Privacy Policy
How your information is handled
What is collected, why it is collected, how long it is kept, who has access to it, and the rights you hold over it.
Before you rely on this document
This is a template. It sets out the structure and the substance a privacy policy for this kind of service should contain, but it has not been completed with your organisation's specific details and it has not been reviewed by a solicitor.
Every section marked with square brackets requires your own information before this page is published. You should also have the completed policy checked against current UK data protection law, since a service handling health-related information carries obligations beyond those applying to an ordinary website.
Last updated: [ date to be added ]
1. Who we are
Lipo Freeze provides non-invasive body contouring and related treatments delivered in clients' homes. For the purposes of UK data protection law, the data controller responsible for the personal information described in this policy is [ registered business name and company number to be added ], of [ registered address to be added ].
Questions about this policy, or about how your information is handled, can be sent to [ data protection contact address to be added ].
2. The information we collect
We collect only what is necessary to answer your enquiry, assess whether a treatment is suitable for you, and deliver that treatment safely.
Information you give us directly
- Contact details — your name, telephone number, email address and the address at which treatment would take place.
- Enquiry details — what you tell us about the concern you are asking about.
- Health information — medical history, current medication, previous surgery, implanted devices, pregnancy status and relevant conditions. This is collected during assessment and is treated as special category data under UK data protection law, which carries additional protections.
- Treatment records — the areas treated, the settings and protocols used, dates of sessions, any reactions noted and aftercare guidance provided.
- Photographs — only where you have given separate, specific and written consent. Photographs are never taken without that consent, and consenting to photographs for your own record does not constitute consent to their use in any marketing material. Those are two separate permissions and are recorded separately.
Information collected automatically
- Website usage data — [ describe any analytics or cookies in use, or state plainly that none are used. If cookies are used, a cookie notice and consent mechanism are required. ]
3. Why we use it, and our lawful basis
- To respond to your enquiry — on the basis of taking steps at your request prior to entering a contract.
- To assess suitability and deliver treatment — on the basis of performing our contract with you. Health information is processed on the additional basis of your explicit consent, and for the provision of health-related services.
- To keep accurate treatment records — on the basis of our legitimate interests in maintaining safe practice, and to comply with legal and insurance obligations.
- To meet legal obligations — including tax, accounting and insurance requirements.
We do not use your information to build marketing profiles, and we do not sell or rent personal information to anyone under any circumstances. If you enquire and decide not to proceed, your details do not become a marketing list entry.
4. Marketing communications
[ State your position here. If you do not send marketing communications at all, say so plainly. If you do, marketing may only be sent on the basis of consent freely given, that consent must be recorded, and every message must carry a working means of withdrawing it. Consent to receive marketing must never be a condition of receiving treatment. ]
5. Who has access to your information
Access is limited to those who need it in order to deliver your treatment safely. We share information outside that group only in the following circumstances:
- Service providers who process data on our behalf — for example [ list categories such as booking software, secure record storage, accountancy ]. Each is bound by a written agreement requiring them to process data only on our instructions and to protect it appropriately.
- Healthcare professionals — only with your explicit consent, or where there is an urgent risk to someone's life or health.
- Insurers and legal advisers — where necessary to establish, exercise or defend a legal claim.
- Regulatory or law enforcement bodies — where we are legally required to disclose.
We do not share your information with advertising networks, data brokers or any third party for their own marketing purposes.
6. How long we keep it
[ Set out your retention periods here. Typical practice: enquiries that do not proceed to treatment are deleted after a short defined period; treatment records including health information are retained for a longer period reflecting insurance and legal requirements; financial records are retained for the period required by tax law. State the actual periods rather than describing them as "as long as necessary". ]
Once a retention period expires, records are securely deleted or destroyed.
7. How your information is protected
[ Describe the specific measures in place — for example encryption of stored records, access controls, password policies, secure disposal of paper notes, and the arrangements applying to any records carried between appointments, which is a particular consideration for a home-visiting service. ]
No system is completely secure, and we do not claim otherwise. Where a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and will inform you directly where the risk to you is high.
8. Your rights
Under UK data protection law you have the right to:
- Be informed about how your data is used — which is the purpose of this document.
- Access a copy of the personal data held about you, normally within one month and free of charge.
- Rectification of anything inaccurate or incomplete.
- Erasure of your data in certain circumstances, though records we are legally or professionally required to retain may not be deletable on request.
- Restrict processing in certain circumstances.
- Data portability — to receive your data in a structured, commonly used and machine-readable format.
- Object to processing carried out on the basis of legitimate interests, and to object to direct marketing at any time.
- Withdraw consent at any time where processing is based on consent. Withdrawal does not affect processing carried out before it.
You do not need to give a reason for exercising any of these rights, and doing so will never affect the standard of care you receive. To make a request, contact [ data protection contact address to be added ].
9. Complaints
If you are unhappy with how your information has been handled, please raise it with us first at [ contact address to be added ] so we have the opportunity to put it right. You also have the right to complain directly to the Information Commissioner's Office, the UK's independent data protection regulator, at ico.org.uk.
10. Changes to this policy
Any changes will be published on this page with an updated revision date. Where a change materially affects how your information is used, we will make reasonable efforts to inform you directly rather than relying on you noticing the amendment.