately qualified health professional or another person owing a legal duty of confidentiality. Where that condition does not apply, we will identify another valid Article 9 condition, which may include explicit consent or processing necessary for legal claims.
We do not use clinical records or health information to target you with advertising merely because you have a particular condition or have received a particular treatment.
Children and young people
Our services are primarily intended for adults. Some treatments are not legally or clinically available to anyone under 18. Where a lawful service may be offered to a person under 18, we apply additional safeguards and assess consent, capacity, parental responsibility and the young person’s best interests.
We may collect information from a parent or guardian, but a competent young person may have their own data protection rights. We will not automatically disclose a young person’s confidential information to a parent or guardian where doing so would be inappropriate or unlawful.
We do not knowingly collect children’s information through the website for marketing. A parent or guardian should contact us directly before submitting information about a child.
Clinical photography, video and testimonials
Clinical photography may form part of assessment, treatment planning, progress monitoring and the clinical record. Clinical images are confidential and are not automatically available for marketing.
Where we wish to use identifiable images, video, audio, testimonials or reviews for marketing, education, social media or advertising:
- we will provide separate information about the proposed use;
- we will request specific consent where required;
- declining marketing use will not affect access to treatment;
- you may withdraw consent for future use; and
- withdrawal may not always enable us to retrieve material already lawfully printed, shared by third parties or published, although we will take reasonable steps to stop future use under our control.
An image can reveal health information or the fact that a treatment was received. We therefore apply additional safeguards where special category data is involved.
Website, enquiries, bookings and payments
When you use an enquiry or booking form, we use the information supplied to respond, arrange consultations, check availability and administer your request. Submitting an enquiry does not guarantee treatment.
Our practice-management system may hold contact details, forms, medical histories, consent records, clinical notes, photographs, appointment history, payment status and communications.
Card and bank-payment information is generally processed by authorised payment providers. We normally receive confirmation, transaction references and limited payment information rather than complete card details.
Where third-party credit or instalment finance is offered, the finance provider may act as an independent data controller and will provide its own privacy information. It may perform identity, affordability, fraud and credit checks under its own legal responsibilities.
Electronic communications and direct marketing
Service communications
We may contact you by email, SMS, telephone, WhatsApp, post or another agreed method for appointment confirmations, reminders, changes, forms, payment administration, aftercare, safety information, recalls and responses to enquiries. These are service communications rather than marketing where their content is necessary to manage your care or contract.
Electronic messages are not completely risk-free. Please use the secure forms or channels we direct you to for highly sensitive information and check that messages genuinely come from us.
Marketing communications
We may send information about treatments, products, packages, memberships, events, offers or clinic news only where permitted by data protection law and PECR.
- For email, SMS and similar electronic marketing to individuals, we will normally rely on specific consent or the products-and-services soft opt-in where every legal requirement is satisfied.
- The soft opt-in can only be used for our own similar products or services where we obtained the contact details directly during a sale or genuine negotiation, provided a clear opt-out when collecting them, and include an easy opt-out in every message.
- Marketing choices will be specific to the relevant communication method where required.
- We will not treat acceptance of general terms, treatment consent or receipt of service messages as marketing consent.
- We will not use bought-in or publicly available personal contact details for electronic marketing unless valid permission and all other legal requirements are established.
- Live marketing calls will be made only where lawful and will be screened against applicable preference services where required. Automated marketing calls require specific consent.
- Every marketing message will identify the sender and provide a simple method to opt out.
You can object to direct marketing or withdraw marketing consent at any time. We may retain minimal information on a suppression list so that we can honour your choice and avoid contacting you again.
Cookies, analytics and online advertising
Our website may use strictly necessary cookies and similar technologies to provide core functionality and security. Optional analytics, functional or advertising technologies will be used only in accordance with applicable law and your cookie choices.
Where enabled, providers may include our website host, Google Analytics, Google Ads, Meta technologies, maps, embedded media and booking or payment widgets. Exact technologies, purposes and durations are described in our Cookie Policy and live Cookie Settings tool.
We may receive aggregated campaign and website-performance reports. We do not intentionally provide clinical records or detailed health information to advertising platforms for audience targeting.
You can accept, reject or adjust non-essential cookie categories through the Cookie Settings control. Withdrawing cookie consent will not affect processing that was lawful before withdrawal.
Who we share information with
We do not sell or rent personal information. We share it only where necessary, proportionate and lawful.
Recipient/category | Why information may be shared |
|---|---|
Practice management and communications | Pabau and other systems used for booking, forms, clinical records, photographs, reminders and client administration. |
Payments and finance | Stripe, GoCardless, card acquirers, banks and any finance provider you choose to use. Some act as independent controllers. |
Email, cloud and IT | Google Workspace or other approved email, document, hosting, backup, cyber-security and technical-support providers. |
Website, analytics and advertising | Website hosts, consent-management providers, Google and Meta services where enabled and permitted by your cookie choices. |
Healthcare and pharmacies | Prescribers, pharmacies, GPs, hospitals, specialists or other regulated professionals where necessary and lawful, with consent where required. |
Insurers and professional advisers | Professional indemnity insurers, brokers, solicitors, accountants, auditors and consultants where needed for advice, claims, complaints or compliance. |
Authorities and regulators | The ICO, HMRC, police, courts, safeguarding bodies, healthcare regulators or other authorities where disclosure is required or lawfully justified. |
Business transfers | A prospective buyer, seller, investor or successor where the business or assets are reorganised, sold or transferred, subject to appropriate confidentiality and data-protection safeguards. |
Service providers acting as processors must use information only for authorised purposes, maintain appropriate security and comply with their contractual and legal obligations. Some organisations, such as finance providers, healthcare professionals, regulators and professional advisers, may act as independent controllers and issue their own privacy notices.
We may disclose information without consent where required by law or where necessary to protect vital interests, address a serious safety concern, investigate wrongdoing, safeguard a person, or establish, exercise or defend legal claims.
International transfers
Some suppliers may store or access information outside the United Kingdom. When a restricted international transfer takes place, we use a lawful transfer mechanism and take steps appropriate to the risk.
- UK adequacy regulations recognising an adequate level of protection;
- the UK International Data Transfer Agreement;
- the UK Addendum to approved standard contractual clauses;
- another transfer mechanism permitted by UK data protection law; and
- additional technical, contractual or organisational safeguards where appropriate.
You may contact our Privacy Lead for further information about the safeguards relevant to your information, subject to confidentiality and security limitations.
We may disclose information without consent where required by law or where necessary to protect vital interests, address a serious safety concern, investigate wrongdoing, safeguard a person, or establish, exercise or defend legal claims.
Information security and confidentiality
We use technical and organisational measures designed to protect information against accidental or unlawful loss, alteration, unauthorised access, disclosure or destruction.
- role-based access and restricted staff permissions;
- password protection and multi-factor authentication where available;
- secure practice-management and cloud systems;
- encryption in transit or at rest where appropriate and supported;
- device, software, backup and malware controls;
- staff confidentiality obligations, training and access reviews;
- processor due diligence and data-processing contracts; and
- incident and personal-data-breach procedures.
No internet, email, messaging or storage system is completely secure. We therefore apply proportionate safeguards and encourage clients not to send unnecessary sensitive information through insecure channels.
Where a personal-data breach creates a risk to people’s rights and freedoms, we will assess it and notify the ICO and affected individuals where the law requires.
How long we keep information
We keep information only for as long as reasonably necessary for the purpose collected and to meet clinical, legal, tax, insurance and professional obligations. A longer period may apply where there is an active complaint, adverse event, safeguarding concern, investigation, legal claim or insurer requirement.
Information type | Typical retention |
|---|---|
Website and social-media enquiries that do not become clients | Normally 12 months after the last meaningful contact, unless a longer period is needed for a complaint, safety issue, consent record or legal claim. |
Adult consultation, treatment and clinical photographs | Normally at least 8 years after the last clinical entry or treatment, then reviewed and securely destroyed or anonymised unless longer retention is justified. |
Records relating to a child or young person | Normally until the 25th birthday, or 26th birthday if treatment ended when the person was 17, subject to any longer legal, clinical or claims requirement. |
Prescription, medicine administration and related clinical records | Retained as part of the clinical record for the applicable clinical period, or longer where a specific medicines, device, insurer or professional rule applies. |
Booking, package, membership and contract records | Normally 6 years after the contract, package or membership ends, unless the information forms part of the longer-retained clinical record. |
Accounting, invoice, refund and transaction records | Normally 6 years from the end of the relevant accounting period, or longer where HMRC or another legal requirement applies. |
Complaints, incidents, adverse events, insurance and legal claims | Normally 6 years after closure, or longer where needed for an ongoing matter, limitation period, safeguarding issue or insurer requirement. |
Marketing consent and preference evidence | For as long as marketing continues and normally for up to 6 years after the last reliance on the record. Suppression details may be kept for as long as needed to honour an objection. |
CCTV where installed | Normally up to 30 days, unless footage is required for an incident, complaint, investigation, insurance matter or legal claim. |
Data-rights requests and privacy complaints | Normally 3 years after closure, or longer where necessary to evidence compliance or manage an appeal or claim. |
Cookie and analytics information | As stated in the Cookie Policy and live Cookie Settings tool. |
At the end of the retention period, information is reviewed and securely deleted, destroyed or irreversibly anonymised. Backups may take additional time to cycle out, during which they remain protected and are not used for ordinary business purposes.
Your data protection rights
Depending on the circumstances, you may have the right to:
Right | What it means |
|---|---|
Be informed | Receive clear information about how your personal information is used. |
Access | Obtain confirmation of processing and a copy of your personal information. |
Rectification | Have inaccurate information corrected and incomplete information completed. |
Erasure | Request deletion where the legal conditions apply. This does not override clinical, legal, insurance or professional retention duties. |
Restriction | Ask us to limit how information is used in certain circumstances. |
Data portability | Receive certain information you provided in a structured, commonly used, machine-readable format, or have it transmitted where technically feasible. |
Object | Object to processing based on legitimate interests and object at any time to direct marketing. |
Withdraw consent | Withdraw consent at any time where consent is the basis relied upon, without affecting earlier lawful processing. |
Automated decisions | Receive safeguards in relation to solely automated decisions producing legal or similarly significant effects, where applicable. |
Complain | Raise a data protection complaint with us and lodge a complaint with the ICO. |
These rights are not absolute. We may need to verify identity, protect another person’s information, preserve legal privilege or apply a lawful exemption. We will explain the outcome of a request and the available complaint options.
Subject access requests
A subject access request can be made verbally or in writing, including by email or social media. You do not need to use a special form or mention UK GDPR.
- We may request reasonable evidence of identity or authority where necessary to protect confidentiality.
- We will carry out a reasonable and proportionate search for information within the scope of the request.
- Where we hold a large amount of information and the request is unclear, we may ask you to clarify the information or processing activities sought. The response period may be paused where the law permits.
- We normally respond without undue delay and within one month. We may extend by up to two further months for a complex request or multiple requests and will explain this within the initial period.
- There is normally no fee. A reasonable fee may be charged, or a request refused, where permitted by law, including where it is manifestly unfounded or excessive.
- Information will be supplied securely and third-party information may be redacted where necessary.
Data protection complaints
You may complain to us if you believe we have used your information unfairly, failed to respect a right, disclosed information improperly, provided inadequate privacy information or otherwise failed to comply with data protection law.
You can complain using the contact details in section 21. We will:
- provide a clear and accessible route for making the complaint;
- acknowledge it within 30 days unless we are able to provide the full outcome within that period;
- take appropriate steps to investigate, including making relevant enquiries;
- keep you informed where the investigation takes longer; and
- communicate the outcome without unjustifiable or excessive delay.
You may also complain to the Information Commissioner’s Office. We encourage you to contact us first so we can try to resolve the issue, but this does not affect your right to approach the ICO.
Information Commissioner’s Office
- Website: ico.org.uk
- Telephone: 0303 123 1113
- Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Automated decision-making and profiling
We do not make clinical treatment decisions based solely on automated processing. Treatment recommendations and prescribing decisions are made by appropriately qualified professionals following an individual assessment.
We may use limited segmentation, analytics or advertising tools to understand website performance or present general marketing, subject to applicable cookie and marketing rules. These activities are not intended to produce legal or similarly significant effects.
A finance provider may use automated credit or fraud checks under its own policies and legal responsibilities. You should read that provider’s privacy notice before applying.
Changes to this policy
We may update this policy to reflect changes in law, regulatory guidance, systems, suppliers, services or business structure. The current version will be published on our website with its effective date.
Where a change materially affects how existing personal information is used, we will take reasonable steps to bring it to the attention of affected individuals before the new use begins, where required.
Contact details
For privacy enquiries, rights requests or data protection complaints, contact:
Contact | Details |
|---|---|
Privacy Lead | Haleema Saadia |
Website | www.skinaestheticshaleema.co.uk |
Edgbaston clinic | 6 Chad Square, Edgbaston, Birmingham, B15 3TQ |
Sutton Coldfield clinic | 296 Clarence Road, Sutton Coldfield, West Midlands, B74 4LT |
Please state which clinic you attended or intended to attend so that your request can be directed to the correct legal controller. Do not send unnecessary medical information in the subject line of an email.
Warm Regards,
Haleema Saadia MPharm IPresc MSc ACP