Privacy policy

Who we are

Bold Street Clinic is run by Bedgebury Ltd, a company registered in England and Wales (company number 03784604). Bedgebury Ltd trades as Bold Street Clinic, The Bold Street Clinic and Bold Street Slimming & Cosmetics, so you may see any of these names in our communications. Our registered office is Bold Street Clinic, First Floor, 60A Bold Street, Liverpool L1 4EA. Bedgebury Ltd is the controller of your personal information, which means we decide how and why it’s used. We’re registered with the Information Commissioner’s Office (ICO) under registration number ZB320038.

Our clinic is on the first floor at 60A Bold Street, Liverpool L1 4EA. We’re registered with the Care Quality Commission (CQC), and our treatments are led by Dr Paul Effiong.

How to contact us about your information

If you have a question about this policy or want to use any of your rights, you can:

• email us at boldstreet1@outlook.com
• call us on 0151 707 0010
• write to Data protection, Bold Street Clinic, First Floor, 60A Bold Street, Liverpool L1 4EA

Dr Paul Effiong is responsible for data protection at the clinic. We haven’t appointed a separate data protection officer, so Dr Paul looks after how we handle personal information.

The information we collect

When you contact us. If you use the form on our contact page, we collect your name, email address, phone number, the treatment you’re interested in, your message and whether you’d like us to call you back. If you email, phone or message us on social media, we keep a record of what you send.

When you book. Online booking runs through Pabau, our booking and clinic management system. It collects your name, contact details and the appointment you choose. If what you book is chargeable, Pabau also collects the card details needed to take payment: the name on the card, card number, expiry date, security code and billing address.

When you come to us for treatment. Before any treatment, we take a medical history and carry out a consultation. Depending on the treatment, this can include your health conditions, medication, allergies, height, weight and BMI, pregnancy status, previous treatments, consent forms, treatment notes, prescriptions and the results of reviews. For many aesthetic treatments we also take clinical photographs before and after, so we can plan your treatment and check the results.

When you use our website. Our site records some technical information, such as your IP address, browser and device. With your permission, it also records how you use the site through analytics cookies (see Cookies, below).

Health information

Information about your health is special category data under UK data protection law, and we give it extra protection. We use it to assess whether a treatment is safe and suitable for you, to provide and prescribe treatment, to look after you afterwards, and to keep the clinical records the law and our regulators require.

We rely on the condition for health care purposes (Article 9(2)(h) of the UK GDPR and Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018). That means your health information is only used for your care, by or under the responsibility of a health professional who has a duty of confidentiality.

We only use clinical photographs in our marketing, on our website or on social media if you’ve given us your written consent for that specific use. You can say no without it affecting your treatment, and you can withdraw your consent at any time. We’ll then stop using the photographs in anything new and remove them from our website and social media.

How we use your information and why

The law says we need a lawful basis for each way we use personal information. These are ours (what we use the type of information for followed by our lawful basis for doing so):

• Replying to your enquiry and arranging a consultation: Taking steps at your request before entering into a contract, or our legitimate interest in answering enquiries
• Booking, consultations, treatment and aftercare: Performing our contract with you, and for health information, health care purposes
• Keeping clinical and prescribing records: Legal obligation, and for health information, health care purposes
• Taking payment and keeping financial records: Performing our contract with you, and legal obligation
• Sending appointment reminders and treatment follow-ups: Performing our contract with you
• Sending news and offers by email or text: Your consent, or for existing clients, our legitimate interest under the “soft opt-in” rule. You can unsubscribe at any time
• Using clinical photographs in marketing: Your explicit written consent
• Understanding how our website is used: Your consent, given through our cookie banner
• Protecting our website and forms from spam and abuse: Our legitimate interest in keeping our website secure
• Handling complaints and legal claims: Legal obligation, or our legitimate interest in defending our position

We don’t use your information to make decisions about you by automated means alone. We don’t sell your information to anyone.

Our treatments are for adults only. We don’t treat or take bookings from anyone under 18, and we don’t knowingly collect their information.

Who we share your information with

We only share your information where we need to, and only as much as the purpose requires. The organisations below handle information on our behalf under written contracts. They can only use it to provide their service to us.

The following table explains who we share your information with and what they do for us.

• Pabau: Online booking, clinic management and taking card payments for chargeable bookings.
• Google: Website analytics (Google Analytics) and spam protection on our contact form (Google reCAPTCHA)
• Microsoft: Our email service
• Krystal Hosting: Hosting our website on servers in the UK
• Kootoo Digital Ltd: Building, updating and maintaining our website

We may also share information:

• with your GP or another health professional, where it’s needed for your safety or care. We’ll normally discuss this with you first
• with the CQC, the General Medical Council or another regulator, if we’re required to
• with the police, a court or another public body, where the law requires it or allows it to prevent or detect crime
• in an emergency, where someone’s life or safety is at risk

Information sent outside the UK

Some of our suppliers, such as Google and Microsoft, may store or access information in the United States or other countries outside the UK. When that happens, we make sure the transfer is protected. The protection is either UK regulations confirming that the country’s data protection standards aren’t materially lower than ours, such as the UK-US data bridge, or contract terms approved under UK law. Contact us if you’d like more details.

How long we keep your information

• Enquiries from people who don’t go on to book: 12 months from your last contact
• Clinical records, including consultation notes, consent forms and photographs: 8 years after your last treatment
• Payment and accounting records: 6 years from the end of the financial year they relate to
• Marketing preferences: Until you unsubscribe, after which we keep a record that you’ve opted out so we don’t contact you again
• Website analytics: 2 months, the standard Google Analytics setting

When we no longer need information, we delete it securely or anonymise it.

Keeping your information secure

Only people who need your information to do their job can see it, and clinical records are only available to the clinical team and staff who support your care. Our website uses an encrypted connection (HTTPS), and our systems are protected by individual logins. If something goes wrong and your information is put at risk, we’ll tell you and the ICO where the law requires us to.

Cookies

Cookies are small files that a website stores on your device. We use as few as possible:

• _GRECAPTCHA Google – this cookie is set by reCAPTCHA and checks that contact form submissions come from a person, not a spam bot. It lasts for 6 months. We don’t ask for your permission to use it because it’s needed in order to keep our contact form secure.
• _ga and _ga_6PSPL9ZYK8 – this cookie is set by Google Analytics and counts visits as well as showing which pages are used. This is there so that we can improve the website over time and lasts for 2 years. We do ask for your permission to use this.

The first time you visit, our cookie banner asks whether you’re happy for us to use analytics cookies. You can change your mind at any time using the cookie settings link at the bottom of every page. You can also block or delete cookies in your browser settings.

We don’t use advertising or remarketing cookies.

Your rights

You have the right to:

• ask for a copy of the personal information we hold about you
• ask us to correct information that’s wrong or incomplete
• ask us to delete your information. We may not be able to delete clinical records we’re legally required to keep, but we’ll explain why
• ask us to restrict how we use your information while a concern is looked into
• object to us using your information where we rely on our legitimate interests
• ask for information you gave us to be sent to you or another organisation in a commonly used electronic format
• withdraw your consent at any time, where we rely on it. This won’t affect anything we did before you withdrew it
• stop marketing messages at any time, using the unsubscribe link or by contacting us

To use any of these rights, contact us using the details at the top of this policy. There’s no charge. We’ll reply within one month, or within three months if your request is complex, in which case we’ll tell you within the first month. If we need more information to find what you’re asking for, or to confirm who you are, we’ll ask, and the time limit is paused until we have it.

Complaints

If you’re unhappy with how we’ve handled your personal information, please tell us first, using the contact details above. We’ll acknowledge your complaint within 30 days, look into it properly, keep you updated and let you know the outcome.

If you’re still not satisfied, you can complain to the Information Commissioner’s Office:

• website: ico.org.uk/make-a-complaint
• phone: 0303 123 1113
• post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Other websites

Our website links to other sites, such as our social media pages, the CQC and the Pabau booking system. Their own privacy policies apply when you use them.

Changes to this policy

We’ll update this policy when the way we use personal information changes, or when the law changes. The date at the top shows when it was last updated.