Privacy Notice
1. Who we are
Asthetik London Ltd, trading as Asthetik London (“we”, “us”, “our”), is the data controller responsible for your personal data. We handle your personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
- Address: Clinic (trading) address: 27 Chepstow Corner, Chepstow Place, Notting Hill, London, W2 4XE. Registered office: Asthetik London Ltd, 8 Myers Court, Reynard Way, Brentford, TW8 9GD.
- Email: info@asthetiklondon.com
- Phone: 0203 751 5122
- ICO registration number: 13984168
- Data Protection Officer / data contact: James Bayne info@asthetiklondon.com
2. The personal data we collect
We collect and process the following categories of personal data:
- Identity and contact details: name, date of birth, address, email address, telephone number.
- Health data (special category data): medical history, treatment records, clinical notes, images, test results and any information relating to your care.
- Appointment and administrative data: booking details, correspondence, enquiries and communications with us.
- Financial data: payment and billing information.
We collect this data directly from you, and sometimes from other healthcare providers involved in your care.
3. How and why we use your data
We only use your personal data where the law allows. We rely on the following:
- To provide your care and treatment. Lawful basis: Article 6(1)(b) or (e) UK GDPR. Health data condition: Article 9(2)(h) — provision of health care and treatment.
- To manage appointments, respond to enquiries and run the clinic efficiently. Lawful basis: Article 6(1)(b) and/or legitimate interests under Article 6(1)(f).
- To meet legal and regulatory obligations. Lawful basis: Article 6(1)(c); health data condition Article 9(2)(h) or 9(2)(i) where relevant.
- For billing and payment. Lawful basis: Article 6(1)(b) and (c).
Where we rely on consent for a specific use, we will ask for it separately and you may withdraw it at any time.
4. Use of artificial intelligence (AI) tools
We use an AI-assisted administrative tool (provided by Anthropic, the maker of Claude) to help us run the clinic efficiently — for example, to help organise our inbox, draft administrative replies, summarise correspondence and create to-do lists. This tool operates under a data processing agreement and does not use your data to train AI models. Any use of AI that involves your personal data is carried out under appropriate contractual safeguards, remains under our control, and is subject to human review.
5. Who we share your data with
We use carefully selected third-party service providers (“processors”) who act on our instructions under written contracts. These currently include:
- HealSuite — our patient record and practice management system, used to store and manage clinical and administrative records.
- Google (Google Workspace — Gmail and Google Calendar) — used for email correspondence and appointment scheduling.
- Anthropic (Claude) — our AI-assisted administrative tool, as described in section 4.
- Ryft — our payment processor, used to process payments and manage billing.
- IONOS — our website hosting provider, which processes enquiries submitted through our website.
We may also share your data, where necessary and lawful, with other healthcare professionals involved in your care, our regulators, and other parties where required or permitted by law.
6. Our website and cookies
When you use our website, we may collect data in the following ways:
- Enquiry forms: if you submit an enquiry through our website, we collect the details you provide (such as your name, email address and the content of your message) in order to respond to you. Lawful basis: Article 6(1)(b) to respond to your request, and/or legitimate interests under Article 6(1)(f).
- Cookies and similar technologies: our website uses cookies. When you first visit, our cookie banner lets you accept or decline non-essential cookies. Essential cookies that make the site work do not require consent; non-essential cookies (such as analytics) are only used where you have agreed.
- Analytics and site security: we use Google Analytics to understand how our website is used, and Google reCAPTCHA and Google Fonts to keep the site secure and display it correctly. These Google services may process technical data such as your IP address. Google’s privacy policy is available at policies.google.com/privacy.
You can manage or delete cookies through your browser settings at any time. Blocking some cookies may affect how the website works.
7. International transfers
Some of our processors are based outside the UK, or may process data outside the UK. Where personal data is transferred internationally, we ensure an appropriate safeguard is in place — such as the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses — so that your data receives an equivalent level of protection. Details of the specific safeguards are available on request.
8. How long we keep your data
We keep your records only for as long as necessary. Clinical records are retained in line with professional and legal retention requirements; adult records for a minimum of 10 years after the last treatment. Administrative and financial records are kept for the periods required by law.
9. Your rights
Under data protection law you have the right to:
- be informed about how we use your data;
- access the personal data we hold about you;
- request correction of inaccurate data;
- request erasure in certain circumstances;
- restrict or object to certain processing;
- data portability in certain circumstances;
- withdraw consent where we rely on it.
To exercise any of these rights, please contact us using the details in section 1.This policy was last updated on 9 Oct 2026