Privacy notice
What a clinic like this would collect, why, and how long it would keep it. Frith Medispa is a demonstration site and holds no real patient data, so treat this as a worked example rather than a live notice.
What would be collected
Contact details you provide when enquiring or booking. Medical history taken at consultation, including medication, allergies and conditions being treated. Clinical photographs and skin imaging where you have consented to them. Treatment records, consent forms and aftercare notes. Payment records, held by the payment provider rather than by the clinic.
Why
Medical records are held to provide safe care and because there is a professional and legal obligation to keep them. Contact details are held to run appointments. Clinical photographs are held with separate consent, and consent for treatment records is not the same as consent to use an image in marketing. Those are two decisions and they are asked separately.
Lawful basis
For clinical records, the basis is the provision of health care under Article 9(2)(h) of the UK GDPR, alongside contract for the appointment itself. For marketing email, the basis is consent, which you can withdraw at any time using the link in any message.
How long
Adult clinical records for eight years after the last treatment, which follows standard practice for private healthcare in England. Records for anyone treated under 18 until their 25th birthday, though this clinic does not treat under 18s. Enquiry records that do not become patients for two years. Marketing consent until withdrawn.
Who it is shared with
Nobody, except where care requires it and you have agreed, or where the law compels it. Systems used to run the clinic, such as the practice management software and the email provider, act as processors under contract. Data is not sold and is not shared with advertisers.
Your rights
You can ask for a copy of what is held about you, ask for inaccuracies to be corrected, object to processing, and complain to the Information Commissioner's Office. Requests for a copy are answered within one month. Note that a right to erasure does not generally override the obligation to retain clinical records for the periods above, and a clinic that deletes them on request is doing something wrong.
The forms on this website
Every form here, including the enquiry form, the booking form, the virtual consultation form and the newsletter signup, is client side only. Nothing you type is transmitted anywhere and no email address is stored, on this site or on any server behind it. The confirmation you see after submitting is drawn by the page itself. A line under each form says so, and this paragraph is the same statement in the place a privacy notice is expected to make it.
Marketing email
A real clinic running the newsletter described in the footer would hold your address with an email provider acting as a processor, send between four and six messages a year, put an unsubscribe link in every one of them, and delete the record when you used it. Consent would be recorded with a date and a source, because being able to show where consent came from is the part most clinics skip.
Contact
On a real clinic site this section would name a person and give a direct address for data protection questions. Since this one is a demonstration, use the contact page, and remember that nothing there sends.