Privacy Policy | Cosmedocs

Cosmedocs (“we”, “us”, “our”) is a doctor-led aesthetic medicine clinic based at 8–10 Harley Street, London W1G 9PF. We are committed to protecting your personal and medical information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and guidance from the Information Commissioner’s Office (ICO).

1. Who we are (Data Controller)

CosmeDocs Ltd is the data controller for personal data collected through this website, our consultation forms, our clinic systems and our communications. For CQC-regulated medical procedures we work with PrivaDr Ltd, 10 Harley Street, London W1G 9PF, who acts as controller for the clinical record for those specific treatments.

2. What data we collect

Identity & contact: name, email, phone, address, country.
Clinical information you provide: medical history, medications, allergies, photos submitted for consultation.
Appointment & treatment records where you become a patient.
Website usage: IP address, device, browser, pages visited, referrer, and analytics cookies (see our Cookie Policy).
Communications: messages, WhatsApp enquiries, contact-form submissions and email correspondence.

3. How we use your data (Lawful basis)

Consent — marketing emails, optional analytics cookies, AI face-scan uploads.
Contract — booking and delivering the treatment you have requested.
Legal obligation — medical record retention, tax and accounting.
Legitimate interests — clinic safety, fraud prevention, improving our website and services.
Explicit consent (Article 9) — processing of health data for medical treatment.

4. Sharing your data

We only share personal data where necessary and with appropriate safeguards:

Our clinicians, nurses and administrative staff working on your care.
PrivaDr Ltd for CQC-regulated procedures.
Regulated third-party processors: secure hosting, email, SMS/WhatsApp Business, payment providers, appointment software, analytics.
Regulators (GMC, CQC, ICO) or law enforcement where legally required.

We do not sell your personal data.

5. International transfers

Some processors (e.g. hosting, analytics) may transfer data outside the UK. Where they do, we rely on UK adequacy regulations or Standard Contractual Clauses with additional safeguards.

6. How long we keep your data

Clinical records: retained for a minimum of 8 years after last contact, in line with NHS and GMC guidance.
Enquiry-only contacts: up to 24 months, then deleted or anonymised.
Financial records: 6 years (HMRC).
Website analytics: 14 months (GA4 default).

7. Security

We use HTTPS across the site, restricted-access clinical systems, encrypted backups, staff confidentiality obligations and a documented breach-response process.

8. Your rights

Under UK GDPR you have the right to:

Access a copy of your data (Subject Access Request).
Correct inaccurate data.
Request erasure (subject to medical retention rules).
Restrict or object to processing.
Data portability.
Withdraw consent for marketing at any time.
Complain to the ICO — ico.org.uk.

9. Contact

To exercise any right, or for privacy questions, contact us at info@cosmedocs.com or write to: Data Protection, CosmeDocs Ltd, 8–10 Harley Street, London W1G 9PF, United Kingdom.