Privacy Policy

1. Who we are

Ember Aesthetics Limited operates Ember Aesthetics, an appointment-only clinic in Osbaldwick, York, England, providing non-surgical facial aesthetics, injectable treatments and skin treatments. Our company number is 16272440. We are responsible as controller for the personal information we use to manage our client relationships and provide our services.

For privacy questions or to exercise your rights, email contact@ember-aesthetics.co.uk. Our correspondence address is Unit A, 82 James Carter Road, Mildenhall, United Kingdom, IP28 7DE. This is not the clinic’s treatment location; the private clinic address is supplied upon booking.

2. Information we collect and where it comes from

We receive information you give when booking, completing medical-history and consent forms, attending a consultation or treatment, or contacting us. Our client information includes names, contact details, appointment details, medical histories, consent forms, treatment records (including injectable product batch numbers and accurate treatment details) and treatment photographs. Health information and treatment records may be special-category personal data and require additional protection. Photographs may also reveal health or treatment information.

Booking details, medical histories, consent forms and treatment notes are stored in Fresha only. Treatment photographs are stored in Fresha and on Paige’s iPhone; because iCloud Photos is enabled, photographs in the iPhone photo library also sync to Apple’s iCloud service.

3. How we use information

We use booking and contact information to arrange appointments, communicate with clients and manage our client relationship. Medical histories, consent forms and treatment records support individual suitability assessments, informed treatment decisions and the recording of care. Treatment photographs are held as part of the clinic’s treatment records. They are used for promotion only where the client has given separate permission (see section 5).

Appointment reminders and automatic rebooking reminder emails are sent through Fresha. Rebooking emails invite clients to book again and include a working unsubscribe link. You can use that link to stop these emails. No separate promotional email or SMS campaigns are currently sent. An unsubscribe link does not, on its own, establish permission to send marketing.

4. Lawful bases and special-category information

We use information needed to take the booking steps you request, arrange appointments and provide agreed services on the basis of contract or steps taken at your request before entering a contract (Article 6(1)(b) UK GDPR).

For consent-based collection, use and storage of your medical history and health-related information to assess treatment suitability, provide treatment safely and maintain appropriate clinical records, we rely on consent under Article 6(1)(a) and explicit consent under Article 9(2)(a) UK GDPR. Our Fresha form explains these purposes and includes a separate explicit-consent checkbox. Consent to processing health information is distinct from agreement to undergo a treatment. You can withdraw your health-information consent by contacting us at contact@ember-aesthetics.co.uk. If we cannot use information needed to assess safety, we may be unable to proceed with treatment. Withdrawal does not affect processing that was lawful before withdrawal.

Continued retention is a separate purpose from consent-based treatment processing. Where retaining relevant treatment records is necessary to establish, exercise or defend legal claims, including reasonably anticipated claims concerning treatment, the applicable grounds are our legitimate interests in protecting the clinic’s and clients’ legal position (Article 6(1)(f)) and the legal-claims condition for health information (Article 9(2)(f)). These grounds apply only to records and periods necessary for that purpose, with clients’ rights and interests taken into account; they do not permit blanket or indefinite retention. They may support necessary retention after consent is withdrawn, but do not authorise further treatment or promotional use. Our insurer’s retention requirement is not itself a statutory legal obligation or an Article 9 condition.

For optional promotional use of photographs, we rely on your separate consent (Article 6(1)(a)) and, where photographs reveal health information, explicit consent (Article 9(2)(a)). Promotional permission is separate from agreement to treatment. You can decline promotional use without affecting your treatment.

If information is necessary to arrange an appointment or assess treatment safety and you do not provide it, we may be unable to book or safely proceed. Optional promotional permission must not be a condition of treatment.

5. Photographs and promotional permission

A photography consent form is used. It gives clients a separate choice about whether their photographs may be used for promotion; declining does not affect treatment. Treatment photographs are stored in Fresha and on Paige’s iPhone, with iPhone photos synced to Apple iCloud.

You can contact contact@ember-aesthetics.co.uk to withdraw promotional permission. Withdrawal does not affect the lawfulness of use before withdrawal. Withdrawal of promotional permission and requests to delete clinical records are distinct: clinical records may need to be retained on a separate valid basis. The website treatment-results gallery is not currently displayed.

6. Who information is shared with

We use Fresha for booking and client management. Information submitted through Fresha is handled through that service rather than through a booking form on this website. Fresha’s own privacy information also applies to its processing. Its role may differ between activities; this notice does not describe Fresha as solely a processor for everything it does.

Access to client medical histories and treatment records in Fresha is limited to Paige and Emma, the clinic’s prescribing practitioner involved in clients’ treatment. We use IONOS for the clinic’s email service; information you send to contact@ember-aesthetics.co.uk is handled through that service. Payment-card storage and cancellation/no-show fee collection are handled through Fresha. Treatment photographs synced to iCloud are stored by Apple; only Paige has access to the Apple ID and photo library. We do not use an external accountant or bookkeeper with access to client financial information. Our business insurance is arranged through PolicyBee; information may be shared with our insurer only where needed for a claim or complaint.

7. Where information is processed

Information is handled through Fresha, IONOS and Apple iCloud as described above. This notice does not promise that all information is stored in the UK. You can contact contact@ember-aesthetics.co.uk with questions about these services and the handling of your information.

8. How long we keep information

Our insurance requires professional treatment records to be kept for at least 10 years from the date of treatment. These records include relevant medical histories, consent forms and treatment notes. Injectable product batch numbers and accurate treatment details are recorded.

Records relating to minors must be kept for at least 10 years after they reach adulthood. This retention rule is not an offer of treatment to minors.

Pre-treatment photographs for botulinum toxin and dermal filler treatments to the head and neck must be kept for 10 years after treatment. If a client refuses those photographs, a signed and dated refusal must be kept for 10 years instead.

These are minimum requirements of our PolicyBee Aesthetics Combined insurance wording and policy schedule, subject to any longer applicable legal or professional obligations. They do not override data-protection rights or replace the need for valid grounds for retention. Following withdrawal of consent or an erasure request, continued retention must be justified separately as described in section 4; only relevant records necessary for that purpose may be retained. Where no continuing ground applies, records must be erased. Records must not be kept beyond the applicable period without a valid, necessary reason.

For enquiries, ordinary email correspondence and promotional-use records, retention depends on the purpose of the correspondence, whether an enquiry or complaint remains unresolved, and whether the information is needed to document consent, an objection or a legal claim. Such information must not be retained once no longer needed for a valid purpose. Withdrawal of promotional permission stops future promotional use; a clinical copy may still require retention on the separate grounds described above.

9. Keeping information secure

Access to client medical histories and treatment records in Fresha is limited to Paige and Emma. The iPhone holding treatment photographs is protected by Face ID and a passcode. Only Paige has access to the Apple ID and iCloud photo library. No service or storage method can be guaranteed completely secure.

10. Website technologies and external services

This website introduces the clinic and links to Fresha and social/business profiles. It does not contain a client account, newsletter signup, contact form, embedded booking service or payment form. Booking and profile links open external sites in a separate tab; those sites have their own privacy and cookie information.

The website loads Noto Serif Display, Montserrat and DM Sans through Google Fonts. Those requests disclose technical information such as IP address and browser request information to Google. Clinic photographs are delivered through the website hosting platform’s asset service. Website delivery and technical diagnostics can involve technical request information. These resource requests are not, by themselves, evidence of cookie use.

Cookie Settings is available in the website footer. Fresha and the linked social/business sites have their own privacy and cookie information when you choose to visit them.

11. Your rights

Subject to applicable conditions and exceptions, you can ask to access your personal information, correct inaccurate information, have information erased, restrict its use or receive certain information in a portable form. You may object to processing based on legitimate interests and can object to direct marketing at any time. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.

These rights are not all absolute. For example, information may need to be retained on a valid basis for an applicable obligation or legal claim; we must explain any refusal or restriction. Where relevant, UK GDPR also provides protections in relation to solely automated decisions with legal or similarly significant effects.

Email contact@ember-aesthetics.co.uk to make a request. We may need proportionate information to verify identity. We will respond without undue delay and normally within one month, subject to applicable law, including any permitted extension or clarification rules. Requests are normally free; any lawful exception must be explained.

12. Concerns and the ICO

Please contact us if you have concerns about how your information is used. You also have the right to complain to the Information Commissioner’s Office, the UK data-protection regulator, without first having to complete our process.

ICO information and complaints: https://ico.org.uk/make-a-complaint/ and https://ico.org.uk/ .

13. Changes to this notice

Material changes will be reflected in an updated notice and brought to clients’ attention where required.