PRIVACY POLICY
Flori Aesthetics
Effective date: 7 September 2026
Last reviewed: 7 September 2026
ICO Registration Number: ZC153558
ICO Registration: 21 May 2026 – 20 May 2027
1. WHO WE ARE
Flori Aesthetics provides aesthetic, skin and beauty treatments from our clinic at 9 Market Street, Whittlesey, PE7 1BA.
For the purposes of UK data protection legislation, Jessica Lucy McNamara trading as Flori Aesthetics is the data controller for the personal information we collect and use. This means that we are responsible for deciding how and why your personal information is collected and used.
Data Controller
Legal entity: Jessica Lucy McNamara trading as Flori Aesthetics
Registered address: 4 Tayberry Way, Whittlesey, PE7 2GH
Clinic address: 9 Market Street, Whittlesey, PE7 1BA
ICO Registration Number: ZC153558
ICO Registration: 21 May 2026 – 20 May 2027
Data Protection Contact: Jessica Lucy McNamara
Email: hello@floriaesthetics.co.uk
Telephone: 07592 103816
2. INFORMATION WE COLLECT
We collect information that is necessary to provide safe, appropriate and professional treatment and to manage our relationship with you.
Information you provide to us
This may include:
Your name
Date of birth
Address
Email address
Telephone number
Emergency contact details
Medical history
Current medication
Allergies and known sensitivities
Relevant lifestyle information
Previous aesthetic, medical or cosmetic treatments
Details of treatments received elsewhere where relevant
Your treatment goals and concerns
Consultation information
Signed consent forms
Aftercare acknowledgements
Payment and transaction information
Marketing preferences
Clinical information we create
During your treatment and consultations, we may create and maintain:
Consultation records
Treatment records
Clinical notes
Treatment plans
Product and batch information
Treatment photographs
Before-and-after photographs
Aftercare records
Review records
Records of adverse reactions or complications
Records relating to any corrective or remedial treatment
Correspondence relating to your treatment
Complaint or incident records where applicable
Information collected automatically
Depending on how you interact with us, we may also collect:
Website usage information
Cookie information
Booking and appointment information
CCTV footage where CCTV operates at our premises
Information generated through our booking, payment and client-record systems
Some of the information we collect, particularly information relating to your health, medication, allergies and medical history, is considered special category data under UK data protection law.
We take additional care when collecting, storing and using this information.
3. WHY WE USE YOUR INFORMATION
We use your personal information for the following purposes:
We collect and use your personal information primarily so that we can provide you with safe, appropriate and personalised treatments. Before carrying out a treatment, we need to understand your medical history, current medications, allergies, previous treatments, lifestyle and individual concerns. This information allows us to assess whether a treatment is suitable for you, identify any contraindications or potential risks, and make appropriate decisions about your care.
We use your information to manage your appointments, send appointment confirmations and reminders, communicate with you about your treatment, provide aftercare advice and arrange follow-up or review appointments where appropriate. We may also contact you if we need important information relating to your safety or treatment.
We maintain accurate clinical records of the treatments and services you receive from us. This includes consultation information, treatment notes, products used, batch numbers where applicable, clinical photographs, aftercare advice, reviews and any complications or adverse reactions. Maintaining these records helps us provide safe and consistent care and allows us to properly respond to any future treatment-related concerns.
We use your information to process payments, manage invoices and maintain appropriate financial and accounting records. We may also use information where necessary to comply with our legal, regulatory, insurance or professional obligations.
If you raise a complaint or concern, we may use your personal and clinical information to investigate the matter properly, communicate with you and determine an appropriate resolution. Where necessary, information may also be used in relation to an insurance matter, legal claim or the establishment, exercise or defence of legal rights.
Where a prescription-only medicine or other treatment requiring involvement from an appropriately qualified healthcare professional is required, we may share relevant information with our prescriber, pharmacy or another healthcare professional where necessary to facilitate safe treatment. Where appropriate, we will obtain your consent before sharing information with another healthcare professional.
We may be required to use or disclose information to report certain adverse incidents, comply with legal requirements or cooperate with regulatory authorities. This may include sharing relevant information with bodies such as the Medicines and Healthcare products Regulatory Agency (MHRA), where legally required or appropriate.
We may use your contact information to send marketing communications about Flori Aesthetics, including treatments, new services, memberships, packages, offers, events and clinic news. We will only send marketing communications where we have the appropriate consent or other lawful basis to do so. You can withdraw your consent or opt out of marketing at any time.
We may use clinical photographs for purposes connected with your treatment and clinical record. The use of photographs for marketing is separate and requires your specific consent. Your decision not to allow your photographs to be used for marketing will not affect the treatment or service you receive.
We may use personal information where necessary to maintain the safety and security of our clients, practitioners, staff and premises, including through CCTV where applicable. CCTV is used for legitimate purposes such as security, crime prevention and the investigation of incidents.
We may also use information to monitor and improve the quality of our services, understand how clients use our services and improve the overall client experience. Where we use your information for these purposes, we will only use information that is reasonably necessary and will handle it in accordance with applicable data protection legislation.
The legal basis for using your information will depend on the specific purpose. This may include performing our contract with you, complying with a legal obligation, pursuing our legitimate interests, or obtaining your consent.
Where we process information relating to your health or other special category data, we will also rely on an appropriate additional condition under UK data protection law, such as processing for the provision of health or social care and treatment, where applicable.
We will only collect and use information that is reasonably necessary for the purposes described in this Privacy Policy. If we need to use your information for a substantially different purpose, we will provide you with appropriate information before doing so unless we are legally permitted or required to act without informing you.
4. CLINICAL PHOTOGRAPHS
Clinical photographs may be taken before, during or after treatment.
These photographs form an important part of your clinical record and may be used to:
Assess your suitability for treatment
Plan and document treatment
Monitor treatment outcomes
Compare results over time
Support clinical reviews
Assist with the assessment of complications
Document your care
Assist with complaints, insurance matters or legal claims where necessary
Clinical photographs are treated as confidential clinical information and are stored securely as part of your treatment record.
Marketing photographs
The use of your photographs for marketing is completely separate from clinical photography.
We will only use your photographs for marketing purposes where you have provided specific consent for this purpose.
Marketing use may include:
Instagram
Facebook
Our website
Advertising
Promotional materials
Other social media platforms operated by Flori Aesthetics
Agreeing to clinical photographs does not mean that you have agreed to marketing use.
You can refuse marketing photography without this affecting your treatment or relationship with Flori Aesthetics.
You can withdraw your marketing consent at any time by contacting us at hello@floriaesthetics.co.uk.
Where reasonably possible, we will stop using your photograph in future marketing and remove content from platforms that we control.
Please be aware that once an image has been published online, we cannot guarantee that third parties have not copied, downloaded, shared or reposted it. We will take reasonable steps to remove content that we control when consent is withdrawn.
5. MARKETING
If you have given us consent to receive marketing communications, we may contact you by:
Email
SMS
WhatsApp
Other communication methods that you have specifically opted into
Marketing may include information about:
Treatments
New services
Clinic news
Special offers
Packages
Memberships
Events
Relevant clinic updates
You can withdraw your marketing consent at any time.
Every electronic marketing communication will provide an appropriate method of opting out where required.
You can also contact hello@floriaesthetics.co.uk and ask us to stop marketing communications.
Opting out of marketing will not prevent us from contacting you about appointments, treatment, aftercare, payments, safety or other matters relating directly to your care.
We do not sell your personal information.
We do not provide your personal information to other businesses for their own independent marketing purposes.
6. CCTV
Where CCTV is installed at Flori Aesthetics, it is used to help protect clients, practitioners, staff and visitors and to assist with the prevention and investigation of crime.
CCTV cameras will not be positioned in areas where clients have a reasonable expectation of privacy, such as treatment rooms, bathrooms or changing areas.
CCTV footage will be retained for 6 years, unless it is required for an ongoing investigation, insurance matter, complaint, legal claim or other legitimate purpose.
Where footage needs to be retained for longer, it will be securely stored and deleted once it is no longer required.
CCTV footage may be disclosed to the police, insurers, legal advisers or other appropriate authorities where this is necessary, legally required or permitted.
Appropriate signage will be displayed where CCTV is in operation.
7. WHO WE SHARE YOUR INFORMATION WITH
We only share personal information where there is a legitimate reason to do so and only the information reasonably required for that purpose.
Depending on the circumstances, this may include:
Booking and clinical-record providers
We use third-party software providers to manage appointments, client information and clinical records.
Provider: Fresha and/or other approved systems used by Flori Aesthetics.
These providers process information on our behalf and are required to maintain appropriate security and confidentiality.
Payment providers
Payments may be processed through third-party payment providers.
These providers process your payment information in accordance with their own privacy policies and applicable payment-security requirements.
We do not intentionally store complete payment-card numbers.
Prescribers and pharmacies
Where prescription-only medication is required, relevant information may be shared with an appropriately authorised prescriber and/or pharmacy.
This may include information necessary to assess suitability for medication and provide safe treatment.
Healthcare professionals
Where clinically necessary, we may communicate with your GP, nurse, prescriber or another healthcare professional.
Where appropriate, we will seek your consent before doing so.
Information may be shared without consent where this is legally permitted or necessary to protect your vital interests or another person's safety.
Insurers and indemnity providers
Where there is a complaint, incident, claim or potential claim, relevant information may be shared with our insurers, legal advisers or professional indemnity provider where necessary.
Regulators and authorities
We may provide information to regulators or authorities where we are legally required to do so.
This may include reporting relevant adverse incidents to the appropriate regulatory authority or manufacturer.
Professional advisers
Relevant information may be shared with professional advisers such as accountants where necessary for legitimate business, accounting or legal purposes.
IT, email and technology providers
We use third-party providers to operate our email, website, digital systems and other business infrastructure.
Where these providers process personal data on our behalf, we take reasonable steps to ensure that appropriate data-processing and security arrangements are in place.
8. INTERNATIONAL DATA TRANSFERS
Where possible, we use providers that store personal information within the UK or European Economic Area.
Some technology, booking, communication, social media or cloud providers may process information outside the UK or EEA.
Where personal information is transferred internationally, we will ensure that appropriate safeguards are in place in accordance with UK data protection legislation.
These safeguards may include an adequacy decision, UK International Data Transfer Agreement, UK Addendum or other legally recognised protection.
9. HOW LONG WE KEEP YOUR INFORMATION
We only keep your personal information for as long as we reasonably need it for the purpose for which it was collected. The length of time we retain your information depends on the type of information, our legal and regulatory obligations, our insurance requirements and whether we may need the information in relation to your ongoing care or a complaint, incident or legal matter.
Your clinical records, including consultation forms, medical history, treatment records, consent forms, clinical notes, product information and aftercare records, will be retained for an appropriate period following your last treatment. This allows us to maintain an accurate history of your care, respond appropriately to any future treatment-related concerns and meet our legal, professional and insurance obligations. 6 years.
Clinical photographs are considered part of your clinical record and will generally be retained for the same period as the relevant clinical records. Photographs used for marketing purposes will be managed separately and in accordance with the consent you have provided.
Information relating to complaints, incidents, complications, adverse reactions, insurance matters or legal claimsmay need to be retained for longer than your ordinary clinical records where this is reasonably necessary to investigate or resolve the matter, meet our insurance requirements or establish, exercise or defend legal claims.
We retain financial and accounting records for the period required by applicable financial and tax legislation. This will generally be six years, although certain records may need to be retained for longer where legally required.
If you have opted in to receive marketing communications, we will retain your marketing contact information until you withdraw your consent or otherwise ask us to stop receiving marketing. We may retain a limited record of your opt-out request so that we can ensure we do not send you marketing communications in the future.
Where CCTV operates at our premises, footage will normally be retained for 6 years before being securely deleted or overwritten. Footage may be retained for longer where it is reasonably necessary in connection with an incident, complaint, insurance matter, investigation or legal claim.
When information is no longer required, we will securely delete, destroy or anonymise it in a way that prevents it from being unnecessarily accessed or recovered.
We periodically review the information we hold to ensure that we are not retaining personal information for longer than is reasonably necessary.
10. HOW WE KEEP YOUR INFORMATION SAFE
We take appropriate technical and organisational measures to protect your personal information against:
Unauthorised access
Loss
Theft
Misuse
Accidental destruction
Unauthorised alteration
Unauthorised disclosure
These measures include:
Password-protected systems
Access controls
Secure clinical-record systems
Restricted access to client information
Secure storage of clinical photographs
Encryption and/or device security where available
Password-protected devices
Secure storage of paper records
Locked storage where paper records are retained
Staff confidentiality requirements
Data protection and confidentiality training
Clinical photographs must not be retained in practitioners' personal camera rolls once they have been appropriately transferred to the approved clinical-record system.
Access to client information is restricted to individuals who genuinely need access to perform their role.
11. DATA BREACHES
We have procedures in place to identify, investigate and respond to personal-data breaches.
If a personal-data breach occurs, we will assess the nature and severity of the breach and take appropriate action.
Where legally required, we will notify the Information Commissioner's Office within the required timeframe.
Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you where legally required.
12. YOUR DATA PROTECTION RIGHTS
Under UK data protection legislation, you may have the following rights:
Right of access
You can request a copy of the personal information we hold about you, including relevant clinical records and photographs.
Right to rectification
You can ask us to correct information that is inaccurate or incomplete.
Right to erasure
In certain circumstances, you can ask us to delete your personal information.
However, this right is not absolute. We may be legally required or have legitimate grounds to retain clinical, financial or other records.
Right to restrict processing
You may ask us to restrict how we use your information in certain circumstances.
Right to object
You may object to certain types of processing, including some processing based on legitimate interests and direct marketing.
Right to data portability
Where applicable, you may request certain personal information in a structured, commonly used and machine-readable format.
Right to withdraw consent
Where we rely on your consent, you can withdraw that consent at any time.
Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew your consent.
To exercise any of these rights, please contact:
Email: hello@floriaesthetics.co.uk
Address: 4 Tayberry Way, Whittlesey, PE7 2GH
We may need to verify your identity before providing information or making changes to your records. This is a security measure designed to protect your personal information.
We will normally respond to valid requests within one month, subject to any lawful extension that may apply.
13. COOKIES
Our website may use cookies and similar technologies.
Cookies are small files placed on your device that allow websites to recognise your device and remember certain information.
We may use:
Essential cookies
These are necessary for the website to function correctly and may support functions such as navigation, security and booking.
Analytics cookies
Where enabled, analytics tools such as Google Analytics may help us understand how visitors use our website and improve its performance.
Marketing cookies
Where enabled and where appropriate consent has been obtained, marketing technologies such as Meta Pixel may help us measure advertising and understand how users interact with our website.
Non-essential cookies will only be used where the appropriate consent is required.
You can manage your cookie preferences through our cookie-consent mechanism or your browser settings.
14. COMPLAINTS ABOUT YOUR PERSONAL INFORMATION
We take concerns about privacy and data protection seriously.
If you believe that we have handled your personal information incorrectly, please contact us first:
Email: hello@floriaesthetics.co.uk
Telephone: 07592 103816
We will investigate your concern and aim to resolve it appropriately.
You also have the right to complain directly to the Information Commissioner's Office (ICO).
Information Commissioner's Office
Website: ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
You do not have to contact us before contacting the ICO, although we would appreciate the opportunity to investigate and resolve your concern first.
15. CHILDREN AND YOUNG PEOPLE
Flori Aesthetics primarily provides treatments to adults.
Where information relating to a person under 18 is collected in circumstances where treatment is permitted, we will apply appropriate additional safeguards and handle their information in accordance with applicable data protection, safeguarding and consent requirements.
We will not knowingly collect unnecessary personal information from children.
16. CHANGES TO THIS PRIVACY POLICY
We review this Privacy Policy regularly and at least annually.
We may update this policy where there are changes to:
Our services
The systems we use
The way we process personal information
Data protection legislation
Regulatory requirements
Our business operations
The latest version will be made available through the appropriate Flori Aesthetics channels.
Where significant changes affect how we use your personal information, we will provide appropriate notice.
DOCUMENT CONTROL
Policy: Privacy Policy
Business: Flori Aesthetics
Data Controller: Jessica Lucy McNamara trading as Flori Aesthetics
Registered address: 4 Tayberry Way, Whittlesey, PE7 2GH
Clinic address: 9 Market Street, Whittlesey, PE7 1BA
ICO Registration Number: ZC153558
ICO Registration: 21 May 2026 – 20 May 2027
Version: 1.0
Effective date: 7 September 2026
Review date: 7 September 2027
Policy owner: Jessica Lucy McNamara