Privacy Policy

1. Introduction

Aestheticc ("we", "our", or "us") is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our software-as-a-service platform designed for UK aesthetic clinics.

This policy applies to all users of our services, including aesthetic clinic professionals and their patients whose data is processed through our platform. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using our services, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller Information

Aestheticc Limited

Registered Office: 64 Winkworth Road, Banstead, SM7 2QL

ICO Registration Number: ZB989547

Data Protection Officer: Dr Shane McKeown

Email: shane@aestheti.cc

For UK aesthetic clinics using our platform: You act as the data controller for your patients' personal data, while we act as a data processor. We process data on your behalf in accordance with our Data Processing Agreement.

3. Types of Data We Collect

3.1 Clinic Account Information

Business name and registration details
Contact information (email, phone, address)
Billing and payment information
Professional credentials and certifications
Staff user accounts and permissions

3.2 Patient Data (processed on behalf of clinics)

Personal details (name, date of birth, contact information)
Medical history and treatment records
Consent forms and signatures
Before/after treatment photographs
Appointment history and scheduling data
Communication preferences and history

3.3 Technical Data

IP addresses and device information
Browser type and version
Operating system
Login data and access logs
Usage data and analytics

3.4 Special Category Data

We process special category personal data (health data) relating to patients on behalf of aesthetic clinics. This includes:

Medical conditions and allergies
Treatment history and outcomes
Aesthetic treatment preferences
Photographic records of treatments

3.5 The Aestheticc client app

Clinics that use Aestheticc can offer their clients our iPhone app. This part explains what the app collects and why.

Your app account. You sign in with your email address and a password. We keep your email address and a one-way, scrambled copy of your password (never the password itself). One app account can open each clinic you use it with. Your phone keeps your email address so the sign-in form is filled in for you. We are the data controller for your app account, because one account can open more than one clinic.

This phone's sign-in. When you sign in, the app creates a random id for this install of the app. It is not your phone's serial number or any hardware id. The app sends it with each sign-in so we can tie your sign-in to this phone and end it when you sign out, delete your account, or your clinic ends your access.

Sign-in links asked for in the app. If you ask for a sign-in link from inside the app, the app also creates a second random value, kept in this phone's secure storage (the keychain) and never in a backup. We keep only a one-way scrambled copy of it alongside that link. We use it for one thing: so a link you asked for in the app signs in only that app, and a link asked for in another app cannot sign your app in. Any other link opened in the app asks you to confirm before it signs you in. Sign-in links that have been used, or have expired, are deleted 30 days later.

Notifications. If you allow notifications, the app sends us a push token from Apple, through Expo (our notification service), together with the phone type (iPhone) and its iOS version. We use it only to send you notifications from your clinic. Notifications from a clinic are switched off when you ask that clinic to delete your details, or when you sign out of that clinic while your phone is online.

Crash reports. If the app crashes, it sends a crash report to Sentry, our error monitoring service in the EU (Germany). Reports carry the error type, where in the app it happened, the app version and your phone's operating system. They do not carry your name, email address, messages, screenshots or what you were looking at.

Face ID. You can use Face ID (or Touch ID on phones that have it) to unlock the app. Your phone checks your face or fingerprint itself. We never see or receive it.

No advertising tracking. Nothing you do inside the app is sent to advertising platforms such as Meta or Google. The app has no advertising tools and does not track you across other apps or websites. If you accept analytics cookies in the app, we measure which pages you open and which buttons you use, to improve the app. This is off until you accept.

Your clinic's records. Your appointments, treatment records, consent forms, photographs, invoices and health check-ins belong to your clinic. Your clinic is the data controller for them, as set out in section 2, and the app only shows you what your clinic holds. For questions about those records, please contact your clinic.

Deleting your account. In the app, tap Account, then Delete my account. If you cannot open a clinic, tap Delete my account on the sign-in screen and confirm with your password or a link we email you. Your app sign-in (your email and password for the app) is deleted straight away and this phone is signed out. You can also ask your clinics to delete your personal details: from the Account screen you choose which clinics to ask, and from the sign-in screen every clinic you use the app with is asked. Each clinic replies within 30 days. Clinics have to keep some records by law, so a clinic may keep part of your record.

4. Legal Basis for Processing

We process personal data under the following legal bases:

4.1 Contract Performance

Processing necessary to perform our contract with aesthetic clinics, including:

Providing our SaaS platform and features
Account management and support
Billing and payment processing

4.2 Legal Obligations

Processing necessary to comply with legal obligations, including:

Maintaining records for tax and accounting purposes
Responding to lawful requests from authorities
Complying with healthcare regulations

4.3 Legitimate Interests

Processing based on our legitimate interests, including:

Improving our services and platform
Ensuring platform security and preventing fraud
Marketing our services to businesses (not patients)

4.4 Consent

Where required, we obtain explicit consent for:

Marketing communications
Non-essential cookies
Processing special category data where no other legal basis applies

5. How We Use Your Data

5.1 Service Provision

Operating and maintaining the Aestheticc platform
Processing appointments and bookings
Facilitating patient management and CRM functions
Generating treatment documentation and consent forms
Enabling communication between clinics and patients
Processing payments and managing subscriptions

5.2 Platform Improvement

Analyzing usage patterns to improve features
Conducting research and development
Testing new features and updates
Providing customer support and training

5.3 Security and Compliance

Monitoring for security threats and vulnerabilities
Preventing fraud and unauthorized access
Maintaining audit logs for compliance
Backing up data for disaster recovery

7. Instagram, Facebook and WhatsApp

A clinic can connect its Instagram, Facebook and WhatsApp business accounts to Aestheticc. This section explains the data we receive from Meta when it does. The clinic is the data controller for messages with its patients and enquirers; we process them on the clinic's behalf. To delete this data, see our data deletion instructions.

7.1 What we receive

Account details: the clinic's Facebook Page, Instagram business account and WhatsApp business number, their IDs and names, and the access tokens Meta issues so we can act for the clinic. Access tokens are encrypted at rest.
Posts: the posts and images the clinic chooses to publish to Instagram or Facebook through Aestheticc.
Instagram direct messages: messages people send to the clinic's Instagram account and the replies sent back, including the sender's Instagram ID. A message can be recorded as a new enquiry for the clinic.
WhatsApp messages: messages exchanged between the clinic and its clients on WhatsApp, with phone numbers and delivery status.
Past WhatsApp chats: when a clinic connects its WhatsApp Business app, the clinic can choose in the app to share up to 180 days of past chats. We link a past chat to a client only when the phone number exactly matches a client the clinic already has.
WhatsApp contacts: Meta may also share the WhatsApp Business app's contact list when the clinic connects. We do not create client records from it and do not keep it as a list.

7.2 Why we use it

To show the clinic its Instagram and WhatsApp conversations in Aestheticc, alongside its other client messages
To send the WhatsApp replies the clinic's staff write
To publish the posts the clinic schedules
Where the clinic turns it on, to let our AI assistant answer messages for the clinic
Where the clinic runs Facebook or Instagram ads through Aestheticc, to create those ads for the clinic using its connected Facebook account and Page

We do not use messages, past chats or contacts for advertising, and we do not sell any of this data.

7.3 Where it is stored and who processes it

We store this data with our other clinic data on Google Cloud in London. Meta is the source of the data and processes it under its own terms and privacy policy, which may involve processing outside the UK. WhatsApp messages may also pass through Twilio (see section 6.1).

7.4 How long we keep it

Access tokens: kept only while the account is connected, and erased when the clinic disconnects it in Aestheticc. Disconnecting also stops us publishing and messaging with that account. If the clinic also runs Facebook or Instagram ads through Aestheticc, the ads connection keeps its own access until the clinic removes Aestheticc in Facebook Business Integrations or asks us to remove it.
Account details: kept with the clinic's account until the clinic asks us to delete them.
Messages: Instagram and WhatsApp messages are stored in the clinic's Aestheticc inbox. When a client's record is erased on an erasure request, the messages linked to that record are deleted with it (see section 9). For messages not linked to a client record, such as an enquiry sent before the person became a client, email privacy@aestheti.cc.

7.5 Deleting this data

Step-by-step instructions for clinics and patients are on our data deletion page.

8. International Data Transfers

Clinic and patient data is stored in London, and our AI features run in the UK and EU. Where a service provider processes data in the United States (Twilio for calls and text messages, Expo for client app notifications, and our backup voice and AI services and email delivery), the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, the UK International Data Transfer Agreement, or the UK-US data bridge where the provider is covered by it, is in place before the transfer occurs.

9. Data Retention

Clinic account data: kept for the length of the subscription and afterwards until the clinic asks us in writing to delete it. We delete it within 30 days of that request.
Patient records: kept as directed by the clinic, which is the data controller. We do not delete them on a timer.
Erased patients: where a patient asks to be erased and the clinic must keep the record, it is held out of view for 8 years and then deleted.
Client app sign-in links: links that have been used, or have expired, are deleted 30 days later.
Audit logs: 8 years
Transaction records: 6 years for tax compliance
Backups: point-in-time recovery for 7 days

10. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

10.1 Access Right

You can request a copy of the personal data we hold about you, including:

What data we process
Why we process it
Who we share it with
How long we keep it

10.2 Rectification Right

You can request correction of inaccurate or incomplete personal data.

10.3 Erasure Right ("Right to be Forgotten")

You can request deletion of your personal data in certain circumstances, including:

The data is no longer necessary
You withdraw consent (where applicable)
You object to processing
The data was unlawfully processed

For data from Instagram, Facebook or WhatsApp, see our data deletion instructions.

10.4 Restriction Right

You can request that we restrict processing of your data while disputes are resolved.

10.5 Portability Right

You can request your data in a structured, machine-readable format for transfer to another service.

10.6 Objection Right

You can object to processing based on legitimate interests or for direct marketing purposes.

10.7 Automated Decision Rights

You have the right not to be subject to decisions based solely on automated processing, including profiling.

10.8 How to Exercise Your Rights

To exercise any of these rights, please contact us using the details in Section 15. We will respond within one month of receiving your request.

10.9 Complaints

If you're not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk

Phone: 0303 123 1113

Live chat: Available on ICO website

11. Security Measures

We implement appropriate technical and organizational measures to protect personal data:

11.1 Technical Measures

Encryption in transit (TLS 1.3) and at rest (AES-256)
Secure authentication with multi-factor authentication (MFA) options
Regular security audits and penetration testing
Web Application Firewall (WAF) protection
Regular software updates and patch management
Secure backup procedures with encrypted storage

11.2 Organizational Measures

Staff training on data protection and security
Access controls based on least privilege principle
Data protection impact assessments (DPIAs)
Incident response procedures
Regular review of security policies
Confidentiality agreements with all staff

11.3 Data Breach Procedures

In the event of a data breach, we will:

Notify affected users within 72 hours where required
Report to the ICO if necessary
Investigate and remediate the cause
Document all actions taken

12. Cookies and Tracking

We use cookies and similar technologies to enhance your experience:

12.1 Essential Cookies

Required for platform functionality:

Session management and authentication
Security tokens
Load balancing
User preferences

12.2 Analytics Cookies

Help us understand platform usage:

Google Analytics (anonymized)
Performance monitoring
Error tracking

12.3 Managing Cookies

You can control cookies through your browser settings. Note that disabling essential cookies may impact platform functionality.

For more details, see our separate Cookie Policy.

13. Children's Privacy

Our services are not directed at individuals under 18 years of age. Aesthetic clinics using our platform are responsible for ensuring appropriate consent when treating minors, in accordance with UK medical guidelines and regulations.

14. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of significant changes by:

Email notification to registered users
Prominent notice on our platform
Updating the "Last updated" date

Continued use of our services after changes indicates acceptance of the updated policy.

15. Contact Information

For privacy-related questions, requests, or complaints, please contact our Data Protection Officer:

Data Protection Officer

privacy@aestheti.cc

dpo@aestheti.cc

Postal Address

Aestheticc Limited
64 Winkworth Road, Banstead, SM7 2QL
United Kingdom

Phone

+44 7872 567 919

We aim to respond to all privacy requests within 30 days.

Note for Patients: If you are a patient of a clinic using Aestheticc, please contact your clinic directly for questions about your personal data. They are the data controller for your information. To delete messages you sent a clinic on Instagram or WhatsApp, see our data deletion instructions.