Privacy Policy

For the UK operations described in this notice, the data controller is AZ SKINCARE LTD (Company No. 16466399), trading as Bavary Clinic.

Business and registered office address: 138 Kenton Road, Harrow, England, HA3 8AZ.

Telephone: +44 (0) 20 7101 4932. For privacy enquiries, access requests or complaints, contact hawa@bavaryclinic.co.uk.

Any clinic separately operated in Ireland has its own controller arrangements and requires a separate, verified notice. This document does not claim that AZ SKINCARE LTD controls all Irish operations.

• Identity and contact details: name, email, phone number, address and appointment preferences.
• Consultation and treatment records: information you provide about health, medications, allergies, relevant history, suitability, consent, treatment plans, clinical notes and aftercare.
• Clinical images: photographs used for consultation, treatment records or progress monitoring where appropriate.
• Purchase and payment records: orders, shipping, billing and transaction information. Payment card processing is generally handled by our payment provider.
• Website and device data: IP address, browser information, security logs, cookies and information about use of the website, depending on settings and consent.
• Marketing preferences: newsletter subscriptions, consent records and communication preferences.
• Communications: enquiries, complaints and correspondence with us.

We may collect information directly from you, from bookings or forms, during consultations, from your purchases and through relevant website technologies.

When we rely on legitimate interests, those interests include operating a secure clinic and website, maintaining service quality and protecting our business and clients. We will provide additional information about specific processing where required.

Medical history, treatment information and some photographs may reveal health information and are treated as special category personal data under the UK GDPR.

In addition to an Article 6 lawful basis, we must identify an appropriate Article 9 condition before processing such information. Depending on the service, professional responsibilities and circumstances, this may involve the provision of health or care services under applicable confidentiality safeguards, or your explicit consent where that is the appropriate lawful condition. We will not treat routine acceptance of website terms as blanket consent to use sensitive health information.

We use GetTimely to manage appointments, consultation forms and related client records. Access should be restricted to authorised personnel who need the information for their role.

Where appropriate, photographs may be taken to document baseline condition, treatment planning, safety, progress and clinical records. Such images are handled confidentially and access is limited according to professional and organisational need.

Use of identifiable clinical images for public marketing, social media, case studies or promotional materials requires an appropriate separate permission or consent process. Consent for marketing photographs can be withheld without affecting your access to appropriate clinical care, subject to any images genuinely needed for treatment records.

We use carefully selected service providers where relevant, including:

• GetTimely — appointment scheduling, consultation forms and clinic administration;
• Stripe and payment partners offered at checkout — payment processing and fraud prevention;
• WooCommerce / WordPress and our hosting and technical providers — online retail, website and account infrastructure;
• Brevo — email communications and marketing management;
• Complianz — cookie preference management;
• couriers, payment providers, professional advisers, insurers and public bodies, where necessary.

We only disclose information where there is a lawful reason, appropriate protection and a need to do so. Service providers may act as processors or independent controllers depending on the particular service.

You may choose to receive information about products, treatments, news and offers. We use Brevo for email marketing where that service is configured for the relevant communication.

We send electronic marketing only where permitted by applicable law, using opt-in consent where required or a lawful existing-customer exception where its conditions are satisfied. You can unsubscribe through the link in a marketing message or by emailing hawa@bavaryclinic.co.uk.

We may still send necessary service messages, such as booking confirmations, receipts, changes to appointments or important information about an order, even if you opt out of marketing.

Our website uses essential technologies for core operation and may use optional analytics or advertising technologies as these are configured. Google Analytics and Google Ads may be introduced for analytics and campaign measurement. We will update this notice as needed when those services are activated.

Where consent is required, optional tracking must not operate until you have made the relevant choice. We use Complianz to manage cookie consent preferences. See our Cookie Policy and use the website's Cookie Settings control to review or change your choices.

Some technology and communications providers may process information in countries outside the United Kingdom. When personal data is transferred internationally, we assess whether a relevant adequacy arrangement or appropriate legal safeguard applies, such as an approved international data transfer agreement or addendum, alongside supplementary protections where needed.

You may contact us for information about the safeguards applicable to your data. Specific provider locations and arrangements should be checked against our live vendor contracts and configurations.

We retain personal data for no longer than necessary for the purpose collected, taking account of our legal obligations, the nature and sensitivity of the records, safeguarding and insurance needs, potential claims and the ongoing relationship with you.

• Clinical records and treatment photography: kept for periods appropriate to the nature of treatment, professional obligations, safeguarding considerations and any applicable limitation or retention requirements.
• Orders, payments and accounting: kept as needed for tax, financial records, consumer obligations and claims.
• Enquiries and support: kept while necessary to answer or resolve the matter and for an appropriate subsequent period.
• Marketing data: kept while your subscription or another lawful basis remains relevant, with suppression records retained as necessary to honour opt-outs.
• Cookie preferences and analytics: subject to the relevant purpose, retention setting and applicable law.

We regularly review records and delete, anonymise or securely archive information when it is no longer needed. A documented category-by-category retention schedule will be maintained and refined as our operations and regulatory obligations are reviewed.

We apply appropriate technical and organisational measures intended to protect personal information, including controlled access, staff confidentiality, service provider due diligence and account/security management. No online system can be guaranteed completely secure.

Please avoid sending sensitive medical information through ordinary email unless requested through an appropriate secure channel.

Depending on the circumstances and lawful basis, you may have the right to request access to your data, correction, erasure, restriction, portability, and to object to certain processing. Where we rely on consent, you can withdraw it at any time without affecting processing already carried out lawfully.

Right to object: You may object at any time to processing of your personal information for direct marketing; we will stop that processing when you do.

To exercise your rights, contact hawa@bavaryclinic.co.uk. We may need to verify your identity. Some records cannot be erased immediately where retention is legally required.

If you remain dissatisfied, you may complain to the Information Commissioner’s Office (ICO).

We may update this Privacy Policy when services, systems, laws or privacy practices change. Significant changes will be highlighted where appropriate. The current version and its update date are published on this page.