1. Who We Are

Aesthetic Boutique is the trading name of UKSAFECARE. LTD, a company registered in England and Wales under company number 12588677.

UKSAFECARE. LTD operates Aesthetic Boutique and is the data controller responsible for determining how and why personal information is processed in connection with its aesthetic services.

Our treatments and consultations are provided by Oksana Vincent, an NMC Registered Nurse with specialist aesthetic training.

Our clinic is based at Changing Faces, 134 Fore Street, Exeter, EX4 3AN.

Full registered company information and contact details are provided in Section 17.

2. Information We May Collect

Depending on your interaction with Aesthetic Boutique, we may collect the following information.

Personal and Contact Information

• Full name

• Date of birth

• Email address

• Telephone number

• Address, where required

• Information provided through enquiries or correspondence

Booking and Appointment Information

• Appointment dates and times

• Treatments and consultations booked

• Booking and cancellation history

• Appointment reminders and communications

• Deposits, payments and transaction records

Medical and Clinical Information

Where necessary for safe assessment and treatment, we may collect:

• Relevant medical history and health conditions

• Current or recent medication

• Allergies

• Previous aesthetic treatments and complications

• Pregnancy or breastfeeding information, where relevant

• History of cold sores or other relevant infections

• Treatment suitability assessments

• Consultation and informed consent documentation

• Treatment details, products used and clinical notes

• Aftercare and follow-up records

• Clinical photographs, where appropriate

Medical and health information is classified as special category personal data and is subject to additional legal protections.

Website and Technical Information

When you visit our website, certain information may be collected, including your IP address, browser type, device information, pages visited and website usage information.

Some information may be collected through cookies or similar technologies, as explained in our Cookie Policy.

3. How We Use Your Information and Our Lawful Bases

We process personal information only where there is an appropriate lawful basis under Article 6 of the UK GDPR.

Different lawful bases may apply depending on the purpose of processing.

Appointments, Consultations and Treatments

We use your information to manage bookings, communicate about appointments, provide consultations, assess treatment options and deliver agreed services.

Our principal lawful basis is Article 6(1)(b) — processing necessary for a contract with you or to take steps at your request before entering into a contract.

Clinical Records and Professional Obligations

We maintain appropriate clinical documentation and relevant records to support safe care and comply with applicable legal and professional requirements.

Where processing is necessary to comply with a specific legal obligation, we rely on Article 6(1)(c).

Where appropriate, Article 6(1)(f) — legitimate interests — may apply to maintaining records necessary for patient safety, continuity of care, professional accountability or the establishment, exercise or defence of legal claims, subject to your rights and interests.

General Enquiries

We process contact details and messages to respond to enquiries, provide information and assist with booking decisions.

Depending on the circumstances, the lawful basis is Article 6(1)(b), where you request steps towards booking a service, or Article 6(1)(f), where responding to general enquiries is in our legitimate business interests.

Payments and Financial Records

We process transaction information to administer payments, deposits and refunds, and to meet applicable accounting and tax requirements.

The lawful basis may be Article 6(1)(b) or Article 6(1)(c), depending on the processing activity.

Website Security and Administration

We may process limited technical information for website functionality, security, fraud prevention and service administration.

Where appropriate, we rely on Article 6(1)(f) — our legitimate interests in operating and protecting our website and business.

Marketing Communications

We will send direct marketing communications only where permitted by applicable data protection and electronic marketing laws.

Where we rely on consent, our lawful basis is Article 6(1)(a). You may withdraw that consent at any time.

We do not use medical history or confidential clinical records to select individuals for promotional marketing.

4. Medical Information and Patient Confidentiality

As a nurse-led aesthetic clinic, we collect relevant health information to determine whether treatment is appropriate and to provide safe, professional care.

Health information is special category data under Article 9 of the UK GDPR.

Where applicable, we process information necessary for the provision of healthcare or treatment under Article 9(2)(h), together with Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018.

This condition applies where its legal requirements are satisfied, including processing by, or under the responsibility of, a professional subject to an appropriate duty of confidentiality.

Where this condition does not apply, another valid Article 9 condition, such as explicit consent under Article 9(2)(a), must be established before the relevant processing takes place.

Consent to undergo an aesthetic procedure is separate from consent used as a lawful basis for processing personal data.

Your medical information is treated as confidential and is accessed or disclosed only where appropriate, necessary and lawful.

You must provide information necessary to assess treatment suitability. If essential information is unavailable, treatment may need to be postponed or declined.

Please do not submit detailed medical information through our general website enquiry form. Medical information required for treatment will be requested through our clinical assessment and documentation process.

5. How We Obtain and Manage Your Information

We may collect information directly from you when you:

• Complete an online enquiry

• Book through Fresha

• Complete medical or consent forms through Faces Consent

• Attend a consultation or treatment

• Provide medical information during assessment

• Contact us by email, telephone or other communication channels

• Communicate with us regarding aftercare or follow-up

We use the following services as part of our business operations.

Fresha — Appointment Management

Fresha is used to manage appointments, bookings, client contact details, reminders and relevant payment or booking information.

Fresha may act as a data processor on our behalf for certain booking information and as an independent data controller for some of its own platform activities.

Faces Consent — Clinical Documentation

Faces Consent is used to support medical questionnaires, clinical consultation and consent documentation, treatment records and related clinical administration, as applicable to the services we use.

Information entered into Faces Consent may include confidential health and treatment information.

Hostinger — Website Services

Hostinger provides our website hosting and associated services. Personal information may be processed through website enquiries, technical logs and related website functions.

We may also receive information through relevant payment, prescribing or professional service providers where necessary and lawful.

6. Sharing Your Information

We do not sell your personal or medical information.

We share information only where there is an appropriate purpose and lawful basis.

Relevant recipients may include:

• Fresha, for appointments, booking management and related services

• Faces Consent, for clinical documentation and consent management

• Hostinger, for website hosting and associated technical services

• Payment processors, for payment administration

• Email and communication service providers

• Prescribing professionals or pharmacies, where clinically necessary

• Professional indemnity insurers and legal advisers, where appropriate

• Other healthcare professionals, where necessary and lawful

• Regulatory bodies or public authorities, where disclosure is legally required

Only information reasonably necessary for the relevant purpose should be shared.

Where external providers act as processors on our behalf, their handling of personal information is subject to applicable contractual and data protection requirements.

Some providers may also act as independent data controllers for their own purposes, in which case their privacy notices explain those activities.

7. Email, Appointment Reminders and Marketing

We may contact you by email, telephone or other appropriate communication methods regarding:

• Appointment confirmations and reminders

• Consultation arrangements

• Treatment information

• Relevant medical or consent documentation

• Aftercare and follow-up

• Responses to enquiries

• Important changes to appointments or services

These are service communications and are separate from promotional marketing.

We may occasionally provide information about new treatments, services or special offers where we have a lawful basis and comply with applicable electronic marketing rules.

You may opt out of direct marketing at any time by contacting us or using an unsubscribe option where available.

Opting out of marketing will not prevent necessary communications concerning appointments, treatment or patient safety.

8. Clinical Photographs and Consent

Clinical photographs may be taken where appropriate to document treatment, assess progress and support professional clinical records.

These photographs are treated as confidential information.

Photographs will not be used for website galleries, social media, advertisements or other promotional purposes without separate, informed permission.

Consent for promotional use is voluntary and is not a condition of receiving treatment.

Where we rely on consent for promotional image processing, you may withdraw that consent at any time. Withdrawal will apply to future processing but may not reverse publication or use already completed lawfully.

Where withdrawal is requested, we will take appropriate steps to stop further promotional use and remove images from channels we control where reasonably practicable and legally required.

Clinical photographs required for legitimate treatment records may need to be retained independently of promotional consent.

9. Security of Your Personal Information

Aesthetic Boutique takes reasonable and appropriate technical and organisational measures to protect personal information from unauthorised access, misuse, disclosure, alteration, loss or destruction.

We use professional service providers for booking management, website hosting and clinical documentation.

Appropriate confidentiality arrangements, access restrictions, security controls and data protection safeguards are required for the processing of personal information.

Access to clinical information is restricted to those with a legitimate need to access it.

Although appropriate safeguards are used, no electronic storage or communication system can be guaranteed to be completely free from security risks.

10. How Long We Keep Your Information

We retain personal information only for as long as necessary for the purposes for which it was collected and to meet applicable legal, clinical, professional, insurance and financial requirements.

Different categories of information are subject to different retention criteria.

Clinical and Treatment Records

Clinical records, including medical histories, consultation notes, consent records, treatment documentation and clinical photographs, are retained according to the applicable clinical record retention requirements, professional obligations, insurance conditions and any relevant legal limitation periods.

Appointment and Booking Records

Booking information is retained for as long as necessary to manage appointments, resolve disputes, administer financial transactions and meet relevant legal obligations.

Financial Records

Financial records are retained for the applicable accounting and tax retention periods.

General Enquiries

Information relating to enquiries that do not lead to treatment is retained only while reasonably necessary to respond, manage subsequent correspondence or resolve relevant issues.

Marketing Information

Marketing contact information is retained while a valid lawful basis exists and is reviewed when consent is withdrawn or marketing preferences change.

When personal information is no longer required, it is securely deleted, anonymised or otherwise disposed of where appropriate and lawful.

11. Your Data Protection Rights

Under UK data protection legislation, you may have the right to:

• Be informed about how your information is used

• Request access to your personal information

• Request correction of inaccurate information

• Request erasure in certain circumstances

• Request restriction of processing in certain circumstances

• Object to certain processing, including direct marketing

• Request data portability where applicable

• Withdraw consent where processing is based on consent

These rights are subject to applicable legal conditions and exceptions.

For example, some clinical information may need to be retained despite a request for deletion where a valid legal basis for continued retention applies.

To exercise your rights, please contact us using the details in Section 17.

We may need to verify your identity before responding to a request.

12. Cookies and Website Technologies

Our website uses, or may use, cookies and similar technologies to enable website functionality, maintain security, improve usability and understand website activity.

Some cookies may be associated with third-party services.

Non-essential cookies will only be used where an appropriate legal basis and any required consent have been obtained.

You can find further information about the cookies used on our website and how to manage your preferences in our Cookie Policy.

13. Third-Party Services and International Data Transfers

Aesthetic Boutique uses third-party services, including Fresha, Faces Consent and Hostinger.

These providers may process information using infrastructure or authorised service providers located within or outside the United Kingdom.

Fresha

Fresha's published privacy and data protection information explains that some personal information may be transferred internationally for service delivery, storage or support.

Hostinger

Hostinger's published privacy and contractual information describes processing in several jurisdictions and arrangements for international transfers.

Faces Consent

Faces Consent's practitioner terms include conditions concerning the transfer of patient information outside the UK, including contractual safeguards and relevant practitioner authorisation.

Where personal information is transferred outside the UK, applicable data protection requirements must be met. Depending on the destination and circumstances, this may involve UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or other legally recognised mechanisms.

Where applicable, we will ensure that the required safeguards and contractual arrangements are in place.

You may contact us for further information about relevant international transfers and the safeguards applicable to your personal information.

Third-party providers may also operate under their own privacy policies where they act as independent data controllers.

14. Children and Young People

Our services are intended primarily for adults.

We do not knowingly collect personal information from children except where lawful, necessary and appropriate for a service that we are legally permitted to provide.

Where information concerning a young person is processed, applicable legal, professional, safeguarding and consent requirements must be observed.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our business operations, clinical services, technology, third-party providers or legal obligations.

The latest version will be published on this website with its updated revision date.

Where required by law, we will provide additional notice of significant changes affecting how personal information is processed.

16. Complaints

If you have concerns about how your personal information is handled, please contact Aesthetic Boutique so that we can investigate and respond.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: https://ico.org.uk

17. Contact Us and Registered Company Details

For questions about this Privacy Policy, the processing of your personal information or requests to exercise your data protection rights, please contact:

Trading Name: Aesthetic Boutique

Registered Company: UKSAFECARE. LTD

Company Registration Number: 12588677

Registered in: England and Wales

Registered Office: 18 Kestor Drive, Exeter, Devon EX4 2NH United Kingdom

Clinic Address:
Aesthetic Boutique at Changing Faces
134 Fore Street
Exeter
EX4 3AN
United Kingdom

Email: aestheticboutique.uk@gmail.com

Telephone: 07446 360480

Website: https://aestheticboutique.uk

Consultations and treatments are strictly by appointment.

We are committed to respecting your privacy, maintaining patient confidentiality and handling personal information responsibly in accordance with applicable data protection legislation.

Privacy Policy

Aesthetic Boutique - Last updated: September 2026

At Aesthetic Boutique, protecting your privacy and maintaining the confidentiality of your personal and medical information are essential parts of the care we provide.

This Privacy Policy explains how we collect, use, store, share and protect your information when you visit our website, make an enquiry, book an appointment, attend a consultation or receive treatment.

We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable legal and professional requirements.