Privacy Policy

Oriah Clinics Ltd is a medical aesthetics clinic operating across the United Kingdom and Channel Islands.

Oriah Clinics Ltd is responsible for the personal information collected and processed in connection with our services.

• Company: Oriah Clinics Ltd
• Registered Address: 3 Newbold Road, Rugby CV21 2LQ
• Email: support@oriah.co.uk

We process personal information in accordance with applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and relevant data protection legislation in Jersey and Guernsey.

We may collect and process the following information:

• Personal information: Name, date of birth, address, telephone number and email address.
• Appointment information: Booking details, consultation history, treatment preferences and correspondence.
• Medical information: Medical history, medications, allergies, consultation assessments, treatment records, consent forms and aftercare information.
• Treatment photographs: Images taken for clinical assessment, treatment planning and monitoring results.
• Payment information: Transaction records and payment details associated with our services.
• Website information: Technical information collected through cookies and similar technologies.

Medical information is classified as sensitive personal data and is handled with additional safeguards.

We collect and use personal information to:

• Respond to enquiries and manage appointments.
• Assess treatment suitability and provide safe, appropriate care.
• Maintain accurate medical and treatment records.
• Provide aftercare advice and follow-up support.
• Process payments and manage treatment courses, packages and memberships.
• Respond to patient feedback, concerns and complaints.
• Meet our legal, regulatory and professional obligations.
• Send clinic news, updates and marketing communications where permitted.

We process personal information under appropriate lawful bases, including the performance of a contract, compliance with legal obligations, legitimate interests and consent where required.

Medical and health information is processed only where an additional legal condition for handling sensitive information applies, including, where appropriate, the provision of healthcare by professionals subject to confidentiality obligations.

We may share your personal information with trusted third-party service providers where necessary to deliver our services and operate the clinic. These may include:

• Authorised practitioners and administrative personnel.
• Secure patient management and appointment booking systems.
• Payment processing providers.
• Website, IT and communication service providers.
• Other healthcare professionals involved in your care, where appropriate.
• Professional advisers, insurers or regulatory authorities where necessary or legally required.

We only share information necessary for the relevant purpose and require appropriate confidentiality and data protection safeguards.

We do not sell your personal information.

Where information is transferred internationally, we ensure appropriate safeguards are in place in accordance with applicable data protection legislation.

We take appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, misuse or disclosure.

Patient information is stored securely, with access restricted to authorised individuals who require it for clinical or operational purposes.

How Long We Keep Your Information

We retain personal information only for as long as necessary to provide our services and meet applicable legal, clinical, professional and regulatory obligations. Our retention arrangements include:

• Clinical records: Adult patient records are generally retained for a minimum of eight years following the last treatment or contact, subject to applicable professional, legal and insurance requirements.
• Treatment photographs: Photographs forming part of the clinical record are retained in line with the associated patient records.
• Financial records: Generally retained for six years, subject to applicable accounting and tax requirements.
• Enquiries and marketing information: Retained only for as long as necessary for the relevant purpose, in accordance with our internal retention arrangements.

Longer retention periods may apply where required by law, professional obligations, ongoing complaints or legal proceedings.

Once information is no longer required, it is securely deleted or anonymised.

Marketing Communications

We may send you information about clinic services, treatment updates and special offers where permitted by law.

You can unsubscribe from marketing communications at any time using the unsubscribe link provided in our emails or by contacting us directly.

Unsubscribing from marketing will not affect essential appointment, treatment or aftercare communications.

Treatment Photographs

Photographs taken for clinical purposes form part of your confidential patient records.

We will not use identifiable patient photographs for marketing, website content or social media without obtaining appropriate consent.

Website Cookies

Our website may use cookies and similar technologies to support website functionality, analyse website performance and improve your browsing experience.

Where required by law, we will request your consent before using non-essential cookies.

Depending on the applicable legislation and circumstances, you may have the right to:

• Request access to the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of information in certain circumstances.
• Request restriction of or object to certain processing.
• Request transfer of certain personal information.
• Withdraw consent where processing relies on consent.

These rights are subject to certain legal limitations. For example, we may be required to retain clinical records to meet professional, legal or regulatory obligations.

To exercise your rights, please contact us using the details below.

If you have any questions about this Privacy Policy or how your personal information is handled, please contact:

• Oriah Clinics Ltd
• Email: support@oriah.co.uk
• Address: 3 Newbold Road, Rugby CV21 2LQ

If you have concerns about how your information has been processed, you may also contact the relevant data protection authority:

• United Kingdom: Information Commissioner's Office — www.ico.org.uk
• Jersey: Jersey Office of the Information Commissioner — www.jerseyoic.org
• Guernsey: Office of the Data Protection Authority — www.odpa.gg

We may update this Privacy Policy periodically to reflect changes in legislation, our services or how we process personal information. The latest version will be published on our website.