Privacy Notice

01

Who is responsible for your information?

Youthful Revival Medical Aesthetics is the data controller for the information covered by this notice. This means the clinic decides why and how that information is used.

02

Information we may collect

03

Why we use it and our lawful bases

04

Clinical photographs

Photographs used to assess, plan, deliver or review treatment form part of the confidential clinical record. In this release, photographs are taken by, or supplied directly to, the clinic through an agreed process; the client-portal photo-upload feature is switched off. If that feature is introduced, this notice and the upload safeguards will be updated before clients are invited to use it.

Access to clinical photographs is limited to authorised clinic staff. Any use for education, a website, social media, print or promotion requires a separate, specific choice. Supplying a clinical photograph never gives marketing permission. Refusing marketing photography does not affect your ability to receive care. You may withdraw future marketing permission, although material already lawfully published may not always be fully retrievable.

05

Identity, age and booking restrictions

Your normalised mobile number is used as the primary client reference so that changing email addresses does not split your treatment history, forms or attendance record. For adult-only injectable appointments, we collect date of birth and record that an age check was completed. Photo identification is checked again at the appointment; we record the result and normally do not retain a copy of the identity document.

Your full medical history is kept as a current profile record and is not automatically reissued for every booking. You are asked to confirm whether anything has changed; when you report a change, the signed update is added as a new version and the earlier record remains in the clinical audit trail. Treatment consent is separate: every newly booked treatment receives its own matching consent record linked to that treatment, appointment, form version and signature.

If three consecutive no-shows are recorded, online booking is paused automatically. This is a safety and diary-management safeguard, not a permanent solely automated decision: you can contact the clinic and ask Colleen to review and restore booking access.

For a confirmed home visit, the clinic records when the assigned specialist marks the journey as on the way, the account email used, delivery status and who triggered it. Duplicate-send protection prevents the same status email being sent repeatedly. The message avoids treatment and medical details and is not affected by your marketing choices.

06

Who may receive information?

We only share the minimum information necessary. Recipients may include:

• Colleen and any future verified Youthful Revival specialist assigned to your appointment, each using an individual role-limited account;
• secure hosting, database, authentication, configured email and practice-support suppliers, and an SMS supplier only if SMS is enabled later;
• Stripe and, if you choose them and are eligible, Klarna, Clearpay or PayPal for payments;
• WhatsApp/Meta when you choose to open or continue a WhatsApp conversation;
• your browser or operating-system push service and a Web Push delivery supplier only if app notifications are introduced and you choose to enable them;
• insurers, accountants, legal advisers and professional advisers under confidentiality;
• the MHRA, manufacturer, prescriber, insurer or another appropriate safety body when an adverse event, defective product, counterfeit concern or recall must be investigated or reported;
• regulators, law-enforcement bodies, courts or safeguarding services where disclosure is legally required or necessary; and
• another healthcare professional where necessary for your care, referral or an emergency and a lawful basis applies.

We do not sell patient information or provide it to unrelated organisations for their own marketing.

07A

Marketing SMS and app push, if introduced

Special-offer SMS and app-push sending are not enabled in this release. If Youthful Revival introduces either channel, this notice will be updated before it is used. Each channel will be optional, controlled separately and independent from appointment, aftercare and clinical-safety communications.

If promotional SMS is enabled, messages will identify Youthful Revival and include an appropriate opt-out. If app push is enabled, the app will ask for your choice before the browser displays its permission request, and notification wording will avoid medical history, treatment type and appointment details.

If either channel is introduced, you will be able to turn it off without affecting your care. Browser push permission can also be removed in device settings, and each browser or device will require its own permission.

08

Payments, rewards, finance providers and receipts

When you choose to pay online, the selected payment provider processes payment and anti-fraud information under its own privacy notice. Buy-now-pay-later providers also make their own eligibility and credit decisions; Youthful Revival does not control those decisions. We retain payment references, amounts, status and receipts, but full card credentials should remain with the regulated payment provider. Home visits normally require a £25 deposit after the address and travel time are approved. If Colleen waives that deposit, the booking record may include the override reason, owner identity and time.

Where Colleen agrees individual pricing as the clinic owner, the service, standard price, client price, saving, reason, validity date and change history may be stored on your profile and shown in your client account. At checkout, Colleen may adjust the final price; the system records the original price, final price, reason, owner identity and time, and includes the adjustment on the receipt.

Revival Rewards uses eligible completed payments and refunds from the previous 12 months to calculate a client’s current tier and applicable saving. The Visit Stamp Card records one stamp per eligible completed and paid treatment visit, with a complimentary HydroDermal facial available after six verified visits. Consultations, reviews, no-shows, cancellations, prescription-only medicines or services, voucher purchases, home-visit fees, refunded amounts, chargebacks and the complimentary reward facial are excluded. The facial reward is personal, non-transferable, has no cash value and remains subject to clinical suitability. You may ask us to explain or correct either calculation; any manual adjustment or redemption is recorded with the reason, owner identity and time. Reward status is an administrative benefit and is never used to decide clinical suitability, prescribing or treatment recommendations.

The client-recommendation programme gives an existing client a personal link to share themselves. Youthful Revival does not use that link to cold-contact the recommended person. If a genuine new client chooses to use the link, the recommendation remains pending until their first eligible treatment is completed and the final payment is successfully verified. A booking, free consultation or review, home-visit deposit or fee, voucher purchase, prescription-only medicine or service, cancellation, failed payment, refund or chargeback does not create a credit. Once the conditions are met, one personal £50 credit is created for the referrer’s next eligible treatment. The credit has no cash value, cannot be transferred and is itemised when redeemed. We use normalised contact and account references to prevent self-referral, duplicate claims and repeated redemption, while limiting what either client can see about the other.

09

International processing

Some technology, communication and payment suppliers may process information outside the UK. Before production use, Youthful Revival will identify those transfers and require an approved UK transfer mechanism or other lawful safeguard where needed. Provider privacy notices may give additional information about their locations and safeguards.

10

How long we keep information

We keep information only for as long as it is needed for care, patient safety, complaints, insurance, legal claims, accounting and regulatory requirements. The exact period depends on the record type, your age, the treatment and applicable professional or insurer guidance.

• Clinical notes, consent, treatment records and related photographs follow the clinic’s clinical-record retention schedule.
• Payment and accounting records follow statutory tax and accounting requirements.
• Marketing information is used until you opt out or it is no longer current; a minimal suppression record may be retained to honour an opt-out.
• Enquiries, security logs and incomplete bookings are reviewed and removed when no longer needed.

Records subject to a complaint, safeguarding concern, investigation or legal claim may be kept for longer where necessary. A recorded legal hold pauses routine deletion for the affected information. Before launch, the clinic will approve a documented schedule that names each record type, period, deletion method, review owner and permitted exception.

11

Security

Clinic staff sign in with an individually approved work email and password, followed by a current authenticator-app code. SMS or email alone cannot open the clinical workspace. ClinicKind checks the active practice membership and assigned role before opening it; shared clinic accounts are not permitted. Passwords and authenticator checks are handled by the configured identity provider rather than stored in the public website files.

On the device being used, the clinic workspace hides after 15 minutes without activity and the app requests global sign-out at the eight-hour limit. Moving the app into the background hides patient details, and an authenticator check is required before they are shown again. Session tokens are kept in browser session storage rather than embedded in the application. The app requests patient information only after sign-in and role checks succeed, and no fictitious or real patient records are included in the published public files.

The current release does not enable client photo uploads. Additional safeguards will be described in this notice only after they are configured and verified. No online service can promise absolute security, so safeguards and supplier settings remain under review.

We maintain a factual record of personal-data incidents and the assessment made, whether or not notification is ultimately required. Where a breach is likely to create a risk to people’s rights and freedoms, the clinic follows the applicable notification rules, including reporting to the ICO without undue delay and, where feasible, within 72 hours of becoming aware. People affected are informed without undue delay where the legal high-risk threshold is met.

12

Cookies and browser storage

The independent booking app may use essential browser storage to keep the service working, protect sessions and remember progress. Essential storage does not require an advertising choice. If non-essential analytics or advertising technologies are introduced, the app will provide suitable information and choices before they are used.

13

Your rights

Depending on the circumstances, you may ask for access, correction, erasure, restriction, portability or an objection to how your information is used. You can withdraw a consent choice at any time. You have an absolute right to object to direct marketing. Some rights are limited where the clinic must keep a clinical, legal or financial record.

To make a request, email hello@youthful-revival.co.uk or call 07494 293494. A request can also be recognised when made through another communication channel. We may need to confirm your identity proportionately. Subject access requests are answered without undue delay and normally within one calendar month; a lawful extension or restriction will be explained. Information is searched for across relevant systems and disclosed through an approved secure channel. You may also complain to the UK Information Commissioner’s Office.

14

Changes to this notice

We will update this notice when the app, suppliers, legal bases or clinic practices materially change. The current version and date will always be available here. Where a change significantly affects clients, we will provide an additional notice through an appropriate channel.