INJECTUAL LTD

PATIENT AND WEBSITE PRIVACY NOTICE

How we collect, use, share and protect personal information

1. About us and this Privacy Notice

This Privacy Notice is issued by Injectual Ltd (Injectual, we, us or our). We are a specialist medical aesthetics clinic providing consultations and non-surgical treatments, including injectable, laser, skin, hair-rejuvenation, body and gender-affirming services. We also sell skincare products and memberships through our clinics and website.

This Privacy Notice applies to current, prospective and former patients; website and online-shop users; people who contact or engage with us; and contractors, suppliers, partners, referrers and other individuals whose personal information we hold (you or your). It explains what information we collect, where it comes from, why and how we use it, who we share it with, how long we keep it and your rights.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable privacy and electronic-communications legislation (Data Protection Legislation). Injectual Ltd is the controller of personal data for the processing described in this notice.

Individual doctors, nurses, prescribers or other healthcare professionals may, in some circumstances, act as separate or joint controllers for aspects of your care. Where this applies, they may provide additional privacy information.

2. Contact details

Our Privacy Manager can be contacted at:

Email: info@injectual.com

Registered and postal address: Injectual Ltd, 59 Westbourne Grove, London, England, W2 4UA

Website: https://www.injectual.com

3. How we collect personal data

We collect personal data directly from you when you enquire, book, complete a medical or consent form, attend a consultation or treatment, buy a product or membership, contact us, provide feedback, make a complaint, enter a promotion, attend an event or interact with our website, online booking system, email, telephone, WhatsApp, SMS or social-media accounts.

We may also receive information from:

• a parent, carer, personal assistant, emergency contact or another person acting with your authority;
• your GP, consultant, prescriber, pharmacy, hospital, laboratory, insurer, referrer or other healthcare provider;
• practitioners who provide or support your care at an Injectual clinic;
• payment, finance, identity-verification, booking, website, communications and marketing providers;
• regulators, law-enforcement bodies, courts, professional advisers or insurers; and
• publicly available sources, where appropriate and lawful.

When we obtain personal data from someone other than you, we will provide privacy information within the period required by law unless an exemption applies.

4. Personal data we collect

4.1 Identity and contact data

This may include your name, former name, title, pronouns, date of birth, age, gender, gender identity, NHS number where relevant, address, email address, telephone number, emergency contact details, signature, photograph or video likeness and identification information.

4.2 Clinical and health data

This is special category personal data and may include:

• medical history, diagnoses, symptoms, allergies, contraindications, disabilities and family history;
• medications, prescriptions, previous procedures or treatments and treatment plans;
• consultation notes, assessments, clinical decisions, treatment parameters, products, devices, batch numbers and outcomes;
• test results, reports, referrals, correspondence with healthcare professionals and aftercare information;
• before-, during- and after-treatment photographs, video and other clinical images;
• information about complications, adverse events, incidents, safeguarding concerns or emergency care; and
• where relevant to safe, personalised or gender-affirming care, information concerning racial or ethnic origin, religious or philosophical beliefs, sex life, sexual orientation or gender identity.

4.3 Appointment, correspondence and complaint data

This may include booking history, attendance, cancellations, deposits, communications, call or message records, forms, enquiries, feedback, reviews, complaints, incident records, requests for support and your marketing preferences.

4.4 Financial, transaction and retail data

This may include payment and refund information, bank or card details processed through our payment providers, invoices, purchases, packages, memberships, gift cards, finance arrangements, order and delivery information and transaction history. We generally do not retain complete payment-card details ourselves.

4.5 Technical, usage and marketing data

This may include IP address, device and browser information, time zone, identifiers, website activity, referral source, cookie or similar-technology information, advertising interactions, communication preferences and responses to campaigns.

4.6 Supplier and professional-contact data

This may include business identity and contact details, role, organisation, correspondence, contract, payment and due-diligence information.

5. Why we use personal data and our lawful bases

We must have a lawful basis under Article 6 UK GDPR whenever we process personal data. Where we process special category data, including health information, we must also satisfy an Article 9 condition and relevant requirements under the Data Protection Act 2018.

5.1 Providing consultations, treatment and aftercare

We use information to register you, assess suitability and medical needs, discuss objectives and alternatives, obtain and record informed consent, plan and deliver treatment, prescribe where appropriate, monitor results, provide aftercare, respond to complications, coordinate care and maintain accurate clinical records.

Lawful bases: steps before and performance of our contract with you; compliance with legal and professional obligations; our legitimate interests in delivering and documenting safe care; and, where necessary, vital interests. For special category data, we principally rely on processing necessary for medical diagnosis, the provision or management of healthcare by or under the responsibility of a professional subject to confidentiality (Article 9(2)(h) UK GDPR and applicable provisions of the Data Protection Act 2018).

5.2 Clinical photography

We may take photographs or videos where reasonably necessary for assessment, treatment planning, patient identification, treatment records, monitoring, safety, quality assurance or the establishment or defence of legal claims. Clinical-record images are not used for advertising merely because they were taken for care.

Lawful bases: contract, legal obligation and legitimate interests; Article 9(2)(h) for healthcare and, where relevant, Article 9(2)(f) for legal claims.

5.3 Optional photography, education and promotion

We will obtain separate, specific permission before using identifiable patient photographs, videos, testimonials or treatment information for social media, our website, advertising, press, training, presentations, events, research or publications where consent is the appropriate basis. Declining promotional consent will not affect your care. You may withdraw consent for future use at any time, although withdrawal does not make previous lawful use unlawful and material already lawfully published or shared by others may not be fully retrievable.

Lawful bases: consent under Article 6(1)(a) and explicit consent under Article 9(2)(a), where special category data is involved.

5.4 Prescriptions, pharmacies and coordinated care

We may use and disclose relevant information to prescribers, pharmacies, laboratories, GPs, hospitals, emergency services, insurers or other healthcare professionals when necessary to provide, verify or coordinate safe care, dispense medication, address complications or meet legal or professional requirements.

Lawful bases: contract, legal obligation, legitimate interests or vital interests; Article 9(2)(h), and Article 9(2)(c) where you are physically or legally incapable of consenting and processing is necessary to protect vital interests.

5.5 Payments, orders, memberships and administration

We use information to take deposits and payments, fulfil orders, administer packages and memberships, issue invoices and refunds, prevent fraud, recover debts and maintain financial and business records.

Lawful bases: contract, legal obligation and legitimate interests.

5.6 Enquiries, reviews, complaints and legal matters

We use information to answer enquiries, seek and manage feedback, investigate complaints and incidents, respond to subject-rights requests, notify insurers, obtain professional advice and establish, exercise or defend legal claims.

Lawful bases: contract, legal obligation and legitimate interests; Article 9(2)(f) where special category data is necessary for legal claims and Article 9(2)(h) where relevant to healthcare governance.

5.7 Safety, governance and improvement

We may use information for clinical audit, practitioner supervision, training, quality and safety monitoring, stock and product traceability, infection control, adverse-event reporting, safeguarding, regulatory inspections and service improvement. Wherever reasonably possible, information used for wider analysis is anonymised or minimised.

Lawful bases: legal obligation and legitimate interests; Article 9(2)(h), Article 9(2)(f) or another applicable substantial-public-interest condition where required.

5.8 Marketing

We may send information about our treatments, products, events, memberships and offers where you have consented or where the electronic-marketing rules permit us to contact an existing customer about our own similar products or services. Every electronic marketing message will provide a simple way to unsubscribe. We maintain a limited suppression record so that we can respect opt-outs.

Lawful bases: consent or legitimate interests, as applicable. We also comply with the Privacy and Electronic Communications Regulations 2003 and do not rely on legitimate interests to override a requirement for consent.

5.9 Website, analytics and security

We use technical information to operate and secure our website and booking services, prevent fraud, understand performance and—where you have agreed—measure or personalise advertising. Further detail should be provided in our Cookie Policy and consent tool.

Lawful bases: legitimate interests, legal obligation and consent where non-essential cookies or similar technologies require it.

6. If you do not provide information

Where information is needed to assess suitability, provide treatment, dispense medication, fulfil an order, take payment or meet a legal or professional requirement, failure to provide accurate and complete information may mean that we cannot offer or continue the relevant service. You must tell us promptly if your medical or contact information changes.

7. Automated decision-making and profiling

We do not currently make decisions about your care using solely automated processing that produces legal or similarly significant effects. We may use limited website or marketing profiling where permitted and described through our cookie and marketing information. We will update this notice if our use of significant automated decision-making changes.

8. Sharing personal data

We only share personal data where necessary, proportionate and lawful. Recipients may include:

• our employed and self-employed clinicians, prescribers, managers and authorised staff;
• GPs, consultants, hospitals, emergency services, pharmacies, laboratories, referrers and other healthcare providers involved in your care;
• medical-device, medicine or product manufacturers where necessary for traceability, safety or adverse-event reporting;
• insurers, finance providers, banks, payment processors and debt-recovery providers;
• providers of patient-record, booking, clinical-imaging, e-prescribing, communications, cloud, IT-security, website, ecommerce, delivery, analytics and marketing services;
• professional advisers, including solicitors, accountants, auditors, consultants and insurance brokers;
• the CQC, ICO, HMRC, professional regulators, courts, law-enforcement and other public authorities where required or permitted; and
• a prospective purchaser, investor or successor in connection with a merger, financing, reorganisation or sale, subject to appropriate confidentiality and safeguards.
• Service providers acting as processors may only use personal data on our documented instructions, must protect it and are subject to contractual confidentiality and data-protection obligations. Where another organisation acts as an independent controller, its own privacy notice will also apply.

9. International transfers

Some technology, communications, ecommerce, clinical or marketing providers may process personal data outside the UK. Where we make a restricted transfer, we use a lawful transfer mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another permitted safeguard. We also assess and apply supplementary security measures where appropriate. You may contact us for further information about the relevant safeguards.

10. Data security and confidentiality

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, unauthorised access, use or disclosure. Access is limited according to role and need, and personnel and practitioners are subject to confidentiality duties. We maintain procedures for suspected personal-data breaches and will notify affected individuals and the ICO where the law requires.

11. How long we keep information

We retain information only for as long as necessary for the purpose for which it was collected and to meet clinical, legal, regulatory, insurance, tax, accounting and reporting requirements. Our current retention approach is generally:

• adult clinical records and associated clinical images: normally at least eight years after the conclusion of treatment, and longer where required by the nature of the treatment, an ongoing concern, professional guidance, insurer requirements or a potential claim;
• prescribing, medicine, device and product-traceability records: for the period required by applicable clinical, regulatory and manufacturer requirements;
• financial, tax and transaction records: normally six years after the end of the relevant financial period or transaction;
• enquiries that do not lead to treatment: normally up to two years after the last meaningful contact, unless a longer period is justified;
• complaints, incidents and legal-claim material: for the duration of the matter and the relevant limitation, regulatory or insurance period;
• marketing records: while you remain subscribed or while we may lawfully market to you; a minimal suppression record may be kept after opt-out; and
• promotional images and materials: while the relevant permission remains valid and the material is required, subject to withdrawal of consent for future use.

These periods may be extended where information is required for litigation, a regulatory investigation, safeguarding, public-health reporting or another legal obligation. We may securely anonymise information instead of deleting it where it can no longer identify you.

12. Your rights

Depending on the circumstances and subject to legal exemptions, you may have the right to:

• be informed about how we use your personal data;
• request access to your personal data;
• request correction of inaccurate or incomplete information;
• request erasure of information in certain circumstances;
• request restriction of processing;
• object to processing based on legitimate interests and object at any time to direct marketing;
• receive certain information in a structured, commonly used, machine-readable format and request transfer to another controller;
• withdraw consent at any time where we rely on consent; and
• challenge qualifying solely automated decisions and request human intervention.

These rights are not absolute. In particular, we may need to retain clinical records despite an erasure request where continued retention is required or permitted for healthcare, regulatory or legal purposes. We will normally respond to a valid request within one month, although the law allows an extension for particularly complex or numerous requests. We may ask for information to verify your identity.

To exercise a right, contact the Privacy Manager at info@injectual.com.

13. Cookies and similar technologies

Our website and booking or ecommerce services may use strictly necessary cookies and, with your consent where required, analytics, functionality and advertising cookies or similar technologies. Non-essential technologies should not be activated before the required consent is obtained. You can change or withdraw cookie choices through the website’s consent controls. A separate Cookie Policy should identify the technologies used, providers, purposes and durations.

14. Questions and complaints

We take privacy concerns seriously and would appreciate the opportunity to address them. Contact our Privacy Manager using the details in section 2.

You also have the right to complain to the Information Commissioner’s Office (ICO). Website: https://ico.org.uk/make-a-complaint/

Injectual Ltd’s ICO registration number is ZB643884.

15. Changes to this notice

We review this Privacy Notice regularly and may update it when our services, systems, suppliers or legal obligations change. The current version will be published on our website. Where a change materially affects how we use existing personal data, we will take reasonable steps to bring it to your attention before the new use begins.

Last updated: August 2026