Privacy Policy
This notice explains how ART Clinic looks after the personal information of its patients, of anyone who enquires, and of visitors to this website, and the choices the law gives you over it.
Who is responsible for your information
ART Clinic Ltd, trading as ART Clinic, is the controller of your personal data: we decide how and why it is used, and we are accountable for protecting it. We are registered with the Information Commissioner's Office under registration number ZA000000.
Questions about this notice, or about your own information, are handled by our Data Protection Lead. Section 14 gives the ways to reach us.
The information we hold
Identity and contact details: your name, date of birth, address, email address, telephone number, and how you like us to contact you.
Health and medical information: your medical history, conditions, allergies and medicines, previous treatments, your practitioner's notes from each assessment and treatment, your consent forms and the aftercare you were given. Health information is special category data, which the law protects more strictly.
Clinical photographs: images taken before, during and after treatment, so your practitioner can plan your care and review your progress.
Booking and payment records: your appointments and attendance, the treatments and packages you have bought, and the deposits and payments you have made. Card details are handled by our payment provider and not stored by the clinic.
Messages and enquiries: what you tell us through our enquiry form, by email, by telephone or on WhatsApp.
Website usage: the pages you visit, the device and browser you use, your approximate location and how you reached the site, gathered by analytics cookies only if you allow them.
Where your information comes from
Most of it comes from you: when you book, complete a form, send us a message or speak with your practitioner. Our practitioners add their clinical notes and photographs as part of your care. With your agreement, we may also receive information from your GP or another healthcare professional involved in your treatment. Our booking system records your appointments and payments, and Google Analytics reports on how the website is used, once you have consented to it.
How we use your information, and why the law allows it
What we use it forOur lawful basis
Arranging and providing your consultations and treatment, managing appointments and taking paymentPerformance of our contract with you (Article 6(1)(b))
Keeping clinical records, meeting tax and accounting duties, and responding to regulatorsCompliance with a legal obligation (Article 6(1)(c))
Running and improving the clinic, answering enquiries, handling complaints and legal claims, and keeping our systems secureOur legitimate interests, balanced against your rights (Article 6(1)(f))
Sending you news and offers, and measuring how the website is usedYour consent, which you may withdraw at any time (Article 6(1)(a))
Because information about your health is special category data, we also rely on an additional condition when we use it. To provide your care, that condition is Article 9(2)(h), the provision of health care, with your records handled by or under the responsibility of health professionals who owe you a duty of confidentiality (Data Protection Act 2018, Schedule 1, paragraph 2). Where we need health information to establish or defend a legal claim, we rely on Article 9(2)(f).
Your clinical photographs belong to your medical record. We will show a photograph in which you could be recognised anywhere beyond that record, such as on this website, on social media or in training, only with your separate, explicit written consent, and you can withdraw that consent at any time for future use.
Who we share your information with
We never sell your personal information. We share it only where it is needed for your care, for running the clinic or by law:
Pabau, our practice-management and online booking system, which holds your patient record, appointments and enquiry-form submissions on our behalf.
Our payment provider, Stripe, to process card payments.
Our IT, email and website providers, including our email and website hosting services, who keep our systems running.
WhatsApp (Meta), if you choose to message us there; Meta handles those messages under its own privacy policy.
Your GP or another clinician, with your agreement, or without it only where we believe it is necessary to protect your safety or someone else's.
Regulators, insurers, professional advisers and the police, where the law requires it or where it is needed to deal with a claim.
Google, whose Analytics service tells us how the website is used, when you have accepted analytics cookies.
Every provider that handles personal data on our behalf does so under a written contract, on our instructions only, and must keep it secure.
Information processed outside the UK
Some of our providers, Google among them, may process personal data outside the United Kingdom. Where that happens, we make sure it is protected to the standard UK law requires, either because the country has been recognised as giving adequate protection or because the transfer is covered by approved safeguards such as the International Data Transfer Agreement.
How long we keep your information
Clinical records and photographs: eight years after your last appointment.
Payment and accounting records: six years from the end of the financial year they relate to.
Enquiries that do not lead to an appointment: 12 months from your last contact.
Marketing preferences: until you unsubscribe, after which we keep only a note that you have asked not to be contacted.
Website analytics: 14 months.
Once a retention period ends, the information is securely deleted or anonymised.
How we protect your information
We use technical and organisational measures suited to the sensitivity of health information, so that only the people who need your record for your care or for running the clinic can see it. If a breach ever put your information at serious risk, we would tell you and the Information Commissioner's Office as the law requires.
Your rights
UK data protection law gives you the right to:
access the personal information we hold about you and receive a copy;
rectification, so that anything inaccurate or incomplete is put right;
erasure, in some circumstances, although clinical records we must keep by law cannot be deleted early;
restriction, limiting how we use your information while a concern is resolved;
portability, receiving information you gave us in a format that can be passed to another provider;
object to our using your information on the basis of legitimate interests, and to direct marketing at any time;
withdraw consent wherever we rely on it, without affecting anything done before.
To make a request, email or write to us (section 14). There is no charge, and we will reply within one month; for a complex request, or several at once, we may take up to two further months and will tell you why. We may need to confirm your identity before releasing any information.
News and offers from the clinic
We send news and offers only to people who have asked to receive them, and every message includes a simple way to unsubscribe. You can also tell us at any time that you no longer wish to hear from us.
Children
Our services are for adults aged 18 and over, and we do not knowingly collect personal information from anyone younger.
Cookies
This website uses a small number of cookies, and anything beyond the essential ones is set only with your permission. Our Cookie Policy lists each one and explains how to change your choice.
Read our Cookie PolicyIf you are unhappy with how we handle your information
Please raise any concern with us first, and we will do our best to put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.
Changes to this notice, and how to contact us
We review this notice regularly, and the current version is always the one on this page. If a change affects how we use information you have already given us, we will let you know before it takes effect.
For anything about your personal information, email info@art-clinic.co.uk, call +44 20 3355 2030, or write to the Data Protection Lead, ART Clinic, 14A Lowndes Street, SW1X 9EX.
Last updated: 13 October 2026