Privacy policy
Last updated 5 October 2026.
Who we are
Nurse Annie Aesthetic Clinic Ltd (company number 16301094), trading as Nurse Annie Aesthetic Clinic, registered office 17-19 St George's Street, Norwich, NR3 1AB, is the data controller for the information described here. Contact 07359 836026 with any question about your data.
What we collect
- Contact details. Name, email address, phone number, and postal address where relevant.
- Health data. Medical history, medication, allergies, previous treatments, treatment records and consent forms. This is special category data under UK GDPR and is treated accordingly.
- Clinical photography. Before and after images, taken as part of your clinical record.
- Booking and payment data. Held by Aesthetic Nurse Software, our booking platform, not by us. We see appointment details, not full card numbers.
- Website data. Anything you type into the enquiry form, and, only if you accept analytics cookies, Google Analytics data about how the site is used (pages viewed, how you arrived, which buttons were used). Google acts as our processor for that data, advertising features are off, and you can withdraw at any time through the cookie settings link in the footer.
Why we hold it, and on what basis
- To provide treatment safely. Article 6(1)(b) contract and Article 9(2)(h) provision of health care. We cannot treat you safely without a medical history.
- Clinical records. A legal and professional obligation under NMC standards.
- Appointment reminders and follow-up. Legitimate interest, and part of aftercare.
- Marketing. Consent only, and only where you have opted in. You can withdraw at any time and every email carries an unsubscribe link.
- Clinical photography used publicly. Explicit, separate, written consent. It is never assumed, it names exactly where images may be used, and it can be withdrawn.
Who we share it with
Aesthetic Nurse Software, for booking and payment. Our indemnity insurer, only in the event of a claim. A prescribing pharmacy, where a prescription is dispensed. Your GP or another clinician, only with your consent or where there is a safeguarding or urgent clinical need. We do not sell your data and we do not share it for advertising.
How long we keep it
Adult clinical records are retained for at least eight years after your last appointment, in line with professional guidance. Records for anyone treated under 18 are retained until their 25th birthday. Marketing consent records are kept for as long as the consent stands, plus two years. Enquiry form messages are deleted after twelve months if they do not lead to treatment.
Your rights
You can ask for a copy of your data, ask for it to be corrected, ask for it to be deleted where we are not legally required to keep it, object to processing, withdraw consent, and ask for your data in a portable format. Contact 07359 836026 and we will respond within one month.
If you are not happy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Security
Clinical records are held in an access-controlled system. Paper consent forms are held in a locked cabinet on the premises. Access is limited to clinical staff who need it. Any data breach affecting your rights is reported to the ICO within 72 hours and to you without undue delay.