Privacy Policy
R&A Clinic Website
How we collect, use and protect your personal information
Effective: October 2026 · Last reviewed: October 2026
We protect the privacy and confidentiality of everyone who trusts us with their information. As a medical and aesthetics clinic, some of what we hold is about your health, and we give it extra protection.
At a Glance
- We never sell your information
- We collect only what we need to care for you safely, run the clinic and meet our legal duties
- Health information and clinical photographs are kept confidential
- We never use identifiable photos for marketing without your separate permission
- You can opt out of marketing at any time
- You have rights to access, correct and, in some cases, delete your information
Questions or requests: admin@randaclinic.com
1. About This Policy
R&A Clinic Ltd (company number 15873432), whose registered office is 31 Onslow Square, South Kensington, London SW7 3HU, is the data controller for the information described here.
This policy applies when you:
- Visit our website, www.randaclinic.com
- Make an enquiry, or telephone, email or message us
- Book or attend a consultation or treatment
- Buy products or services
- Attend a clinic event
- Sign up for marketing communications
It covers patients and prospective patients, website visitors, customers, event attendees, marketing subscribers, models taking part in treatments, demonstrations or training, suppliers and professional contacts. Staff information is covered by separate internal documentation.
2. Information We Collect
What we hold depends on how you interact with us and the services you receive.
Personal and contact details
Name, date of birth, address, email, phone, emergency contact, gender where relevant to treatment, communication preferences
Appointments and treatment
Appointment history, consultation records, treatment plans, clinical notes, outcomes, aftercare, products prescribed or supplied, consent forms, correspondence about your care
Health and medical information
Medical history, conditions, allergies, medications, previous procedures, contraindications, pregnancy or breastfeeding status where clinically relevant, relevant family history, and physical or mental health information relevant to your care
Clinical photographs
Images taken before, during or after treatment (see section 5)
Payments
Payment status, invoices, deposits, refunds, balances and accounting records. Card details are usually handled directly by our authorised payment provider, not stored by us
Website and technical
IP address, browser and device type, pages viewed, referral source, cookie and analytics data
Marketing preferences
Whether and how you consented, your preferences, when they changed, how you engage with our messages, and opt-outs
Health information is special category data. We collect it only where it is needed to assess whether a treatment is safe and appropriate, and to provide it.
3. How We Collect It
Most information comes directly from you: through our website, by phone, email or message, at consultations and appointments, on forms and consent documents, when you pay, and at clinic events. Some is gathered automatically by cookies on our website.
We may also receive information from:
- A parent or legal guardian, where appropriate
- Another healthcare professional, where appropriate and lawful
- Someone authorised to act on your behalf
- Our booking and patient management systems and other service providers
We only use information from other sources where we have a proper reason and a lawful basis to do so.
4. How We Use It and Why We Are Allowed To
UK data protection law requires a lawful basis for every use of personal information.
Contract
Registering you, arranging appointments, consultations, treatment and aftercare, supplying products, taking payments, issuing invoices and refunds
Legal obligation
Keeping clinical, tax and accounting records, and meeting regulatory and professional duties
Legitimate interests
Answering enquiries, handling complaints, improving our services, clinical governance, protecting our systems, preventing fraud and defending legal claims, only where these are not overridden by your rights
Consent
Certain marketing, and using photographs, videos or testimonials for promotion. You can withdraw consent at any time
Health Information
To use health information we need a lawful basis and an additional legal condition. Depending on the circumstances, this will be that the processing is necessary for:
- Medical diagnosis and providing health or treatment services
- Managing health services, under a duty of confidentiality
- Establishing, exercising or defending legal claims
- Or, where appropriate, your explicit consent
Only people who need clinical information for legitimate clinical, administrative, legal or operational reasons can access it.
5. Clinical Photographs
We may take photographs before, during or after treatment. They form part of your confidential patient record and help us assess your condition, plan treatment, track progress and compare outcomes.
We will not use identifiable photographs of you for advertising, social media or other marketing without your separate permission.
If you give permission for marketing photos or video, you can withdraw it for future use at any time. We may not be able to recall material that has already been published.
6. Confidentiality and Who We Share With
We do not sell patient information. Your records are accessed only by authorised people, and our clinicians are bound by the confidentiality duties of their professions.
We share information only where necessary and lawful, and only as much as the purpose requires, with:
- Clinicians and healthcare professionals involved in your care
- Laboratories, pharmacies and specialist providers relevant to your treatment
- Technology providers, including patient management (such as Pabau), booking, IT, cloud and website hosting
- Payment processors, accountants and financial advisers
- Legal, professional and compliance advisers, and insurers
- Marketing providers, for messages you have agreed to receive
- Regulators, professional bodies or authorities, only where the law requires or permits
- Anyone else you authorise
Any provider handling information on our behalf must keep it secure and confidential under a written contract.
International Transfers
Some providers may store or access information outside the UK. Where this happens we make sure the transfer is lawful and protected, using UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum, or another recognised safeguard.
7. How Long We Keep It and How We Protect It
Retention
We keep information only as long as needed for the purpose it was collected for, and to meet clinical, legal, regulatory, tax, insurance and accounting requirements. We keep clinical records for 8 years after your last treatment, in line with UK legal and professional guidance. When information is no longer needed, we securely delete, destroy or anonymise it.
Security
We protect your information with password-protected systems, role-based access controls, secure patient management and payment systems, confidentiality agreements, staff training, regular access reviews and procedures for handling security incidents. No system is completely secure, but our safeguards reflect the sensitivity of what we hold.
Data Breaches
We have procedures to identify, investigate and manage suspected breaches. Where the law requires, we will report a breach to the Information Commissioner’s Office and tell the people affected.
8. Marketing and Cookies
Marketing
We may send you news about our treatments, services, events and offers by email, SMS, messaging or phone. We ask for your consent where the law requires it.
To opt out at any time: use the unsubscribe link in any message, email admin@randaclinic.com, or ask any member of our team.
Opting out will not stop us contacting you about appointments, treatment, payments or your safety. We will not use your health information to target marketing without a proper lawful basis.
Cookies
- Essential: make the website work (no consent needed)
- Analytics and performance: show us how visitors use the site (consent where required)
- Advertising and targeting: measure campaigns and show relevant ads (consent needed)
You can accept, reject or change non-essential cookies at any time through our website’s cookie controls.
Other Websites
Our website and messages may link to social media or other sites. We are not responsible for their privacy practices, so please read their policies before sharing information with them.
9. Your Rights
Depending on the circumstances, you have the right to:
- Access your information and get a copy
- Correct inaccurate or incomplete information
- Erase information (not absolute, as we may have to keep clinical records)
- Restrict how we use your information
- Object to certain uses, and always to direct marketing
- Port information you gave us to another organisation
- Withdraw consent at any time
- Rights over automated decisions (we do not make clinical decisions this way)
To make a request, email admin@randaclinic.com with enough detail for us to identify you. We may ask for proof of identity to protect your confidentiality. We will reply within the time limits set by law, and there is normally no charge.
10. Children and Young People
We mainly treat adults. If we provide services to anyone under 18, we take appropriate care over consent, capacity, parental responsibility and confidentiality, in line with UK law and professional standards, and collect only what is needed.
11. Complaints, Changes and Contact
If you are unhappy with how we have handled your information, please tell us first at admin@randaclinic.com so we can put it right. You can also complain to the Information Commissioner’s Office at any time: www.ico.org.uk
We may update this policy when our services, systems, providers or the law change. The latest version will always be on our website.
Contact Us
R&A Clinic Ltd, Malvern Court, 31 Onslow Square, South Kensington, London SW7 3HU
0207 050 0738 | admin@randaclinic.com | www.randaclinic.com
Registered in England and Wales, company number 15873432
