Privacy Policy

Last updated: 31.07.2026

This Privacy Policy explains how The Academy Clinic collects, uses, stores and shares personal data when you use our website, make an enquiry, book or receive a consultation or treatment, or otherwise interact with us. It also explains your privacy rights and how data protection law protects you.

Definitions

For the purposes of this Privacy Policy:

Account: A unique account created for you to access our services.
Affiliate: Entities under common control, sharing 50% or more ownership.
Cookies: Small files stored on your device to track your browsing activity.
Device: Any device capable of accessing the Service, such as a phone or tablet.
Personal Data: Information that identifies or can identify an individual.
Service Provider: Third parties processing data on behalf of The Academy Clinic.
Usage Data: Automatically collected data about your interactions with our Service.
Website: The Academy Clinic website, accessible at www.theacademyclinic.co.uk.
You: The individual using the Service, or the entity on whose behalf the individual is acting.

Who We Are

The Academy Clinic is operated by Harley Academy Limited, a company registered in England and Wales.

For the purposes of UK data protection law, Harley Academy Limited is the controller responsible for the personal data described in this Privacy Policy.

Registered address:

Harley Academy Limited
5th Floor, Jasper House
4–6 Copthall Avenue
London
EC2R 7DA

Privacy enquiries may be sent to: clinicprivacy@theacademyclinic.co.uk

Data We Collect

1. Information You Provide

Identity Data: Name, email, gender.
Contact Data: Phone numbers, billing and email addresses.
Financial Data: Payment card and bank details.
Transaction Data: Details of payments to/from you.
Profile Data: Username, password, preferences, and feedback.

Health and Clinical Data includes medical history, current and previous health conditions, allergies, medication, pregnancy or breastfeeding status, lifestyle information relevant to treatment, previous procedures, consultation and assessment notes, treatment recommendations, prescriptions, consent records, product and batch information, treatment outcomes, adverse reactions, complications, referral information, ultrasound or other clinical imaging, aftercare records and clinical photographs.

Health and Clinical Data is special category personal data. We process it only where we have both a lawful basis under Article 6 of the UK GDPR and an applicable special category condition under Article 9.

Clinical Photography and Imaging: We may take photographs, videos, ultrasound images or other clinical images where reasonably necessary to:

assess your condition or suitability for treatment;
plan or provide treatment;
record your condition before, during or after treatment;
monitor progress or treatment outcomes;
obtain advice from another authorised healthcare professional;
manage a complication or adverse event;
investigate a complaint or legal claim; or
meet clinical, regulatory, insurance or professional requirements.

Clinical photographs and images form part of your clinical record. They are processed for clinical purposes and are not dependent on marketing consent.

Where clinical photography or imaging is reasonably required for safe assessment, treatment or record-keeping, declining it may mean that we are unable to provide or continue a particular service.

We will not use identifiable photographs, videos or clinical images for advertising, social media, promotional activity, testimonials, public presentations or similar non-clinical purposes unless we have obtained your separate and explicit consent.

Marketing consent is voluntary. Refusing or withdrawing that consent will not affect the care or treatment you receive.

You may withdraw marketing consent at any time. Withdrawal will stop future use under our control but will not affect processing that took place lawfully before consent was withdrawn. We may not be able to retrieve printed material or content already lawfully published or shared by third parties.

For the Aesthetic Complications Referral Centre, we will collect and process additional health data including complication details, ultrasound imaging records, treatment outcomes, and referral information. With explicit consent, these records may also be used for research and educational purposes as part of the complications clinic research tier.

Research, Education and Service Improvement

We may use information derived from clinical services to improve patient safety, treatment protocols, training and service quality.

Where information has been fully anonymised so that no individual can reasonably be identified, it is no longer personal data and may be used or shared for research, statistical, educational or service-improvement purposes.

Where identifiable or potentially identifiable clinical information, photographs or imaging are proposed for research or education, we will identify an appropriate lawful basis and Article 9 condition before the processing takes place.

Where explicit consent is the appropriate basis, participation will be voluntary and refusal will not affect your treatment or care.

Any formal research activity involving identifiable patient information must be subject to appropriate clinical, ethical, information-governance and contractual review.

2. Information Collected Automatically

Usage Data: Pages viewed, session durations, and interaction metrics.
Device Data: Browser type, operating system, IP address, and device details.
Cookies: Collected for analytics and service improvement purposes.

3. Aggregated Data

Aggregated data (statistical or demographic) that cannot identify you.

How We Collect Your Data

Direct Interactions: Through inquiries, sign-ups, and forms.
Automated Technologies: Using cookies and similar technologies.
Third Parties: Analytics tools like Google Analytics.

How We Use Your Data

Purpose	Data Types	Legal Basis
To register you as a client	Identity, Contact	Performance of a contract
To provide our services	Identity, Financial, Profile, Health	Performance of a contract, Consent
To manage payments	Identity, Financial	Performance of a contract, Legitimate interests
To send marketing communications	Identity, Contact	Consent
To improve services	Usage, Technical	Legitimate interests

Special Category Data

In light of the services which we provide to You, it will often be necessary for us to use information about your health. Even in the broadest sense of the word, 'health' information is a special category of personal data which requires us to have an additional lawful basis for using this information. Where we use information about your health for the purpose of providing our services to you (or in preparation for us to provide services to you), the additional lawful basis on which we shall rely will be that such use is necessary in order for us to provide you with health care or treatment.

You may be asked to provide details that impact potential treatments and products. Including medications, medical history, allergies, lifestyle factors such as occupation and travel plans, medical treatments and ongoing concerns. This data is stored securely and only used when advising you on suitable treatments.

With the exception of Health Data, we do not collect any other Special Categories of Personal Data about you (this includes details about religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, genetic or biometric data). Nor do we collect any information about criminal convictions and offences.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

If the information we have stored needs updating, please inform us by email info@theacademyclinic.co.uk.

We may process data for more than one lawful ground depending on the specific purpose for which we are using data. Please contact us if You want further details about the specific legal ground we are relying on to process your data.

Where we need to collect data by law, or under the terms of a contract and You do not provide that data when requested, we may not be able to fulfil the contract. In this case, we may have to cancel a service You have with us.

In the context of the complications clinic services, we may share anonymised complication data with our educational and research partners to support training and improve complication management protocols, but only where explicit consent is obtained.

We share data as necessary with:

Affiliates: Harley Academy and Story Clinics.
Service Providers: Zenoti (clinic management) and Design MC (website hosting).
Legal Obligations: Regulatory authorities when required by law.

Appropriate safeguards are in place for any data transfers outside the UK/EEA.

Data Retention

Complication management records, including ultrasound images and treatment notes, will be retained for a minimum of 7 years in line with medical regulatory standards.

We retain your data only for as long as necessary:

Personal Data: For service provision or as required by law.
Usage Data: For a shorter duration unless needed for security purposes.

Retention of Clinical Records

Clinical records, including consultation notes, consent forms, treatment records, prescriptions, ultrasound images, clinical photographs, correspondence and complication-management records, may need to be retained for longer than ordinary customer information.

We retain clinical records in accordance with applicable legal, professional, regulatory, safeguarding, insurance and limitation requirements and our Data Retention Policy.

The applicable retention period may vary according to:

the type of treatment or service;
the patient's age;
the nature and seriousness of any complication or adverse event;
professional or regulatory requirements;
insurance requirements; and
whether the record may be required for a complaint, investigation or legal claim.

Records will not be retained for longer than is reasonably necessary unless continued retention is required or permitted by law.

Your Legal Rights

You have the right to:

Access: Request copies of your data.
Rectification: Correct inaccuracies in your data.
Erasure: Request deletion of your data (subject to legal exceptions).
Restriction: Limit processing of your data.
Data Portability: Receive your data in a structured format.
Withdraw Consent: Opt-out of marketing or data collection activities.

To exercise these rights, email us at clinicprivacy@theacademyclinic.co.uk.

Data Security

We implement robust security measures to protect your data. If a breach occurs, affected parties and regulators will be notified promptly.

Cookies and Third-Party Tools

We use cookies to improve functionality and gather analytics. You can manage or disable cookies in your browser settings. You can reset your browser to refuse all cookies or to indicate when a cookie is being sent. However, some of our Service features may not work properly without cookies. Most browsers accept cookies automatically but allow You to disable them. For more information about cookies visit https://www.allaboutcookies.org.

Information About Your Location

From your IP address, we can tell generally where You are when You are accessing our Service, such as which city. We start by choosing a location for You based on the IP address of your internet connection. You can update or remove this location at any time by logging in to your account on the Service.

Personal Data and Information Third Parties Collect Automatically

Third-Party Cookies for Site Use Analysis

We use third parties such as Google to help us analyse how people are using our Service. We also use the Google Analytics service to provide us with demographic data about our Hosts and Members, such as age and gender. Google uses a cookie that can be recognised by Google or its affiliate DoubleClick when You visit other websites. For more information about how Google collects, uses, and shares your information, please visit the Google Privacy Policy-Partners website at https://www.google.com/policies/privacy/partners/.

Third-Party Cookies Used to Target Ads on Other Websites

"Beacons" are transparent pixel images that are used in collecting information about website usage across websites and over time. Our Hosts may use their own or third-party cookies or beacons to target Host ads to You when You visit other websites. Our Hosts may also work with other companies who use their cookies or beacons to target third-party ads to You on other websites based on your prior visits to the Host's Network on our website Service. This is called online behavioural advertising ("OBA") because You receive ads based on your prior online behaviour. We do not have access to these cookies; it is third parties who engage in OBA.

Data Protection Legislation

Our use of your personal data is subject to the data protection laws applicable in the United Kingdom, including the UK GDPR; the Data Protection Act 2018 (and regulations made thereunder) (DPA 2018); the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) and the ePrivacy Directive (2002/58/EC) as amended and all other legislation and regulatory requirements in force from time to time which apply to a party relating to the use of Personal Data (including, without limitation, the privacy of electronic communications) and the guidance and codes of practice issued by the Commissioner or other relevant regulatory authority which are applicable to a party.

We may share your data within The Academy Clinic sister brands, Story Clinics and Harley Academy Limited (i.e. our officers, staff and contractors) and with our service providers; for example, to service your requests or provide You with information. We may also share your data if a change happens in our business such as a merger or acquisition. If that happens, the new owners may use your data in the same way as set out in this Privacy Policy.

We may also share your data with service providers whom we engage to help us run our business or deliver our services to you. This may include advertising and marketing service providers and advertising platforms, such as Google and Meta, who assist us in delivering relevant marketing communications, creating advertising audiences and measuring the effectiveness of our advertising activities.

We may also share any data you place on our platform with other users of our platform.

We may also share your data with other organisations or individuals when it is reasonably necessary to:

Meet any applicable law, regulation, legal process or request of a suitable governmental body or public authority e.g. under a relevant court production order;
Enforce applicable legal terms and conditions or our other legal rights, including investigation of potential violations;
Protect against or prevent harm to the rights, property or safety of The Academy Clinic as required or permitted by law;
Share your data with your GP or another relevant healthcare professional if we refer you to them or believe it is in your best interest to contact them.

When we share personal data with third parties, we will ensure that we only share the minimum necessary, that appropriate safeguards are in place and that such recipients are bound by appropriate confidentiality obligations.

Your activity on Our Service in accordance with their Privacy Policies:

Zenoti (Clinic management software) — https://www.zenoti.com/trust/privacy-notice
Design MC (Website platform host) — https://designmc.org/privacy-policy/

Where Is Your Data Stored And Processed?

We will process and store your data on the Website/Application servers, email and other servers and equipment that are needed to provide the services and platform as applicable.

We do not ordinarily transfer your data outside of the country or region from which You access our services. That is either the UK or European Economic Area. However, we may transfer your data outside of your country or region as follows:

Analytics Providers

Our service providers, such as Google Analytics (Google Inc. and its affiliates), may process your data in the course of providing analytical information to us about the use of the Website. These service providers may collect and/or transfer your data outside of the UK or European Economic Area. For more information on how Google Analytics processes your data, You can visit here: https://support.google.com/analytics/answer/6004245?hl=en-GB.

Service Providers

Sometimes our service providers are based outside of the EEA or UK. Whenever we transfer data out of the EEA or UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

We will only transfer data to countries that have been deemed to provide an adequate level of protection for data; or
Where we use certain service providers, we may use specific contracts approved by the UK Information Commissioner which give personal data the same protection it has in the UK.

What Direct Marketing Do We Conduct?

If You provide your contact details, we might contact You individually in the future if we think that our services may be of interest to you. If we think it appropriate, we might also add You to our regular email marketing list.

You can ask us to remove your personal details from our marketing lists using the contact details listed at the top of this Privacy Policy.

Complication management records, including ultrasound images and treatment notes, will be retained for a minimum of 7 years in line with medical regulatory standards.

Advertising Audiences and Marketing Partners

Where you have consented to receive marketing communications from us, we may use your contact information, including your name, email address and telephone number, to create and manage advertising audiences and customer lists on third-party advertising platforms, including Google and Meta.

This allows us to show relevant advertisements to existing customers and prospective customers who may be interested in our services, and to measure the effectiveness of our advertising campaigns.

We may share limited personal data with these advertising partners for these purposes. Where required, such information may be encrypted, hashed or otherwise transformed before being processed. We will only use personal data for advertising audience creation and personalised advertising where we have an appropriate lawful basis to do so, including consent where required by applicable law.

You may withdraw your consent to marketing communications at any time by contacting us using the details provided in this Privacy Policy or by using the unsubscribe link included in our marketing communications.

You can ask us to remove your personal details from our marketing lists using the contact details listed at the top of this Privacy Policy.

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

The Company will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of Our Service, or We are legally obligated to retain this data for longer time periods.

Transfer of Your Personal Data

Your information, including Personal Data, is processed at the Company's operating offices and in any other places where the parties involved in the processing are located. It means that this information may be transferred to — and maintained on — computers located outside of Your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from Your jurisdiction.

Your consent to this Privacy Policy followed by Your submission of such information represents Your agreement to that transfer.

The Company will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy and no transfer of Your Personal Data will take place to an organisation or a country unless there are adequate controls in place including the security of Your data and other personal information.

Your Legal Rights In Detail

Under certain circumstances, You have rights under data protection laws in relation to your personal data.

Request access to your personal data (commonly known as a "data subject access request"). This enables You to confirm with us whether your personal data is processed and, if it is, to receive a copy of the personal data we hold about you.
Request correction of the personal data that we hold about you. This enables You to have any incomplete or inaccurate data we hold about You corrected, though we may need to verify the accuracy of the new data You provide to us.
Request erasure of your personal data in certain circumstances. This enables You to ask us to delete or remove personal data where it is no longer necessary for us to continue to process it. You also have the right to ask us to delete or remove your personal data where You have successfully exercised your right to object to processing (see below), where we may have processed your personal data unlawfully or where we are required to erase your personal data to comply with applicable law. However, the right to erasure is not an absolute right and we may not always be required to comply with your request for specific legal reasons which will be notified to you, if applicable, at the time of your request.
Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party). In some cases, we may demonstrate that we have compelling legitimate grounds to process your personal data which override your rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes.
Request restriction of processing of your personal data in certain circumstances. This enables You to ask us to suspend the processing of your personal data in the following circumstances:
- If You want us to establish the data's accuracy;
- Where our use of the data is unlawful but You do not want us to erase it;
- Where You need us to hold the data even if we no longer require it as You need it to establish, exercise or defend legal claims; or
- You have objected to our use of your personal data or performing profiling activities when relying on a legitimate interest but we need to verify whether we have overriding legitimate grounds to use it.
Request the transfer of your personal data to You or a third party. We will provide to you, or a third party You have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to personal data processed by automated means which You initially provided consent for us to use or where we used the information to perform a contract with you.
Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before You withdraw your consent. If You withdraw your consent, we may not be able to provide certain products or services to you. We will advise You if this is the case at the time You withdraw your consent.

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns in the first instance.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law enforcement

Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other legal requirements

The Company may disclose Your Personal Data in the good faith belief that such action is necessary to:

Comply with a legal obligation;
Protect and defend the rights or property of the Company;
Prevent or investigate possible wrongdoing in connection with the Service;
Protect the personal safety of Users of the Service or the public;
Protect against legal liability.

Security of Your Personal Data

The security of Your Personal Data is important to Us. We have put in place appropriate security measures to prevent data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to data to those of our staff and other third parties who have a business need to know. They will only process data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data breach and will notify You and any applicable regulator of any breach where we are legally required to do so.

Children's Privacy

Our Service does not address anyone under the age of 18. We do not knowingly collect personally identifiable information from anyone under the age of 18. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone under the age of 18 without verification of parental consent, We take steps to remove that information from Our servers.

If We need to rely on consent as a legal basis for processing Your information and Your country requires consent from a parent, We may require Your parent's consent before We collect and use that information.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third-party link, You will be directed to that third-party's site. We strongly advise You to review the Privacy Policy of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

Updates to This Policy

We may revise this Privacy Policy. The latest version will always be available on our website.

Contact Us

If You have any questions about this Privacy Policy, You can contact us:

By email: clinicprivacy@theacademyclinic.co.uk
By mail: The Academy Clinic of 5th Floor Jasper House, 4-6 Copthall Avenue, London, EC2R 7DA.