Privacy Policy

1. Data Controller Information

Jo Ferriday Aesthetics operates as a registered nurse-led medical aesthetics clinic in Barry, South Wales, UK. In accordance with the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, Jo Ferriday Aesthetics is the Data Controller responsible for your personal data.

2. Information We Collect

As a medical aesthetic practice governed by the Nursing and Midwifery Council (NMC) and Save Face accreditation standards, we collect several categories of information to ensure safe, lawful clinical treatment:

• Personal Identifiers: Name, date of birth, postal address, email address, and phone number.
• Medical & Clinical Data: Medical history, current medications, allergies, previous aesthetic treatments, health conditions, and treatment consultation records.
• Clinical Photography: Standardized pre- and post-treatment photographs required for clinical documentation, treatment planning, and safety audit.
• Financial Information: Payment details and transactional records for services rendered.
• Technical & Analytics Data: IP address, browser type, and interactions with our website when submitting booking forms or inquiries.

3. Lawful Basis for Processing

We process your personal and medical information under the following legal bases:

• Contractual Necessity: To fulfill consultations, treatment appointments, and clinical follow-up care.
• Legal & Regulatory Obligations: Compliance with UK healthcare regulations, NMC professional codes, and medical record retention laws.
• Explicit Consent: For marketing communications or explicit agreement to share anonymized before-and-after photographs for educational/portfolio purposes (which is entirely optional).
• Special Category Data (Health Data): Processed under Article 9(2)(h) of UK GDPR for healthcare provision and clinical diagnosis by a registered healthcare professional bound by clinical confidentiality.

4. How We Use Your Information

Your data is strictly utilized for:

• Conducting medical consultations, prescribing appropriate treatments, and providing clinical procedures safely.
• Sending appointment confirmations, pre-treatment instructions, and aftercare guidance.
• Maintaining accurate, confidential patient medical records.
• Responding to inquiries submitted through our website or contact form.
• Improving our website performance and client care standards.

5. Data Sharing & Confidentiality

We treat all medical records with strict professional confidentiality. Your personal information is never sold or leased to third parties. Data may only be shared under the following conditions:

• Medical Prescribers & Emergency Services: Where necessary for issuing prescriptions or managing acute clinical emergencies.
• Secure Practice Management Systems: Encrypted digital software used for secure clinical scheduling and record management.
• Legal Requirement: When compelled by law, court order, or regulatory bodies (e.g. Save Face, NMC, or public health authorities).

6. Data Security & Retention

We store medical records and personal data using industry-standard encryption and physical security measures. In accordance with UK medical record guidelines, clinical records are retained for a minimum of 7 to 10 years following your last treatment, after which they are securely destroyed or permanently anonymized.

7. Your Rights Under UK GDPR

You possess the following rights regarding your data:

• Right of Access: Request a copy of your medical and personal records held by us (Subject Access Request).
• Right to Rectification: Request correction of inaccurate or incomplete information.
• Right to Erasure: Request deletion of non-medical data (subject to legal record-keeping obligations).
• Right to Restrict Processing: Request restrictions on how your data is processed.
• Right to Withdraw Consent: Withdraw consent for marketing or photographic consent at any time.

To exercise any of these rights, please contact Jo Ferriday via email at hello@joferriday.co.uk.

8. Cookies Policy

Our website uses essential cookies necessary for site functionality and security, alongside basic analytical cookies to evaluate site traffic and user experience. You can modify your browser settings to decline cookies if preferred.

9. Complaints & ICO Contact

If you have concerns about how your data is handled, please contact us first so we can address your inquiry. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.