Privacy Policy

Amber Grove Aesthetics (“we”, “us”, “our”) is committed to protecting and respecting your privacy. This policy explains how we collect, use, store, and protect your personal data when you visit our website, enquire about or receive treatments, or join our mailing list. We process data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who we are

Amber Grove Aesthetics is the trading name of Amber Grove Aesthetics and Wellbeing Ltd, a nurse-led aesthetic clinic based in Rainham, Kent. We are registered in England and Wales (company number 15822541), with our registered office at 43 Princes Avenue, Minster-on-Sea, Kent, ME12 2HJ. Our clinic and correspondence address is 212 Station Road, Rainham, Gillingham, Kent, ME8 7PS.

For the purposes of data protection law, Amber Grove Aesthetics and Wellbeing Ltd is the data controller. Our full contact details are set out at the end of this policy. We are registered with the ICO, registration reference ZC235002.

The information we collect

We may collect and process the following categories of personal data:

• Identity and contact data: your name, date of birth, email address, postal address, and telephone number.
• Health data (special category data): your medical history, medications, allergies, skin concerns, and treatment records. This is necessary to provide safe clinical treatment.
• Treatment records: consultation notes, consent forms, treatment details, aftercare, and where relevant, clinical photographs (with your separate consent).
• Financial data: payment records (card payments are processed securely by our payment provider; we do not store full card details).
• Marketing data: your preferences for receiving marketing from us, including Glow List subscription status.
• Technical data: IP address, browser type, and usage data collected via cookies and similar technologies when you use our website (see our Cookie Policy).

How we use your information

We use your personal data for the following purposes, relying on the following lawful bases:

• To provide treatment — performance of our contract with you, and for health data, the provision of health care (Article 9(2)(h) UK GDPR).
• To manage appointments and communicate with you — performance of our contract and our legitimate interests in running the clinic.
• To keep clinical records — our legal and professional obligations as a registered healthcare practitioner.
• To send marketing (e.g. the Glow List) — your consent, which you may withdraw at any time.
• To improve our website and services — our legitimate interests, subject to your cookie preferences.

Our systems and providers

We use HubSpot as our customer relationship management (CRM) and marketing platform. When you submit a form, subscribe to the Glow List, or interact with our website, your data may be stored and processed within HubSpot. HubSpot may use cookies to track website activity and associate it with your contact record. We use Aesthetic Nurse Software to manage bookings and clinical records. These providers act as our data processors under written data protection agreements, and process your data only on our instructions

International transfers

Some of our providers, including HubSpot, are based outside the United Kingdom and may store or process your data in countries such as the United States. Where your data is transferred outside the UK, we ensure it remains protected by an approved safeguard under UK data protection law. For transfers to the United States, we rely on the provider’s certification under the UK Extension to the EU–US Data Privacy Framework; where a provider is not certified, we rely on the UK International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU Standard Contractual Clauses. In each case, the transfer is subject to appropriate technical and legal protections so that your data receives an equivalent level of protection to that provided in the UK.

How long we keep your data

We retain clinical records in line with professional and legal guidance. Adult clinical records are kept for a minimum of eight years after your last treatment. Records relating to anyone under 18 are kept until their 25th birthday. These periods reflect recognised healthcare record-retention guidance and our professional obligations; where we are required to keep records longer for legal or insurance reasons, we will do so. Marketing data is retained until you unsubscribe or ask us to remove it.

Sharing your data

We do not sell your data. We may share it with:

• Our data processors (e.g. HubSpot, our booking and records system, payment providers).
• Healthcare professionals where clinically necessary and with your knowledge — for example, sharing a mole screening report with your GP.
• Regulatory or legal authorities where we are legally required to do so.

Your rights

Under UK GDPR, you have the right to access your data, request correction or erasure, object to or restrict processing, withdraw consent, and request data portability. To exercise any of these rights, please contact us using the details below. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk

Data security

We take the security of your data seriously and use appropriate technical and organisational measures to protect it, including secure storage, access controls, and encrypted systems for sensitive information.

Changes to this policy

We may update this policy from time to time. The current version will always be available on this page, with the “last updated” date shown above.