Privacy Policy

1. Introduction

Welcome to Nebras Clinic.

At Nebras Clinic, we respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, share and protect your personal data when you visit our website, contact us, book an appointment, receive a treatment or enquire about our professional training courses.

We handle personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

Please read this policy carefully to understand how we manage your information and your rights.

2. Who We Are

Business Name: Nebras Clinic

Address: 22–24 Norland Road, London W11 4TR, United Kingdom

Website: https://nebrasclinic.co.uk/

Email: info@nebrasclinic.co.uk

Telephone: +44 20 3411 3000

For the purposes of applicable data protection legislation, the business operating Nebras Clinic is the data controller for the personal information described in this policy, except where another organisation acts as an independent controller.

For privacy-related enquiries, please contact us using the details above.

3. Information We Collect

Depending on how you interact with our clinic and website, we may collect the following categories of personal information.

3.1 Personal Identification Information

• Full name
• Email address
• Telephone number
• Postal address, where required
• Date of birth or age, where necessary
• Emergency contact details, where appropriate

3.2 Appointment and Booking Information

• Requested treatments and services
• Appointment dates and times
• Booking history
• Consultation requests
• Appointment preferences
• Cancellation and rescheduling information

3.3 Health and Treatment Information

Where relevant to providing safe and appropriate treatments, we may collect:

• Medical history and relevant health conditions
• Allergies and medication information
• Previous cosmetic or aesthetic treatments
• Skin conditions and treatment concerns
• Consultation notes
• Treatment records and aftercare information
• Photographs taken for treatment assessment, monitoring or clinical records
• Consent forms and relevant medical declarations

Health information is classified as special category personal data under UK GDPR and receives additional protection.

We collect and use this information only where a valid legal basis and an applicable special category processing condition exist.

3.4 Payment Information

We may process information relating to:

• Treatment and course payments
• Deposits
• Transaction records
• Invoices and receipts
• Refunds

Where payments are handled by an external payment provider, that provider may process payment card information in accordance with its own privacy and security practices.

3.5 Website and Technical Information

When you visit our website, we may collect:

• IP address
• Browser type and version
• Device information
• Website usage information
• Pages visited
• Referral sources
• Cookie identifiers and preferences

3.6 Training and Course Information

If you enquire about or enrol in professional training, we may collect:

• Course enquiries and enrolment information
• Professional experience and relevant qualifications
• Training attendance records
• Assessment and certification information
• Communications relating to course participation

4. How We Collect Your Information

We may collect personal information when you:

• Complete a website enquiry or contact form
• Book an appointment online or by telephone
• Contact us through email, telephone or WhatsApp
• Attend a consultation or receive a treatment
• Complete a medical questionnaire or consent form
• Enrol in a professional training course
• Subscribe to marketing communications
• Interact with our website

We may also receive information from authorised booking providers, payment processors, training partners or other service providers where relevant and lawful.

5. How We Use Your Personal Information

We use personal information for the following purposes:

Appointment Management

To schedule, confirm, manage and communicate about appointments.

Treatment and Client Care

To assess treatment suitability, provide appropriate services, maintain treatment records and communicate aftercare instructions.

Customer Support

To respond to questions, requests, complaints and feedback.

Payments and Administration

To process transactions, manage invoices and maintain business records.

Training Services

To manage course enquiries, registrations, attendance, assessments and certification where applicable.

Website Operation

To maintain website functionality, security and performance.

Marketing Communications

To send promotional information, treatment updates or special offers where permitted by applicable law.

Legal and Regulatory Compliance

To comply with applicable legal obligations and respond to lawful requests.

6. Our Legal Bases for Processing Personal Data

Under UK GDPR, we rely on one or more of the following lawful bases, depending on the purpose of processing:

Contractual Necessity

Where processing is necessary to arrange or provide treatments, appointments or training services under a contract with you, or to take steps at your request before entering into a contract.

Legal Obligation

Where processing is required to comply with applicable legal or regulatory requirements.

Legitimate Interests

Where processing is necessary for our legitimate business interests, such as responding to enquiries, maintaining website security, preventing fraud or improving our services, provided those interests are not overridden by your rights and freedoms.

Consent

Where we ask for your consent for a particular purpose, such as certain marketing activities or optional use of photographs.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

7. Special Category Health Information

As an aesthetics and wellness clinic, we may need to process sensitive health-related information to assess treatment suitability and provide appropriate care.

We will process special category health information only where we have both an Article 6 lawful basis and a valid Article 9 condition under UK GDPR.

Depending on the circumstances, the relevant Article 9 condition may include:

• Explicit consent for a specified purpose; or
• Processing necessary for the provision of health care or treatment, where the applicable legal requirements and professional confidentiality safeguards are satisfied.

We will not assume that treatment consent automatically provides consent for unrelated uses of health information.

Access to sensitive treatment records is restricted to authorised individuals who require the information for legitimate purposes.

8. Photographs and Media Consent

Photographs may be taken where appropriate for treatment assessment, progress monitoring or clinical documentation.

Photographs forming part of treatment records will be handled as confidential personal information.

We will obtain appropriate separate permission before using identifiable client photographs, videos, testimonials or treatment results for advertising, social media, promotional materials or other optional publicity purposes.

You may withdraw consent for future consent-based promotional use by contacting us. Withdrawal may not be able to reverse all uses already lawfully completed or content independently retained by third-party platforms.

9. Cookies and Website Analytics

Our website may use cookies and similar technologies to support functionality, understand website performance and improve user experience.

These may include:

• Strictly necessary cookies required for website operation
• Analytics cookies used to understand website usage
• Functional cookies used to remember preferences
• Marketing cookies used to measure advertising performance, where applicable

Where required by UK law, we will obtain your consent before storing or accessing non-essential cookies or similar technologies on your device.

You may manage your cookie preferences through our website’s cookie controls, where available, or through your browser settings.

Further information about the cookies actually used by our website should be provided in our cookie information or cookie policy.

10. Marketing Communications

We may contact you with information about treatments, clinic services, training courses, offers or events where permitted under applicable UK marketing and privacy laws.

Where consent is required, we will obtain it before sending marketing communications.

Where another lawful marketing permission applies, we will comply with its conditions, including providing a clear opportunity to opt out.

You may unsubscribe from marketing emails using the unsubscribe link provided or contact us at info@nebrasclinic.co.uk.

Opting out of marketing will not prevent us from sending necessary appointment, treatment, payment or service-related communications.

11. Sharing Your Personal Information

We do not sell your personal information.

We may share relevant personal information with trusted third parties where necessary and lawful, including:

• Appointment and booking platform providers
• Payment processing providers
• Website hosting and technical support providers
• Email and communication service providers
• Authorised professionals involved in providing your treatment or care
• Training or accreditation organisations, where relevant
• Professional advisers
• Regulatory authorities or law enforcement agencies where legally required

We require service providers acting on our behalf to protect personal information and process it only in accordance with applicable contractual and legal requirements.

Some third parties may act as independent data controllers and have their own privacy policies.

12. International Data Transfers

Some technology or communication service providers may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we will ensure that an appropriate transfer mechanism and any necessary safeguards are in place, as required by UK data protection legislation.

These may include UK adequacy regulations, approved contractual safeguards or other lawful transfer arrangements.

You may contact us for further information about relevant international transfer safeguards.

13. How Long We Keep Your Information

We retain personal information only for as long as necessary for the purposes for which it was collected, including any applicable legal, clinical, accounting or regulatory requirements.

Retention periods depend on the type of information and the reason for processing.

For example:

• Enquiry records are retained for an appropriate period to manage and follow up on enquiries.
• Booking and transaction records are retained for relevant operational, accounting and legal purposes.
• Treatment and health records are retained in accordance with applicable professional, legal and clinical recordkeeping requirements.
• Training records are retained where necessary for course administration, certification and compliance.
• Marketing information is retained until you unsubscribe or another applicable retention criterion is met.

When information is no longer required, we will securely delete, anonymise or otherwise dispose of it in accordance with our retention procedures.

You may contact us for information about the retention period applicable to your personal data.

14. How We Protect Your Information

We take reasonable and appropriate technical and organisational measures to protect personal information against unauthorised access, accidental loss, misuse, alteration or disclosure.

These measures may include:

• Access controls
• Password protection
• Secure storage
• Staff confidentiality obligations
• Appropriate system security
• Restricted access to sensitive records
• Security monitoring and appropriate incident-response procedures

Although we take reasonable precautions, no internet transmission or electronic storage system can be guaranteed to be completely secure.

15. Your Data Protection Rights

Subject to applicable legal conditions and exemptions, you have the right to:

Access: Request a copy of the personal information we hold about you.

Rectification: Ask us to correct inaccurate or incomplete personal information.

Erasure: Request deletion of personal information in certain circumstances.

Restriction: Ask us to restrict the processing of your information in certain circumstances.

Objection: Object to certain processing activities, including direct marketing.

Data Portability: Request the transfer of eligible personal information in a structured, commonly used and machine-readable format.

Withdraw Consent: Withdraw consent where consent is the legal basis for processing.

Automated Decision-Making Rights: Exercise applicable rights relating to qualifying solely automated decisions.

Some rights are not absolute, particularly where information must be retained for lawful clinical, professional or regulatory purposes.

To exercise your rights, email info@nebrasclinic.co.uk.

We may request reasonable information to verify your identity before responding.

We will respond within the period required by applicable data protection law, normally one month, subject to lawful extensions.

16. Children’s Privacy

Our website and services are not intended to encourage children to provide personal information without appropriate safeguards.

Where a treatment or service is available to a person under 18, we will apply appropriate age, capacity, safeguarding and consent requirements.

We may require parental or guardian involvement where legally appropriate.

We do not knowingly use children’s personal information for unlawful marketing purposes.

17. Third-Party Websites and Services

Our website may contain links to third-party websites, social media platforms, booking services or payment providers.

These organisations may collect and process personal information under their own privacy policies.

We encourage you to review the relevant privacy notices before providing information to third parties.

We are not responsible for the privacy practices of independent third-party organisations.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, data processing practices or applicable law.

The latest version will be published on our website with an updated revision date.

Where required by law, we will provide additional notice of significant changes.

19. Complaints and Contact Information

If you have questions, concerns or complaints about how we handle personal information, please contact:

Nebras Clinic

22–24 Norland Road
London W11 4TR
United Kingdom

Email: info@nebrasclinic.co.uk

Telephone: +44 20 3411 3000

You also have the right to complain to the UK Information Commissioner’s Office (ICO), the independent regulator responsible for data protection.

Information Commissioner’s Office

Website: https://ico.org.uk/

We encourage you to contact us first so that we have an opportunity to address your concerns.