Privacy Notice

1. Purpose of This Notice

This Privacy Notice explains how ZARYA Clinic Ltd collects, uses, stores, shares and protects personal information when you visit our website, join a waiting list, make an enquiry, book or attend an appointment, receive a service, purchase a product or package, communicate with us, provide feedback, or interact with our online systems.

We process personal information in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations where applicable.

2. Who We Are

Data controller: ZARYA Clinic Ltd

Email: privacy@zaryaclinic.com

3. Information We May Collect

Identity and contact information

Name, date of birth, title and contact details.
Address, email address and telephone number.
Identity documents where reasonably required.
Emergency contact or next-of-kin details where relevant.

Enquiry, booking and waiting-list information

Services or concerns in which you have expressed interest.
Preferred contact method, appointment preferences and communications.
Booking, cancellation, attendance and customer-service records.
The source of your enquiry or referral where relevant.

Health and treatment information

Medical history, conditions, symptoms, medications, allergies and contraindications.
Pregnancy or breastfeeding status where relevant to treatment safety.
Previous treatments, complications, clinical assessments and consultation notes.
Treatment plans, consent records, product and device details, outcomes, adverse events and follow-up.
Clinical photographs, test results and referrals where relevant.
Lifestyle or wellbeing information where necessary for the service requested.

Health information is special category personal data and receives additional legal protection.

Financial and transaction information

Invoices, receipts, deposits, refunds and payment status.
Limited payment information received from payment processors.
The clinic does not intentionally store complete payment-card details unless an approved payment provider offers a secure card-on-file service and you choose to use it.

Website, device and communications information

IP address, browser, device information, website usage and cookie preferences.
Emails, telephone notes, SMS messages, web forms and secure platform communications.
CCTV images where CCTV is in operation in permitted non-clinical areas.

4. How We Obtain Information

Directly from you, including through the website, waiting-list forms, Pabau, email, telephone and in-person consultations.
From a parent, guardian, carer or representative where appropriate and lawful.
From practitioners, pharmacies, laboratories or other healthcare professionals involved in your care, with consent or another lawful basis where applicable.
From payment, website, communications and technology providers.
From publicly available sources where necessary to verify professional, legal or business information.

5. Why We Use Personal Information

To respond to enquiries and manage waiting-list registrations.
To arrange, confirm, deliver and follow up appointments and services.
To assess suitability, obtain informed consent and maintain accurate clinical records.
To manage patient safety, incidents, complaints, safeguarding and referrals.
To process payments, issue invoices and administer refunds or outstanding balances.
To communicate service information, pre-care and aftercare instructions.
To manage the clinic, train staff, audit quality and improve services, using anonymised or minimised data where reasonably possible.
To protect the clinic, patients, staff and premises and to establish, exercise or defend legal claims.
To comply with legal, tax, accounting, professional, insurance and safety obligations.
To send marketing where permitted and to respect your communication preferences.

6. Lawful Bases

Depending on the purpose, we rely on one or more lawful bases, including steps taken at your request before entering a contract, performance of a contract, compliance with a legal obligation, legitimate interests, consent and protection of vital interests. Legitimate interests may include operating and improving the clinic, securing systems, preventing fraud, managing complaints and protecting legal rights, provided those interests are not overridden by your rights.

For special category health information, we rely on an applicable condition under data-protection law, which may include the provision or management of health care by or under the responsibility of a professional subject to confidentiality, explicit consent where appropriate, protection of vital interests, or the establishment, exercise or defence of legal claims.

7. Waiting Lists and Pre-Launch Communications

If you join a waiting list, we use the details you provide to record your interest, contact you about relevant availability or launch information, prevent duplicate registrations and administer your communication preferences. Joining a waiting list does not guarantee access to a service. Where marketing consent is required, it will be requested separately and may be withdrawn at any time.

8. Pabau and Other Service Providers

The clinic uses Pabau as a patient and clinic management system and may use approved providers for website hosting, communications, payments, accounting, secure cloud storage, IT support, diagnostics, pharmacy services, document signing and other operational functions. Providers are selected and managed using appropriate contractual, confidentiality, security and data-protection safeguards.

9. Sharing Information

We may share the minimum information reasonably necessary with:

Practitioners and authorised clinic personnel involved in your care or administration.
Laboratories, pharmacies, prescribing services or other healthcare providers where relevant and lawful.
Pabau and approved technology, communications, payment, accounting, IT, storage and security providers.
Professional advisers, insurers, auditors and debt-recovery providers where necessary.
Emergency services, safeguarding bodies, law-enforcement agencies, courts or public authorities where required or permitted by law.
A purchaser, investor or successor organisation in connection with a genuine business transaction, subject to appropriate confidentiality and data-protection safeguards.

We do not sell personal information.

10. Clinical Photography

Clinical photographs may be taken where reasonably necessary for assessment, treatment planning, records, monitoring or patient safety. Where clinical images are necessary for the safe provision or documentation of a service, the clinic may be unable to proceed if they cannot be obtained.

Separate, specific permission will be sought before identifiable images are used for marketing, promotional, educational or social-media purposes. Declining or withdrawing optional image-use permission will not affect access to care, although withdrawal cannot undo a use that was lawful before withdrawal or printed material already distributed.

11. Cookies and Similar Technologies

The website may use essential cookies for security and functionality and, with appropriate consent where required, analytics or marketing cookies. Non-essential cookies should not be placed before the user has made a choice. Users can manage preferences through the cookie banner and browser settings. Details should be provided in a separate Cookie Notice or cookie-management panel accessible from the website footer.

12. Marketing

We may send news, launch updates, events or service information where you have consented or where another lawful electronic-marketing route applies. You can opt out at any time by using an unsubscribe link or contacting the clinic. Service messages about an enquiry, booking, payment, safety or aftercare are not marketing and may still be sent where necessary.

13. CCTV

CCTV may operate in selected public or security-sensitive areas for safety, security, incident investigation and crime prevention. CCTV is not used in treatment rooms, examination areas, toilets or changing facilities. Appropriate signage will be displayed. Footage access is restricted and retention is limited in accordance with the clinic’s CCTV arrangements, subject to preservation where an incident, complaint or legal claim requires it.

14. International Transfers

Some providers may process information outside the United Kingdom. Where restricted international transfers occur, the clinic will use an applicable lawful safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses, or another recognised mechanism, together with any required risk assessment.

15. Retention

Information is kept only for as long as reasonably necessary for the purpose collected and to meet legal, professional, tax, insurance, safety and dispute-management requirements. Retention periods vary by record type and the age and circumstances of the patient. Clinical records and associated images may need to be retained for extended periods. Enquiry and unsuccessful waiting-list information will be deleted or anonymised when no longer required, subject to consent records, suppression lists and legal needs.

16. Security

We use proportionate technical and organisational measures, which may include access controls, user permissions, multi-factor authentication where available, encryption, secure backups, confidentiality obligations, staff training, device management, incident response and supplier due diligence. No online system is completely risk-free, and users should avoid sending sensitive information through insecure channels unless instructed.

17. Your Data-Protection Rights

Subject to the circumstances and legal exemptions, you may have rights to:

Be informed about processing.
Access your personal information.
Correct inaccurate or incomplete information.
Request erasure in certain circumstances.
Request restriction of processing.
Object to processing based on legitimate interests or to direct marketing.
Receive certain information in a portable format.
Withdraw consent where processing relies on consent.
Complain to the Information Commissioner’s Office.

A request can be made using the privacy contact details above. We may need to verify identity. We normally respond within one calendar month, although the period may lawfully be extended for complex or multiple requests.

18. Automated Decision-Making and Digital Tools

The clinic does not currently use solely automated decision-making that produces legal or similarly significant effects for patients. Approved digital or artificial-intelligence-assisted tools may be used to support administration, transcription, drafting, documentation or service improvement, but appropriate human review, confidentiality, security and data-protection controls apply. Such tools do not replace individual clinical judgement.

19. Children

The clinic’s aesthetic services are intended for adults aged 18 and over. The website and marketing are not directed at children. If information about a child is received inadvertently or for a legitimate safeguarding, enquiry or representative purpose, it will be handled lawfully and proportionately.

20. Changes to This Notice

This Notice may be updated to reflect changes in law, technology, suppliers or services. The current version and effective date will be published on the website. Material changes will be communicated where appropriate.

21. Questions and Complaints About Personal Information

Please contact the Data Protection Lead first so that we can investigate and respond. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or by using the contact details published by the ICO.

Book a Consultation

Begin Your Zarya Journey

Every strategy begins with a conversation. Book a private consultation with our clinical team in Kensington.