Privacy Notice

1. Who We Are

This Privacy Notice applies to:
Perfect Skin Studio Ltd ICO Registration No: ZB599715
Each company acts as a Data Controller under UK data protection legislation.

2. When This Notice Applies

Perfect Eyes Ltd is responsible for processing personal data relating to surgical and medical ophthalmic services. Perfect Skin Studio Ltd is responsible for processing personal data relating to aesthetic and non-surgical skin treatments. Where appropriate and lawful, personal data may be shared between the two entities for continuity of care, administration, and regulatory compliance.

3. What Personal Data We Collect

Identity and Contact Information:

• Name
• Date of birth
• Address
• Email address
• Telephone number

Clinical Information (Special Category Data):

• Medical history
• Examination findings
• Treatment records
• Prescriptions
• Clinical photographs
• Correspondence with other healthcare professionals

Financial Information:

• Billing information
• Payment details (processed via secure third-party providers)

Marketing Preferences:

• Communication preferences
• Newsletter subscriptions

4. Special Category Data

As specialist healthcare providers, we process special category data (including health information) to provide safe and appropriate medical and aesthetic care.

5. Lawful Basis for Processing

Clinical Care:

• Article 6(1)(e) – Public task (healthcare provision)
• Article 9(2)(h) – Provision of health or social care

Contractual Services:

• Article 6(1)(b) – Performance of a contract

Legal & Regulatory Compliance:

• Article 6(1)(c) – Legal obligation

Marketing Communications:

• Article 6(1)(a) – Consent (withdrawable at any time)

6. Clinical Photography

Clinical photographs form part of the medical record and are retained in accordance with the same retention schedule as other clinical records. Separate explicit consent is obtained before any identifiable images are used for marketing, teaching, or publication.

7. Data Sharing & Processors

We may share relevant information with:

• GPs and healthcare professionals (where clinically appropriate)
• Laboratories or diagnostic providers
• Professional advisers (including insurers and legal advisers)
• Regulatory authorities where required

We use carefully selected third-party data processors including practice management software providers, cloud storage providers, payment processors, and IT support providers. All processors are contractually bound to maintain confidentiality and data security.

8. International Transfers

Some third-party service providers may process data outside the UK or EEA. Where this occurs, we ensure appropriate safeguards are in place, including UK adequacy regulations, International Data Transfer Agreements (IDTAs), or Standard Contractual Clauses (SCCs).

9. Data Retention

We retain personal data only for as long as necessary for clinical, legal, regulatory, accounting, and insurance purposes. Clinical Records:

• Adult patient records are retained for a minimum of 8 years from the date of last treatment.
• Records may be retained for longer where there is an ongoing complaint, claim, regulatory requirement, or clinical justification.

Financial Records:

• Retained for at least 6 years in accordance with HMRC requirements.

Marketing Data:

• Retained until consent is withdrawn.

CCTV (if applicable):

• Typically retained for 30 days unless required for investigation purposes.

We maintain a documented Data Retention and Disposal Policy.

10. Security Measures

We implement appropriate technical and organisational measures including encrypted systems, role-based access controls, secure password protocols, regular backups, staff confidentiality training, and secure destruction of records when retention periods expire.

11. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request restriction of processing
• Object to processing (where applicable)
• Request data portability (where applicable)
• Withdraw marketing consent at any time

We respond to Subject Access Requests within one calendar month unless a lawful extension applies. You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at [www.ico.org.uk](http://www.ico.org.uk).

12. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

13. Changes to This Notice

We may update this Privacy Notice periodically. The latest version will always be available on our website.