PRIVACY POLICY

Depending upon your relationship with us and the services you receive, we may collect the following information.s ### Identity information This may include: • your full name; • title; • date of birth; • age; • gender or sex where clinically relevant; • photographic identification where necessary; • client or patient reference numbers; and • signature. ### Contact information This may include: • home or correspondence address; • email address; • telephone and mobile numbers; • emergency contact information; and • preferred method of communication. ### Medical and health information Because we provide medical, aesthetic, laser, skin, hair and related treatments, we may need to collect sensitive medical information. This may include: • medical history; • existing and previous medical conditions; • allergies; • medications; • pregnancy status where relevant; • previous surgery or aesthetic procedures; • previous treatment history; • skin conditions; • skin type; • hair type; • information concerning treatment contraindications; • consultation notes; • clinical assessments; • diagnoses where applicable; • treatment suitability assessments; • prescriptions where applicable; • laboratory or test results where applicable; • clinical observations; • adverse reactions; • complications; • aftercare information; • treatment outcomes; • referral information; • consent documentation; and • other information necessary for your safe treatment. Health information is classified as special category personal data and receives additional protection under data protection legislation.

We may take photographs, videos, skin scans, imaging or other visual records for legitimate clinical purposes. These purposes may include: • assessing your condition; • planning treatment; • recording your baseline appearance; • monitoring treatment progress; • comparing treatment outcomes; • maintaining appropriate clinical records; • investigating complications; • handling complaints; • responding to legal or insurance matters; and • supporting continuity of care. Clinical photographs form part of your clinical record where they are required for treatment or clinical documentation. ### Marketing photographs and videos We will not use identifiable clinical photographs or videos for advertising, social media, promotional materials, educational marketing or similar public facing purposes merely because you agreed to clinical photography. Where consent is required for marketing use, we will obtain separate permission. Refusing marketing consent will not affect your eligibility to receive treatment. Where processing is based upon your consent, you may withdraw that consent for future use at any time. Withdrawal of consent does not make processing carried out lawfully before withdrawal unlawful. Where content has already been lawfully published, printed, distributed or shared with third party platforms before consent is withdrawn, it may not always be technically possible to retrieve every existing copy. However, where required, we will stop new uses under our control and take reasonable steps in relation to material we continue to control.

We may process information relating to: • appointments; • consultations; • patch tests; • treatment plans; • treatments booked; • treatments completed; • treatment courses; • packages; • membership information; • practitioners providing treatment; • appointment cancellations; • late attendance; • non attendance; • aftercare; • follow up appointments; and • communications concerning your treatment.

We may process: • amounts paid; • deposits; • invoices; • receipts; • payment dates; • outstanding balances; • refund information; • finance arrangements; • payment plan information; • transaction references; • payment provider information; • chargeback information; and • correspondence relating to payment disputes. Card payments may be processed by external payment service providers. We do not ordinarily store complete payment card numbers or card security codes ourselves. Where you use a finance or buy now pay later provider such as Klarna, that provider may act as a separate data controller for information it processes in connection with providing finance to you. You should also read the privacy information provided by the relevant finance provider.

We may keep records of communications between you and the Clinic including communications through: • email; • telephone; • SMS; • WhatsApp; • website enquiry forms; • online chat; • social media messaging; • booking platforms; and • in person communications recorded in your client record. Telephone calls may be recorded where we have a lawful basis to do so and appropriate information has been provided. Communications concerning your treatment may form part of your clinical record.

When you use our website or online services, we may collect information including: • IP address; • device type; • browser information; • operating system; • pages visited; • date and time of visits; • website interactions; • referring websites; • approximate geographic information derived from technical information; and • cookie or similar technology identifiers. Some of this information is collected using cookies and similar technologies. Please refer to our Cookie Policy and cookie preference system for more information.

We may receive personal information about you from third parties where lawful and appropriate. These may include: • doctors and other healthcare professionals; • referring practitioners; • hospitals or healthcare providers; • laboratories; • pharmacies; • booking platforms; • payment processors; • finance providers; • insurers; • your authorised representative; • parents or guardians where appropriate; • emergency contacts; • regulators; • professional advisers; • social media platforms where you contact us through them; and • other organisations involved in your care or transaction. Where information has not been obtained directly from you, we will provide appropriate privacy information where required by law.

We may process your personal information for the following purposes: • to respond to enquiries; • to arrange consultations; • to create and maintain your client or patient record; • to assess treatment suitability; • to identify contraindications; • to provide safe and appropriate treatment; • to obtain and document informed consent; • to provide aftercare; • to manage appointments; • to communicate important information about your treatment; • to maintain clinical records; • to manage prescriptions where applicable; • to make or receive appropriate medical referrals; • to protect your health and safety; • to process payments; • to manage treatment packages and account balances; • to administer finance arrangements; • to prevent and investigate fraud; • to manage complaints; • to manage chargebacks and payment disputes; • to establish, exercise or defend legal claims; • to comply with regulatory requirements; • to comply with professional obligations; • to maintain insurance records; • to respond to safeguarding concerns; • to cooperate with lawful investigations; • to protect staff, clients and clinic premises; • to maintain and improve our services; • to train and supervise staff where appropriate; • to conduct internal audits and quality assurance; • to communicate treatment information and service updates; • to send marketing where permitted by law; • to analyse website performance; and • to comply with our legal obligations.

We will only process personal information where we have a lawful basis to do so. Depending upon the particular activity, we may rely upon one or more of the following bases. ### Contract We may process information where it is necessary to take steps at your request before entering into a contract or to perform our contract with you. This may include: • booking appointments; • providing services; • managing treatment packages; • processing payments; • communicating about appointments; and • providing aftercare connected with the service purchased. ### Legal obligation We may process information where necessary to comply with a legal or regulatory obligation. This may include requirements relating to: • clinical governance; • patient safety; • tax and accounting; • regulatory compliance; • medicines; • safeguarding; • insurance; • legal proceedings; and • responses to lawful authorities. ### Legitimate interests We may process information where necessary for our legitimate interests or those of another person, provided those interests are not overridden by your rights and freedoms. Our legitimate interests may include: • operating and improving our business; • maintaining appropriate records; • preventing fraud; • protecting our premises and systems; • managing complaints; • recovering legitimate debts; • establishing or defending legal claims; • quality assurance; • staff training and supervision; • business administration; • website security; and • understanding how clients use our services. Where required, we assess whether our legitimate interests are proportionate and whether your interests, rights or freedoms override them. ### Consent We may rely upon your consent where appropriate. Examples may include: • certain marketing communications; • certain uses of photographs or videos; • optional promotional content; and • other processing where we specifically ask you to consent. Where processing is based upon consent, you can withdraw consent at any time. ### Vital interests In exceptional circumstances, we may process information where necessary to protect your life or the life of another person. For example, this may apply during a medical emergency where you are unable to provide consent.

Information concerning your physical or mental health is special category personal data. Processing special category information requires an additional lawful condition. Depending upon the circumstances, we may rely upon conditions including: • processing necessary for the provision of health care, medical diagnosis, treatment or management of healthcare services where applicable and carried out by or under the responsibility of an appropriate professional; • your explicit consent where that is the appropriate legal basis; • processing necessary for the establishment, exercise or defence of legal claims; • processing necessary to protect vital interests where legally applicable; and • other conditions permitted under UK data protection legislation where appropriate. We will not use your medical information for unrelated purposes merely because we hold it as part of your clinical record.

Clinical and medical information is treated as confidential. Access is restricted to individuals who reasonably require access to perform their role or fulfil a legitimate clinical, legal, regulatory or administrative function. Staff, clinicians, contractors and other persons with authorised access to confidential information are expected to comply with applicable confidentiality and data protection obligations.

Where appropriate, we may share relevant information with: • doctors; • nurses; • prescribers; • pharmacists; • laboratories; • other healthcare practitioners; • hospitals; • your GP; or • other healthcare services. We will only do so where there is an appropriate lawful basis. This may include situations where sharing is necessary for your treatment, medication, referral, continuity of care, safeguarding or medical safety.

Where there is a genuine medical emergency, we may share relevant information with emergency services, hospitals or healthcare professionals where necessary to protect your vital interests or those of another person.

Where we reasonably believe that a child or vulnerable adult may be at risk of serious harm, we may share relevant information with appropriate safeguarding organisations, healthcare professionals, local authorities or law enforcement agencies where permitted or required by law. Where legally appropriate, information may be shared without consent where the need to protect an individual outweighs confidentiality considerations.

We may share information where necessary with trusted organisations and individuals including: • medical practitioners; • nurses; • therapists; • prescribers; • clinical staff; • laboratories; • pharmacies; • referral partners; • IT service providers; • patient and clinic management software providers; • booking systems; • payment processors; • finance providers; • accountants; • auditors; • insurers; • legal advisers; • professional advisers; • marketing service providers; • website hosting providers; • email and communication providers; • cloud storage providers; • regulators; • professional bodies; • law enforcement agencies; • courts and tribunals; • government departments; and • other organisations where disclosure is required or permitted by law. Depending upon the service they provide, these organisations may act as our data processor, joint controller or independent data controller. Where another organisation processes information on our behalf as a data processor, we require appropriate contractual and security protections.

Where required or permitted by law, information may be shared with relevant regulatory or professional organisations. Depending upon the circumstances, these may include organisations such as: • the Care Quality Commission; • the Information Commissioner's Office; • professional medical, nursing or healthcare regulators; • local authorities; • law enforcement agencies; and • other bodies with lawful regulatory powers. We will only disclose information that is reasonably necessary for the relevant purpose.

Where you raise a complaint or legal issue, we may use and disclose relevant information to investigate and respond to it. This may include: • clinical records; • consent forms; • photographs; • correspondence; • booking records; • payment information; • staff statements; • telephone records; • treatment records; and • other relevant evidence. Information may be shared with our insurers, solicitors, professional advisers, regulators, courts, dispute resolution providers or other relevant parties where lawful and necessary. We may retain relevant information for longer where a complaint, claim, investigation or legal proceeding is ongoing or reasonably anticipated.

If you initiate a chargeback, card dispute or finance dispute, we may provide relevant information to the card issuer, bank, payment processor or finance provider to investigate or defend the transaction. Information provided may include: • booking information; • payment records; • appointment records; • signed agreements; • terms accepted; • communications; • attendance records; • treatment records; • consent forms; • relevant photographs; and • other information reasonably necessary to demonstrate the circumstances of the transaction. Medical information will only be disclosed where lawful, relevant and proportionate to the dispute.

CCTV may operate at some of our premises for purposes including: • security; • crime prevention and detection; • protecting staff and visitors; • investigating incidents; and • protecting property. CCTV will not ordinarily be installed in treatment rooms or other areas where individuals have a reasonable expectation of enhanced privacy. Where CCTV is used, appropriate signage will be displayed. Access to recordings is restricted. Recordings are retained only for as long as reasonably necessary for the purpose for which they were collected unless footage is required for an incident, complaint, investigation, insurance claim or legal proceeding.

We may send information about treatments, products, offers, events or clinic news by methods such as email, SMS or other electronic messaging where permitted by law. Depending upon the circumstances, we may rely upon your consent or the applicable existing customer soft opt in provisions. Where we rely upon consent, agreeing to marketing is optional and is not a condition of receiving treatment. Where we rely upon the soft opt in, this will only be where the relevant legal requirements are satisfied. You can opt out of marketing at any time by: • using the unsubscribe facility provided; • following the opt out instructions in the communication; or • contacting us at hello@dslclinic.com (mailto:hello@dslclinic.com). Opting out of marketing will not prevent us from sending genuine service messages concerning appointments, payments, safety information, treatment, aftercare or other matters necessary to administer our relationship with you.

Where appropriate, we maintain records of your marketing preferences so that we can respect your choices. If you unsubscribe from marketing, we may retain sufficient information on a suppression list to ensure we do not accidentally contact you again for the marketing method from which you have opted out. This does not mean we are continuing to use your information for marketing.

Where you interact with us through platforms such as Instagram, Facebook, TikTok or other social media services, the relevant platform may independently process your information. Those companies have their own privacy policies and may act as separate data controllers. Please review the privacy settings and policies of any social media platform you use.

Where you choose to communicate with us through WhatsApp or another third party communication service, the provider of that service may process information in accordance with its own privacy terms. We take reasonable steps to protect confidential information, but clients should be aware that communications sent through third party platforms are also subject to the security and privacy practices of those providers. Where particularly sensitive information needs to be communicated, we may use or request a more appropriate secure method.

We do not ordinarily make decisions about your treatment that have legal or similarly significant effects solely by automated means. Clinical treatment decisions are made or reviewed by appropriately trained individuals. If this changes and UK data protection law requires us to provide additional information or safeguards, we will do so.

Some organisations providing technology, cloud hosting, communication, payment, marketing or other services to us may process personal information outside the United Kingdom. Where personal information is transferred internationally, we will ensure that an appropriate legal mechanism or safeguard is used where required. Depending upon the destination and circumstances, this may include: • UK adequacy regulations; • the UK International Data Transfer Agreement; • the UK Addendum to approved contractual clauses; or • another lawful transfer mechanism. You may contact us for further information about safeguards applicable to relevant transfers.

We take appropriate technical and organisational measures to protect personal information against: • unauthorised access; • unlawful disclosure; • accidental loss; • destruction; • alteration; • misuse; and • other unlawful processing. Measures may include: • access controls; • password protection; • role based access; • secure clinical systems; • device security; • staff confidentiality requirements; • staff training; • secure backups; • physical security; and • appropriate contractual requirements for service providers. Access to personal information is limited according to business and clinical need.

We maintain processes for identifying, assessing and responding to suspected personal data breaches. Where a breach meets the legal threshold for notification, we will report it to the Information Commissioner's Office within the legally required timeframe. Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify affected individuals where required by law.

We do not keep personal information indefinitely simply because we have collected it. Retention periods depend upon: • the type of information; • the nature of the treatment; • clinical requirements; • professional guidance; • regulatory requirements; • insurance requirements; • tax and accounting requirements; • the possibility of complaints or legal claims; • safeguarding obligations; and • other applicable legal requirements. Clinical records may need to be retained for a substantial period after your final treatment because they may be required for continuity of care, regulatory purposes, insurance or legal claims. Financial and accounting information will be retained for the applicable statutory accounting and taxation period. Marketing information will be kept for as long as there is an appropriate lawful basis for marketing. Suppression information may be retained after an opt out so that we can respect that opt out. CCTV recordings will normally be retained for a significantly shorter period unless required in connection with an incident, investigation, complaint or legal claim. Information relevant to an ongoing or reasonably anticipated dispute, complaint, regulatory matter or legal claim may be retained beyond the usual retention period where necessary. When personal information is no longer required, it will be securely deleted, destroyed or irreversibly anonymised where appropriate.

Depending upon the circumstances and the legal basis on which we process your information, you may have rights including the following. ### Right of access You may ask us whether we process your personal information and request a copy of personal information we hold about you. This is commonly known as a Subject Access Request. ### Right to rectification You may ask us to correct personal information that is inaccurate or complete information that is incomplete. ### Right to erasure In certain circumstances, you may ask us to delete your personal information. This right is not absolute. For example, we may need to retain clinical information where we have a legal, regulatory, professional, insurance or other lawful reason to do so. A request to erase medical records therefore does not necessarily mean that we are legally permitted to delete them. ### Right to restriction In certain circumstances you may request that we restrict the way in which your information is processed. ### Right to object You may have the right to object to certain processing based upon legitimate interests. You have an absolute right to object to the use of your personal information for direct marketing. If you object to direct marketing, we will stop using your personal information for that purpose. ### Right to data portability Where the relevant legal requirements are met, you may have the right to receive certain personal information in a structured, commonly used and machine readable format and to ask that information to be transmitted to another organisation. ### Right to withdraw consent Where we rely upon consent, you can withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

You do not need to use any particular wording or form to make a Subject Access Request. A request may be made verbally or in writing. To help us deal with requests efficiently, you may contact: hello@dslclinic.com (mailto:hello@dslclinic.com) We may request reasonable information to verify your identity before releasing sensitive medical or financial information. We will normally respond without undue delay and within one month once the applicable statutory timeframe has begun. In legally permitted circumstances, the response period may be extended. We do not ordinarily charge for exercising data protection rights, although the law allows a reasonable fee in certain limited circumstances.

Your records may contain information relating to another person. When responding to a request for information, we must also consider that person's privacy rights. We may therefore redact or withhold information concerning another individual where required or permitted by law.

Where we lawfully provide services to a child or young person, we process their personal data in accordance with applicable legal and clinical requirements.