Privacy Policy

Last updated: November 2026

At Bicester Glow Clinic, we respect your privacy and are committed to protecting your personal information. This Privacy Policy explains what information we collect, how we use it, how we store it and your rights in relation to your personal data.

We process your information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What information we collect

When you enquire, book or attend an appointment, we may collect the following information:

Personal and contact information

Full name
Address, email address and telephone number
Date of birth, where required
Appointment and booking history

Medical and treatment information

Medical history and relevant health conditions
Medications and allergies
Contraindications and treatment suitability information
Previous treatments and treatment notes
Consent forms and signed declarations
Details of any reactions or adverse events

Photographs

Before, during and after treatment photographs
Images used to monitor treatment progress
Photographs used for marketing, where separate permission has been provided

Payment information

Payment amounts, dates and transaction records
Relevant payment and invoicing information

We do not intentionally collect more information than is necessary to provide safe and appropriate treatments and manage your appointments.

How we use your information

Your information may be used to:

Manage bookings, appointments and payments.
Contact you about appointments, changes and cancellations.
Assess your suitability for treatments.
Maintain accurate medical and treatment records.
Monitor treatment progress and results.
Provide appropriate aftercare and follow-up advice.
Respond to questions, concerns or complaints.
Meet our legal, regulatory and insurance obligations.
Improve our services and customer experience.
Send promotional offers, treatment updates and marketing communications where permitted.

Medical Information & Sensitive personal data

Some of the information we collect, particularly your medical history, is classed as special category personal data under UK GDPR.

We collect this information because it is important for assessing treatment suitability, identifying potential contraindications, managing treatment risks and maintaining appropriate clinical records.

Access to medical and treatment information is restricted to authorised members of our team who need it to perform their duties.

We take additional care when handling this information and only use it for appropriate and relevant purposes.

Photographs & Marketing Consent

Photographs will be taken before, during and after treatments to document your progress, assess results and maintain accurate treatment records. And for insurance purposes.

We may from time to time use such images for marketing and promotion. Identities are concealed where possible.

This is agreed to within your consent form. If you wish to strongly decline please inform your technician or the business.

You can decline marketing photography without this affecting your ability to receive treatment. You can also withdraw your marketing photography consent at any time by contacting us.

Withdrawing consent will prevent future use of the images for marketing purposes, although it may not be possible to retrieve material that has already been printed, distributed or shared by others.

Marketing & Promotional Communication

We may send you information about our treatments, special offers, promotions, events and clinic news.

We will only send electronic marketing communications where we have an appropriate legal basis and have complied with applicable marketing and privacy laws.

You can opt out of marketing communications at any time by using the unsubscribe link in our emails or contacting the clinic directly.

Opting out of marketing will not affect essential communications relating to your bookings, treatments, payments or aftercare.

We do not sell your personal information to marketing companies or unrelated third parties.

How we store & Protect your data

Your personal information and treatment records are stored digitally using systems and service providers selected to support the operation of our clinic.

We take reasonable technical and organisational measures to protect your information against unauthorised access, loss, misuse, alteration or disclosure.

Access to client records is restricted to authorised personnel, and we expect any service providers handling personal information on our behalf to maintain appropriate security and confidentiality standards.

While we take reasonable steps to protect your information, no electronic storage or transmission system can be guaranteed to be completely secure.

Sharing your information

We do not sell or trade your personal information.

We may share relevant information with trusted third-party service providers where necessary to operate the clinic, including:

Appointment booking and management providers.
Payment processing providers.
Secure digital record and data storage providers.
Website, email and communication service providers.
IT and technical support providers.

These providers are only permitted to process information in accordance with their agreed services and applicable data protection requirements.

We may also disclose information where required by law, a court order, regulatory requirements or to establish, exercise or defend legal claims.

How long we keep your information

We retain client records in accordance with our clinic's retention policy and applicable legal, professional and insurance requirements.

Our current clinic policy is to retain relevant client records for five years, including treatment records, consent forms, photographs and appointment information, where applicable.

The actual retention period may vary depending on the type of information, the nature of the treatment, applicable requirements and any ongoing legal or insurance matters.

Once information is no longer required, it will be securely deleted or destroyed, where appropriate.

Your data protection rights

Under data protection legislation, you have a number of rights in relation to your personal information. These may include:

Right of access: You can request a copy of the personal information we hold about you.
Right to rectification: You can ask us to correct inaccurate or incomplete information.
Right to erasure: You can request that your personal information is deleted in certain circumstances.
Right to restrict processing: You can ask us to restrict how we use your information in certain circumstances.
Right to object: You can object to certain types of processing, including direct marketing.
Right to data portability: You may request certain information in a transferable format where applicable.
Right to withdraw consent: Where we rely on consent, you can withdraw it at any time.

Please be aware that some information may need to be retained even if you request deletion, for example where we have a legal, regulatory or legitimate insurance-related reason to keep it.

To exercise your rights, please contact us using the details provided above.

We aim to respond to valid requests within the timeframes required by law

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our business practices, services or legal obligations.

The latest version will always be made available on our website, with the date of the most recent update displayed at the top.

By continuing to use our services, you acknowledge that you have been made aware of our Privacy Policy.