Privacy policy template for aesthetics clinics

Every aesthetics clinic holds medical histories, treatment records, photographs and contact details, and patients increasingly ask what happens to all of it. The document that answers them is a privacy notice: a short, plain-English page telling patients what you hold, why you hold it, who else sees it, how long you keep it and how to contact you about it. It belongs on your website, in your new patient pack and next to your booking form.

The template below is a starting structure written in patient-facing language, with every clinic-specific decision left in brackets. We are a software company, not legal advisors, so this is a drafting aid rather than a legal document. Two of the bracketed values, your retention periods and your stated legal bases, are the ones you should not guess at: settle them with your indemnity provider, your professional body’s guidance and, where the answer is not obvious, a solicitor. The Information Commissioner’s Office publishes the authoritative position for UK organisations, along with its own template notices and a two-minute self-assessment on registration. Start there, then use the wording below to make the result readable.

What patients actually want to know

A privacy notice that reads like a contract gets skimmed and achieves nothing. The five questions a patient in an aesthetics clinic genuinely wants answered are simple: what have you written down about me, why do you need my medical history for a cosmetic treatment, who else can see my photographs, how long do you keep it, and how do I say no to marketing without losing my appointment reminders. Answer those five clearly and the rest of the document can be brief.

Two sections do most of the work in aesthetics specifically. Photographs are the section patients care about most and the one generic templates handle worst, because before-and-after images are simultaneously a clinical record and a marketing asset, and those two uses need separating explicitly. Marketing is the second, because appointment reminders and promotional messages are different things and patients should be able to refuse one without losing the other.

The template

Copy the text below, replace the bracketed values, and cut anything that does not describe your clinic. Nothing here should stay in brackets when you publish.

---

Privacy notice for patients of [Clinic name]

Last updated: [date]

Who we are

[Clinic name] ([registered company name and number, if applicable]) provides [non-surgical aesthetic treatments] at [clinic address]. We are responsible for the personal information described in this notice. If you have any questions about it, contact [name or role] at [email address] or [phone number].

What we hold about you

• Your contact details: name, date of birth, address, phone number and email address.
• Your medical history, including conditions, medications, allergies and the details you give us on our health questionnaire.
• Your GP’s details, where you have given them to us.
• Records of your consultations, consent, treatments, products used, and any aftercare or follow-up.
• Photographs taken as part of your clinical record, where you have agreed to them.
• Your appointment history, and details of payments you have made to us.
• Any messages you send us, and notes of conversations about your care.

Where it comes from

Almost all of it comes from you, in person, on a form or through our online booking. [Where relevant: we may also receive information from your GP or another healthcare professional, with your consent, and from our payment provider when you pay us.]

Why we hold it

• To assess whether a treatment is suitable and safe for you, and to plan it.
• To keep an accurate clinical record of the care we have provided.
• To contact you about your appointments, including confirmations, reminders and aftercare.
• To take payment and keep our financial records.
• To respond to questions or concerns you raise, and to deal with any complication or claim.
• [Add any other purpose that genuinely applies to your clinic, and remove any that does not.]

We rely on [insert the legal bases you have settled with your adviser] to do this. If you would like more detail about that, contact us using the details above.

Photographs

We may take clinical photographs before and after treatment. These form part of your record, help us plan and review your treatment, and support your care if a complication arises.

We will only use a photograph of you in any other way, including on our website, in printed material or on social media, if you have given us separate written permission that says exactly where the image may be used. That permission is optional, it is never a condition of treatment, and you can withdraw it at any time by contacting us. If you withdraw it, we will stop using the image and remove it from the places we control as soon as we reasonably can. [Note whether you are able to remove images already shared or reposted elsewhere.]

Appointment messages and marketing

We will always send you the messages you need in order to attend safely: booking confirmations, appointment reminders and aftercare instructions.

We will only send you offers, newsletters or promotional messages if you have asked us to. You can stop those at any time using the unsubscribe link in any email, by replying [STOP] to a text, or by telling us at your next appointment. Stopping marketing will never affect your appointment messages or your care.

Who else sees your information

• [Your prescriber, where a treatment requires a prescription.]
• [Other clinicians involved in your care, or a hospital or your GP if you need urgent medical attention.]
• Companies that provide the systems we use to run the clinic, such as our [clinic software, payment provider, email and text message providers]. They act on our instructions and are not permitted to use your information for their own purposes.
• Our insurer and professional advisers, if there is a complaint, a claim or a legal obligation to disclose.
• [Anyone else you have specifically asked us to share information with.]

We do not sell your information, and we do not share it for anyone else’s marketing.

Where it is kept

Your records are held in [name your clinic system] and stored in [the UK / the UK and European Economic Area]. [If any provider stores or accesses data outside the UK, say so here and say what arrangements are in place.]

How long we keep it

We keep your clinical records, including consent forms and clinical photographs, for [insert your retention period], and your financial records for [insert your retention period]. Marketing preferences are kept until you change them. When a retention period ends, we securely delete or destroy the records.

Your rights

You can ask us for a copy of the information we hold about you, ask us to correct anything that is wrong, ask us to delete information where that is possible, object to or restrict how we use it, and withdraw any consent you have given. Contact [name or role] at [email address] and we will respond as quickly as we can, and in any event within the period the law allows.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.

Changes to this notice

We review this notice [annually] and whenever we change how we work. The date at the top shows when it was last updated.

---

How to publish it

• Put it where patients meet you. Your website footer, your booking page and your new patient pack. A notice that only exists in a filing cabinet does not do its job.
• Reference it at the point you collect the data, in one line on your medical history form and booking form: “We explain how we handle your information in our privacy notice at [link].” That single sentence is what turns the notice from a document into a process.
• Keep the photography permission separate. It belongs on its own form, alongside the treatment consent, not buried inside the privacy notice. Our guide to working with aesthetics models covers what a proper photography permission looks like when images are intended for publication.
• Version and date it. Keep the previous versions, so you can show which wording a patient was given at the time they signed up.
• Review it when your suppliers change. Switching clinic software, payment provider or messaging provider changes the “who else sees your information” section, and that is the section most likely to go stale.

Where to get the legal position right

This template deliberately does not tell you what the law requires of your clinic. Data protection duties depend on how you operate, and getting them wrong is expensive, so use primary sources rather than a software company’s template. The ICO’s guidance for organisations covers registration, lawful bases, retention and subject access requests, and its registration self-assessment settles in two minutes whether you need to pay the annual data protection fee. Where registration sits in the broader setup sequence is covered in our checklist for opening a clinic. For retention periods specifically, ask your indemnity provider and your professional body before you commit to a number, because the answer differs by profession and by record type.

Using it in practice

A privacy notice is only as accurate as the systems it describes. If your records live across a paper folder, a phone camera roll, a spreadsheet and a booking app, the notice cannot honestly say where anything is kept or how long it is held, and a subject access request becomes a weekend of archaeology.

AesthetiClinic keeps the medical history, consent versions, treatment records and clinical photographs on one patient record with an audit trail, so “what do you hold about me?” is a screen rather than a search. Photographs stay on the record rather than a phone, marketing consent is stored separately from appointment messaging, and records are held on UK infrastructure. See how the patient record works, or read our own privacy policy and data processing agreement for how we handle data as a supplier to clinics.

The full set of free clinic documents, including the medical history form, treatment record and cancellation policy, is in the template library.

This template is a drafting aid for UK aesthetics clinics, not legal advice. Check the final wording, your legal bases and your retention periods with a suitably qualified adviser before you publish it.