Skip to content

Privacy Policy

This Privacy Policy explains how Dr. Alexis Granite (referred to as 'we', 'us', or 'our') collects, uses, stores, and protects your personal and healthcare data. As a specialist medical aesthetics and dermatology clinic, we process 'Special Category Data' concerning your health. We are committed to safeguarding your privacy in strict accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the standards required by the Information Commissioner's Office (ICO).

1. Data controller & ICO registration

Dr. Alexis Granite is the Data Controller responsible for your personal data. We are registered with the Information Commissioner's Office (ICO) under registration number ZA814065. If you have any questions about this policy or how we handle your data, please contact our Data Protection Lead via email at: [email protected].

2. Types of data we collect

We collect and process various categories of data to provide safe, effective clinical treatments and business services:

  • Personal Identification & Contact Data: Full name, date of birth, gender, home address, email address, and phone number.
     
  • Special Category Health Data: Comprehensive medical history, current medications, allergies, previous aesthetic treatments, and skin conditions necessary for clinical diagnosis and safe treatment execution.
     
  • Clinical Photography & Imaging: Before-and-after baseline photographs of treatment areas to track clinical progress and serve as a necessary part of your medical chart.
     
  • Video & Audio Data (Virtual Consultations): Remotely hosted video calls used for remote skin consultations, triaging, or follow-ups.
     
  • CCTV Imagery: Closed-circuit television footage recorded in our public areas (such as entryways and corridors) for security and safety purposes.
     
  • Financial Data: Credit/debit card billing details, deposit transactions, and payment history processed securely via our payment gateways.

3. Legal bases for processing your data

Under the UK GDPR, we must have a valid lawful basis for every processing activity. We rely on the following:

  • Provision of Healthcare (Special Category Data): For your medical history, diagnosis, and treatment charts, we process data under Article 6(1)(b) (necessary for a contract) and Article 9(2)(h) of the UK GDPR (the provision of health or social care treatment by regulated health professionals). Consent is not required to maintain your clinical record.
     
  • Explicit Consent: We rely on your freely given, explicit opt-in consent for non-clinical actions, including sending marketing updates, utilizing WhatsApp for communication, and publishing anonymised before-and-after photographs on our social media or website.
     
  • Legal Obligation: To comply with statutory requirements, such as maintaining medical records for mandatory retention periods, tax reporting, or public health directives.
     
  • Legitimate Interests: For operating CCTV cameras to protect clinic security, staff safety, and prevent fraud.

4. How your data is shared

We strictly maintain clinical confidentiality. Your data is never sold, rented, or exchanged with third parties. It is only shared with trusted partners essential to your care and our operations, including: authorized treating practitioners working with Dr. Alexis Granite; our secure, GDPR-compliant Electronic Medical Record (EMR) software platform; prescribing pharmacies (for prescription-only treatments like botulinum toxin); and secure payment processors. All third-party systems are contractually bound to uphold medical-grade data security.

5. Data retention & storage periods

As an aesthetics and dermatology clinic, your records are managed under medical record retention standard operating procedures. In accordance with UK health records best practices, your medical history, treatment charts, and clinical photographs will be retained securely for a minimum of 8 years from the date of your last treatment. For minors, records are kept until their 26th birthday. CCTV footage is automatically overwritten every 30 days unless required for an active safety incident investigation.

6. Your data protection rights

Under data protection law, you possess several key rights regarding your information:

  • Right of Access (Subject Access Request): You have the right to request a free copy of your medical charts and personal records.
     
  • Right to Rectification: You can request that we immediately correct any inaccurate or incomplete personal or medical information.
     
  • Right to Erasure ('Right to be Forgotten'): You can request the deletion of your data. Please note: This right does not override our statutory legal obligation to retain medical treatment records for the mandatory 8-year clinical retention period. Deletion applies primarily to marketing lists.
     
  • Right to Withdraw Consent: For marketing emails, SMS, WhatsApp alerts, or social media photo usage, you can instantly withdraw your consent at any time without penalty.

7. How to complain

If you believe Dr. Alexis Granite has mishandled your data, please contact our clinic directly so we can resolve your concern. You also retain an absolute right to lodge a formal complaint at any time with the Information Commissioner's Office (ICO) via their website at ico.org.uk or by calling 0303 123 1113.