1. ABOUT THIS PRIVACY POLICY
The Laser Studio (“we," "our," or "us") is committed to protecting and respecting your privacy.
This Privacy Policy explains how we collect, use, store, disclosure, and protect your personal data when you visit our website, complete our intake and consent forms, or receive treatments at our clinic.
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, The Laser Studio is the Data Controller responsible for your personal data.
1. THE DATA WE COLLECT ABOUT YOU
Because we provide medical and aesthetic services, we collect both standard personal data and Special Category Data (confidential health information).
We may collect, use, and store the following categories of information:
* Identity Data: Full name, title, date of birth, gender, and photograph/clinical images.
* Contact Data: Billing address, home address, email address, and telephone numbers.
* Medical & Health Data (Special Category Data): General medical history, past treatments, current medications, allergies, pregnancy status, GP practice details, and treatment notes.
* Financial & Transaction Data: Payment card details (processed securely via our encrypted payment processor), deposit history, and payment transactions.
* Marketing & Communications Data: Your preferences regarding receiving marketing updates and clinic announcements.
1. HOW WE COLLECT YOUR DATA
We collect data from and about you through:
* Direct Interactions: Filling out online or paper medical forms, consent forms, website contact forms, or communicating with us via phone, email, or WhatsApp.
* In-Clinic Consultations: Clinical evaluations, patch tests, and treatment assessments conducted by our practitioners.
* Payment Processing: When you pay a deposit or treatment balance online or in clinic.
1. LEGAL BASIS FOR PROCESSING YOUR DATA
We will only process your personal data when the law allows us to. Under UK GDPR, our lawful bases include:
* Contractual Performance: To fulfill our contract with you (e.g., booking your appointment, taking deposits, and carrying out agreed treatments).
* Legal & Medical Obligations: To comply with statutory healthcare, insurance and requirements, including maintaining accurate clinical records.
* Explicit Consent (Health Data): We process your medical history and health data based on your explicit consent granted via our Consultation and Informed Consent Forms.
* Legitimate Interests: To enforce our clinic booking and cancellation policies, process payments, and improve our services.
1. HOW WE USE YOUR PERSONAL DATA
We use your data to:
* Schedule, confirm, and manage your appointments.
* Process 50% deposits, session balances, and enforce our cancellation/no-show policies.
* Assess your medical suitability for specific treatments (e.g., lasers, injectables, peels).
* Contact you with appointment reminders and post-treatment aftercare advice.
* Maintain accurate, confidential clinical records required by medical malpractice insurers.
* Send marketing materials (only where you have opted in).
1. DATA SHARING & THIRD-PARTY DISCLOSURES
We respect your privacy and will never sell your personal data. We may share your data with trusted third parties strictly necessary for clinic operations:
* Secure Practice Management Software: Cloud-based clinical software used for scheduling and digital form storage.
* Payment Processors: Secure, PCI-DSS-compliant card processing systems (e.g., Stripe, Square, SumUp) used to store card details on file and charge deposits or no-show fees.
* Medical Insurers & Regulatory Bodies: Where required by law or in the event of a clinical insurance claim.
* Healthcare Professionals: Your GP or emergency services in the rare event of a medical emergency.
All third-party service providers are contractually required to maintain UK GDPR compliance and treat your data confidentially.
1. DATA RETENTION & SECURITY
* Security Measures: We implement strict administrative, technical, and physical security measures (including end-to-end encryption) to safeguard your paper and digital records from unauthorized access.
* Medical Record Retention: In accordance with UK medical record guidelines and insurance policies, clinical intake forms and treatment notes are retained for a minimum of 8 years following your last treatment (or up to age 25 for minors). Non-clinical marketing data is deleted upon request.
1. YOUR LEGAL RIGHTS UNDER UK GDPR
Under UK data protection laws, you have the following rights:
* Right of Access: Request a copy of the personal data we hold about you (Subject Access Request).
* Right to Rectification: Request correction of any incomplete or inaccurate data.
* Right to Erasure: Request deletion of your personal data (subject to our legal obligation to retain medical records for 8 years).
* Right to Withdraw Consent: Withdraw consent for marketing communications or photo usage at any time.
To exercise any of these rights, please contact our Data Protection Officer using the details below.
1. CONTACT US & COMPLAINTS
If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:
* Business Name: The Laser Studio
* Email Address: info@thelaserstudio.co.uk
* Phone Number: 0203 345 5365
* Address: 182 Wickham Road, Shirley, Croydon, Surrey, CR0 8BG
If you believe we have not handled your data appropriately, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection (www.ico.org.uk).
