top of page

Privacy Policy

The personal data we collect

We may collect and use the following categories of personal data:

  • identity data, such as your name, title and date of birth

  • contact data, such as your email address, telephone number and address

  • appointment and enquiry data, such as booking details, consultation requests and messages you send us

  • medical and treatment data, such as medical history, allergies, medications, treatment suitability, consultation notes, consent forms, photographs and aftercare records

  • payment data, such as billing information and payment records

  • website usage data, such as IP address, browser type, pages viewed and cookie-related data

  • marketing preferences, such as whether you have agreed to receive updates from us

Under UK GDPR, medical information is special category data and needs an additional condition for processing as well as a lawful basis.

How we collect your personal data

We collect personal data when you:

  • fill in a form on our website

  • book or request a consultation

  • contact us by phone, email, WhatsApp, social media or online form

  • attend a consultation or treatment appointment

  • complete medical history or consent forms

  • make a payment

  • browse our website

  • subscribe to marketing communications

Why we use your personal data

We may use your personal data to:

  • respond to enquiries

  • arrange and manage consultations and appointments

  • assess treatment suitability

  • provide safe and appropriate aesthetic treatment and aftercare

  • maintain medical and treatment records

  • take and store clinical photographs where relevant

  • process payments and keep financial records

  • improve our services and website

  • send service messages about bookings, appointments and aftercare

  • send marketing communications where you have agreed or where permitted by law

  • comply with legal, regulatory, insurance or professional obligations

  • establish, exercise or defend legal claims where necessary

Our lawful bases for processing

The ICO says your privacy notice should include your lawful basis as well as your purposes for processing.

Depending on the circumstances, we rely on one or more of the following lawful bases:

  • Contract — where we need your information to book or provide consultations, treatment or aftercare

  • Legitimate interests — where we use your information to run and improve our business, respond to enquiries, manage appointments and keep appropriate records

  • Legal obligation — where we must keep certain records or comply with legal, tax, insurance, regulatory or professional requirements

  • Consent — where required, for example for certain marketing communications or certain uses of photographs

Where we process medical or other special category data, we also rely on an additional condition under UK data protection law, such as:

  • provision of health or social care by a health professional

  • explicit consent, where applicable

  • establishment, exercise or defence of legal claims, where relevant

Clinical photographs

If clinical photographs are taken, they are used for purposes such as treatment assessment, treatment planning, medical records and monitoring outcomes.

We will not use identifiable before-and-after images for marketing, website or social media purposes without your clear permission. If you give consent, you can withdraw it later for future use.

Marketing

We may use your contact details to send you marketing emails about treatments, clinic updates, news or offers where you have opted in or where we are otherwise permitted to do so by law.

We may also use website analytics and advertising technologies, such as Meta Pixel and Google Ads, to understand the effectiveness of our marketing and improve how we communicate with people who are interested in our services. Where these technologies rely on cookies, pixels or similar tools, we will request consent where required before using them.

You can opt out of email marketing at any time by clicking the unsubscribe link in our emails or by contacting us directly.

Who we share your data with

We may share your personal data with trusted third parties where necessary, such as:

  • appointment booking and clinic management software providers

  • payment processors

  • IT and website providers

  • email and communications providers

  • accountants, insurers or legal advisers

  • laboratories, pharmacies or prescribing partners, where relevant

  • regulators, law enforcement or courts, where required by law

We only share the minimum information necessary and expect third parties to keep your data secure and use it lawfully.

How long we keep your data

We keep personal data only for as long as necessary for the purposes set out in this policy, including legal, medical, insurance, regulatory, tax and record-keeping reasons.

Typical retention periods may include:

  • enquiries that do not lead to treatment: [ up to 12 months]

  • appointment and treatment records: [7–8 years after last treatment, or longer where clinically necessary]

  • financial records: [ 6 years]

  • marketing data: until you withdraw consent or opt out

  • website analytics/cookie data: according to cookie settings and provider retention periods

You should tailor these periods to your actual process and record-keeping obligations.

Cookies, analytics and marketing technologies

Our website may use cookies, pixels, tags and similar technologies to understand how visitors use the site, improve website performance, measure marketing activity and show relevant advertising.

These technologies may include:

  • Google Analytics to help us understand website traffic and user behaviour

  • Google Ads to measure ad performance and support advertising activity

  • Meta Pixel to help measure advertising performance and understand actions taken on our website

  • tools connected with email marketing to measure email engagement, such as opens, clicks and subscription preferences

Some of these technologies are essential for the website to function. Others are optional and used for analytics, performance measurement or advertising.

Where required by law, we will ask for your consent before placing or using non-essential cookies, pixels, tags or similar technologies on your device. This includes technologies used for analytics and online advertising. You can manage your preferences through our cookie banner or cookie settings tool.

Online advertising technologies are not treated as strictly necessary and require consent. This includes advertising-related cookies and similar technologies used for measurement, attribution and performance.

These technologies may collect information such as:

  • IP address

  • browser type

  • device information

  • pages viewed

  • time spent on pages

  • referring website

  • actions taken on the website

  • advertising or campaign-related identifiers

Some online identifiers, including pixel tags and advertising IDs, may be personal data under UK data protection law.

For more information about the specific cookies and technologies we use, how long they last, and how to manage your choices, please see our Cookie Policy

Cookies, analytics and marketing technologies

Under UK GDPR, you may have the right to:

  • access your personal data

  • have inaccurate personal data corrected

  • ask for erasure of your personal data in certain circumstances

  • ask us to restrict how we use your data in certain circumstances

  • object to processing in certain circumstances

  • object to direct marketing at any time

  • request data portability in certain circumstances

  • withdraw consent where consent is the basis for processing

The ICO says privacy information should explain people’s information rights, including the right to withdraw consent where relevant, and how to complain.

To exercise your rights, contact us at info@drcotiga.co.uk

Complaints

If you are unhappy with how we use your personal data, please contact us first so we can try to resolve the issue.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator.

Data security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or alteration.

Changes to this privacy policy

We may update this privacy policy from time to time. Any changes will be posted on this page with the revised update date.

bottom of page