PRIVACY POLICY

We process personal information only where we have a lawful reason to do so. Depending on the circumstances, this may include:
Taking steps at your request before providing a service or fulfilling our agreement with you.
Meeting a legal or regulatory obligation.
Pursuing our legitimate interests in operating and protecting the business, provided that your rights do not override those interests.
Protecting somebody’s vital interests in an emergency.
Your consent, particularly for optional marketing communications.
Medical and health information is special-category personal data. Where we process this information, we do so where necessary for the provision and management of healthcare by, or under the responsibility of, a regulated healthcare professional, or under another applicable legal condition. We may also rely on explicit consent where appropriate.
Children and infants
Some Mother & Baby services may involve information relating to infants or children. This information will normally be provided by, and managed in consultation with, a parent or person who has parental responsibility.
We will only collect information that is relevant and necessary for the service being provided.
Bookings and clinical records
Aesthetic Nurse Software is used to manage bookings, appointments, clinical forms and treatment records.
Information entered into that system is processed in accordance with its applicable privacy and security arrangements. Access to clinical records is restricted to authorised individuals who require the information to provide or administer your care.
Payments
Online deposits and payments may be processed by Stripe or another payment provider shown at checkout.
Payment providers process payment-card information through their secure systems. Noor Aesthetics & Wellness does not ordinarily receive or retain your complete card details.
Who we may share information with
Where necessary and lawful, information may be shared with:
Aesthetic Nurse Software.
Wix, which hosts and supports our website and enquiry form.
Stripe and other payment processors.
Our secure email and technology providers.
Prescribing services and pharmacies.
Diagnostic laboratories and blood-testing or referral partners.
Appropriately qualified healthcare professionals involved in your care.
Professional advisers, insurers, accountants and IT-support providers.
Regulatory authorities, safeguarding bodies, courts or law-enforcement agencies where required by law or necessary to protect someone from serious harm.
We do not sell personal information.
International data transfers
Some technology providers may store or process information outside the United Kingdom.
Where this occurs, we expect the provider to use an appropriate legal safeguard for the transfer, such as a UK adequacy regulation, the UK International Data Transfer Agreement or an approved contractual addendum.
How long we retain information
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable clinical, professional, insurance, tax and legal requirements.
General enquiries that do not lead to an appointment will normally be retained for no longer than 12 months unless there is a valid reason to keep them longer.
Clinical and treatment records may need to be retained for a longer period in accordance with applicable healthcare, professional, safeguarding and insurance requirements. Financial and transaction records are retained for the period required by tax and accounting legislation.
Information will be securely deleted or anonymised when it is no longer required.
Keeping information secure
We take reasonable technical and organisational measures to protect personal information against loss, misuse, unauthorised access, disclosure or alteration.
No internet or email service can be guaranteed to be completely secure. Please avoid sending sensitive medical information through ordinary email, social media or the general website enquiry form.
Marketing
We will only send optional promotional emails or messages where we have an appropriate lawful basis, normally your consent.
You may withdraw your consent or unsubscribe at any time by contacting us at hello@nooraestheticsandwellness.co.uk or by using the unsubscribe option included in the message.
Withdrawing from marketing will not prevent us from sending essential messages about your appointments, treatment or account.
Cookies and website analytics
Our website may use cookies and similar technologies to function correctly, remember visitor preferences, understand website usage and support website security.
Where required, non-essential cookies will not be used unless you have made an appropriate choice through our cookie banner. Further information should be provided through the website’s cookie settings or cookie policy.
Social-media links
Our website contains links to external social-media platforms, including Facebook and Instagram.
If you follow one of these links, you will leave our website. The external platform will process information according to its own privacy policy and cookie practices.
Your data-protection rights
Depending on the circumstances, you may have the right to:
Ask for access to your personal information.
Ask us to correct inaccurate or incomplete information.
Ask us to erase your information.
Ask us to restrict how your information is used.
Object to certain uses of your information.
Request the transfer of information in an appropriate format.
Withdraw consent where processing is based on consent.
Complain about how your information has been handled.
Some rights are subject to legal exceptions. For example, we may need to retain clinical or financial records even if you ask us to delete them.
To exercise your rights, contact:
hello@nooraestheticsandwellness.co.uk
We may need to confirm your identity before responding.
Complaints
Please contact us first if you have a concern about how your personal information has been handled, so that we have an opportunity to resolve it.
You also have the right to complain to the Information Commissioner’s Office:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk
Changes to this policy
We may update this privacy policy when our services, systems or legal responsibilities change.
The latest version will be displayed on our website with its most recent revision date.