Privacy Policy

Dr. Arshi Baig Aesthetic Medicine ("we", "us", "our") is the data controller responsible for your personal data. We are registered with the Information Commissioner's Office (ICO) and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Contact details: - Data Controller: Dr. Arshi Baig - Email: info@arshibaig.com - Address: Harley Street, London, W1G - ICO Registration: Available upon request

We may collect and process the following categories of personal data: Identity Data: Full name, title, date of birth, gender. Contact Data: Email address, telephone number, postal address. Health Data (Special Category): Medical history, treatment records, consultation notes, photographs (before/after), prescriptions, allergies, and current medications. Financial Data: Payment card details (processed securely via our payment provider), invoices, transaction history. Technical Data: IP address, browser type, device information, cookies, and usage data when you visit our website. Communication Data: Records of correspondence, feedback, reviews, and complaints. Consent Records: Your data processing and marketing consent preferences with timestamps.

We process your personal data on the following lawful bases under UK GDPR: Contract (Article 6(1)(b)): To provide aesthetic treatments, manage appointments, process payments, and deliver aftercare. Legitimate Interests (Article 6(1)(f)): To improve our services, maintain security, prevent fraud, and respond to enquiries. Consent (Article 6(1)(a)): For marketing communications, non-essential cookies, and sharing before/after photographs. Legal Obligation (Article 6(1)(c)): To comply with healthcare regulations, tax obligations, and safeguarding requirements. Vital Interests (Article 6(1)(d)): In medical emergencies where you cannot give consent. For special category health data, we rely on Article 9(2)(h) - processing necessary for healthcare purposes, and where applicable, your explicit consent.

Our website uses cookies in compliance with the Privacy and Electronic Communications Regulations 2003 (PECR): Essential Cookies: Required for the website to function (session management, security, cookie preferences). These cannot be disabled. Analytics Cookies: Help us understand how visitors use our website. Data is anonymised. These are only set with your consent. Marketing Cookies: Used to deliver relevant content and measure campaign effectiveness. Only set with your consent. You can manage your cookie preferences at any time using the cookie settings banner at the bottom of our website, or by adjusting your browser settings. Note that disabling essential cookies may affect website functionality.

We may share your personal data with: Healthcare Professionals: Other medical practitioners involved in your care (with your consent), including pharmacies for prescriptions. Service Providers: Our clinic management platform (PICANSE), payment processors, email service providers, and IT support - all bound by data processing agreements. Legal and Regulatory Bodies: The GMC, ICO, HMRC, or law enforcement where legally required. We do not sell your personal data. We do not transfer your data outside the United Kingdom. All our data processors are UK-based or have appropriate safeguards in place.

We retain your personal data only for as long as necessary: Medical Records: 10 years from your last treatment (in line with NHS and GMC guidance, or longer for minors). Financial Records: 7 years (HMRC requirements). Marketing Consent: Until you withdraw consent. Website Analytics: 26 months (anonymised). CCTV (if applicable): 30 days. After the retention period, your data is securely deleted or anonymised.

Under UK GDPR, you have the following rights: Right of Access (Article 15): Request a copy of your personal data. We will respond within 30 days. Right to Rectification (Article 16): Request correction of inaccurate data. Right to Erasure (Article 17): Request deletion of your data (subject to legal retention requirements). Right to Restrict Processing (Article 18): Request we limit how we use your data. Right to Data Portability (Article 20): Receive your data in a machine-readable format. Right to Object (Article 21): Object to processing based on legitimate interests or direct marketing. Right to Withdraw Consent: Where processing is based on consent, withdraw at any time without affecting lawfulness of prior processing. Rights related to automated decision-making: We do not use automated decision-making or profiling. To exercise any of these rights, contact us at info@arshibaig.com or use the Data Rights section in your Patient Portal. If you have a portal account, you can download your data, submit rectification requests, and manage consent preferences directly.

We implement appropriate technical and organisational measures to protect your data: - All data is encrypted in transit (TLS/SSL) and at rest. - Access to patient data is restricted to authorised staff on a need-to-know basis. - Role-based access controls and audit logging are enforced across our systems. - Staff receive regular data protection training. - We maintain a data breach response procedure and will notify the ICO within 72 hours of becoming aware of a qualifying breach.

We do not knowingly provide aesthetic treatments to individuals under 18 without parental/guardian consent and appropriate clinical assessment. Where we treat patients under 18, we obtain explicit consent from a parent or guardian and retain records in accordance with extended retention periods.

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated effective date. For significant changes, we will notify you via email or a notice on our website.

If you are unhappy with how we handle your data, please contact us first at info@arshibaig.com. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): Website: ico.org.uk Telephone: 0303 123 1113 Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF