Privacy Policy

Last updated: 10 June 2026

Kelly Harris Aesthetics (“KHA”, “we”, “us”, “our”) is committed to protecting your privacy and handling your personal information openly and securely. This policy explains what information we collect, why we collect it, how we use it, and the rights you have over it.

We are a medical aesthetics clinic, so some of the information we hold is health information. We treat this with particular care, as set out below.

This policy applies to our website, kellyharrisaesthetics.co.uk, and to the information we collect when you contact us, book an appointment, or attend the clinic.

Who we are

Kelly Harris Aesthetics is the data controller responsible for your personal information.

Address: Unit 2, Squire Court, Victoria Quay, Maritime Quarter, Swansea, SA1 3XB, United Kingdom
Phone: +44 1792 677271
Email: info@kellyharrisaesthetics.co.uk
ICO registration number: [add your ICO registration reference]

The clinic is regulated by Healthcare Inspectorate Wales (HIW). If you have any questions about how we use your personal information, please contact us using the details above.

The information we collect

Information you give us directly

Your name, email address, phone number and any details you include when you complete our contact form or message us.
Booking and appointment details when you reserve a consultation or treatment.
Health and medical information you share during consultations and treatment, including your medical history, medications, allergies, the treatments you have, and any aftercare notes. This is needed so we can treat you safely.
Clinical photographs, where relevant to your treatment and assessment.
Payment details when you pay for products or services.
Reviews, feedback and testimonials you choose to give us.

Information we collect automatically when you use our website

Technical and usage information such as your IP address, browser type, device, and the pages you visit. We collect this through cookies and similar technologies (see Cookies below).

Information from third parties

Appointment and booking information from our booking provider when you book online.

Health information (special category data)

As a medical clinic, we process information about your health. Under UK data protection law this is “special category” data and is given extra protection.

We only use your health information for purposes connected to your care, such as assessing your suitability for treatment, providing treatment safely, keeping accurate clinical records, and following up on your aftercare. We rely on the legal basis that processing is necessary for the provision of health care and treatment, and we will ask for your explicit consent where this is required.

We will never use your health information for marketing without your clear, separate consent.

Clinical photographs and testimonials

We may take clinical photographs as part of your assessment and treatment record. These form part of your confidential clinical notes.

We will only use your photographs, name or comments for marketing, on our website, or on social media if you have given us your specific, written consent, and you can withdraw that consent at any time.

How we use your information and our legal basis

We use your personal information to:

Respond to your enquiries and provide the information you ask for.
Arrange and manage your consultations, appointments and treatments.
Provide safe, appropriate medical and aesthetic care, and keep accurate records.
Take payment and keep financial records.
Send you appointment reminders and information about your care.
Send you marketing communications, where you have agreed to receive them.
Improve our website and services.
Meet our legal, regulatory and insurance obligations.

The legal bases we rely on are:

Your consent, for example for marketing, the use of certain cookies, and the use of your photographs or testimonials.
Performance of a contract, to provide the services you have requested.
Provision of health care and treatment, for the health information needed to treat you safely.
Legitimate interests, to run and improve our clinic, respond to enquiries, and keep our website secure, in a way that does not override your rights.
Legal obligation, where we are required to keep records or share information by law or by our regulator.

Marketing

If you have agreed to receive marketing from us, we may contact you about treatments, offers and news. You can opt out at any time by using the unsubscribe link in our emails or by contacting us directly. Opting out of marketing will not affect your care.

Cookies

Our website uses cookies and similar technologies to help it work properly and to understand how visitors use the site, including analytics provided through Google. You can control or refuse cookies through the cookie banner and through your browser settings. For full details, please see our Cookie Policy.

Who we share your information with

We do not sell your personal information. We share it only where necessary, with:

Our booking and appointment software provider, ClinicMinds, who manage online bookings on our behalf.
Our website hosting and IT providers.
Analytics providers, including Google, where you have accepted analytics cookies.
Our payment provider, to process payments securely.
[Our email or marketing platform, if you use one, for example Mailchimp].
Professional advisers, insurers and our regulator, where required.
Other healthcare professionals or authorities, where this is necessary for your care or required by law.

Where a third party processes information on our behalf, we put an agreement in place requiring them to keep it secure and to use it only on our instructions.

Storing and transferring your information

We store your information within the UK and the European Economic Area wherever possible. If any of our providers store or process information outside these areas, we make sure appropriate safeguards are in place to protect it, as required by UK data protection law.

How long we keep your information

We keep your information only for as long as we need it.

Clinical and treatment records are kept for [add your retention period, for example 8 to 10 years from your last treatment, in line with professional and insurance guidance].
Enquiry and contact information is kept for [add period, for example up to 2 years] if it does not lead to treatment.
Financial records are kept for at least 6 years to meet our legal obligations.

After these periods, we securely delete or anonymise your information.

How we keep your information secure

We take the security of your information seriously and use appropriate measures to protect it, including secure storage, restricted access, and a secure (SSL) website connection. Access to clinical records is limited to those who need it to provide your care.

Your rights

Under UK data protection law you have the right to:

Be told how your information is used.
Access a copy of the information we hold about you.
Have inaccurate information corrected.
Ask us to delete your information, where we are not required to keep it.
Restrict or object to how we use your information.
Ask us to transfer your information to another provider, where this applies.
Withdraw your consent at any time, where we rely on consent.

To exercise any of these rights, please contact us using the details at the top of this policy. We will respond within one month.

Visitors under 18

Our treatments and services are intended for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a young person has provided us with their information, please contact us and we will remove it.

Changes to this policy

We may update this policy from time to time. Any changes will be published on this page with a revised “last updated” date.

How to contact us or make a complaint

If you have any questions about this policy or how we handle your information, please contact us using the details at the top of this page.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection:

Website: ico.org.uk
Helpline: 0303 123 1113
Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF