Privacy Policy

Harry Morley Skin Clinic ("we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website [https://harry-morley.co.uk/] or use our services. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all other applicable privacy and data protection laws.

By accessing or using our services, you consent to the practices outlined in this Privacy Policy.

1. Information We Collect

We may collect and process the following categories of personal data:

a) Personal Identification Data:

• Full name

• Date of birth

• Gender

• Address

• Email address

• Phone number

b) Health and Treatment Data:
When you book a consultation or treatment with us, we may collect sensitive data regarding your:

• Medical history

• Skin condition(s)

• Current medications

• Allergies and sensitivities

• Photographs (before and after treatment)

c) Transaction Data:

• Payment card details (processed securely via third-party payment processors)

• Billing address

• Transaction history

d) Technical and Usage Data:

• IP address

• Browser type and version

• Time zone setting and location

• Device information

• Pages visited and interaction data

• Referral source (e.g., how you found our site)

e) Marketing and Communication Data:

• Your preferences for receiving marketing emails or offers

• Feedback or responses provided via surveys and forms

2. How We Use Your Information

We use your personal data for the following lawful purposes:

• To schedule and manage your consultation or treatment appointments

• To provide personalised skincare and treatment plans

• To manage payments and billing processes

• To respond to enquiries, messages, or requests submitted via our website or by email

• To send appointment reminders, aftercare instructions, or other essential service communications

• To manage client records in accordance with medical and professional standards

• To comply with legal and regulatory requirements

• To improve our website, services, and user experience through analytics

• To send you marketing offers and updates (only if you have given consent)

We do not sell, rent, or trade your personal data to any third parties.

3. Legal Basis for Processing

Under UK GDPR, the lawful bases we rely on for processing personal data include:

• Consent – where you have explicitly agreed to receive marketing communications or allow us to use certain cookies

• Contract – where processing is necessary to provide you with our treatments or manage bookings

• Legal obligation – where we are required to retain health records under regulatory standards

• Legitimate interests – for service improvement, business operations, or communications directly related to your care

4. How We Store and Secure Your Data

Your data is stored securely in our clinic’s systems, including electronic practice management software, with appropriate security protocols in place.

We take the following steps to safeguard your data:

• Access to client records is restricted to authorised personnel only

• Password protection and encrypted systems are in place

• Payment information is handled by secure, PCI-compliant third-party providers

• We conduct regular reviews of our security procedures and staff training

All sensitive health information is stored in line with the UK Data Protection Act 2018 and retained only as long as necessary for medical and legal compliance.

5. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes we collected it for, including satisfying any legal, accounting, or medical requirements.

Typically:

• Medical records: Retained for at least 10 years in line with professional standards

• Transaction and booking records: Retained for up to 7 years for tax and audit compliance

• Marketing preferences: Retained until you withdraw consent

You have the right to request deletion of your data, subject to our legal and regulatory obligations.

6. Sharing Your Data

We may share your information with trusted third parties only when necessary:

• Medical professionals or specialists (with your consent)

• Payment service providers (e.g., Stripe, Square)

• Email marketing platforms (e.g., Mailchimp, only with opt-in consent)

• IT and website service providers who maintain our systems

All third-party providers are required to comply with data protection laws and are contractually obligated to keep your data secure and confidential.

7. Your Data Protection Rights

Under the UK GDPR, you have the following rights:

• Right to access – You can request a copy of the personal data we hold about you

• Right to rectification – You can ask us to correct any inaccurate or incomplete data

• Right to erasure – You can request deletion of your data under certain conditions

• Right to restrict processing – You may request we pause processing your data

• Right to data portability – You can request your data be transferred to another provider

• Right to object – You may object to our use of your data for direct marketing

• Right to withdraw consent – You can withdraw your consent at any time for marketing or optional processing

To exercise any of these rights, please contact us using the details below.

8. Cookies and Website Tracking

Our website uses cookies to enhance your browsing experience and collect usage data for analytics. Cookies are small text files placed on your device.

We use:

• Essential cookies – for core site functionality

• Analytics cookies – to monitor site performance (e.g., Google Analytics)

• Marketing cookies – for retargeting ads (only with consent)

When you first visit our website, a cookie banner will request your consent to use non-essential cookies. You can manage or withdraw cookie consent at any time through your browser settings.

9. Marketing and Communications

If you have opted in, we may contact you with news, promotions, or skincare tips by email or SMS. You may unsubscribe from these communications at any time by:

• Clicking the “unsubscribe” link in any marketing email

• Contacting us directly at: [email protected]

We will never send marketing messages without your prior consent.

10. Third-Party Links

Our website may contain links to other websites or social media platforms. Please be aware that once you leave our site, we are not responsible for the privacy practices of those websites. We encourage you to read the privacy policies of each external site you visit.

11. Children’s Privacy

Our website and services are not intended for children under the age of 18. We do not knowingly collect personal information from minors. If you believe we may have collected data about a child, please contact us immediately so we can remove it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law or improvements in how we handle your data. Any changes will be posted on this page with the updated revision date.

We encourage you to check this page periodically for updates.

13. Contact Us

If you have any questions about this Privacy Policy, your personal data, or wish to make a complaint or data access request, you can contact us:

Harry Morley Skin Clinic
Email: [email protected]
Website: https://harry-morley.co.uk