IH AESTHETICS SANCTUARY LTD PRIVACY POLICY AND PRIVACY NOTICE Effective date: 1 January 2026 Last reviewed: 4 August 2026 Next scheduled review: 1 January 2020 1. Introduction IH Aesthetics Sanctuary Ltd respects your privacy and is committed to protecting the confidentiality, integrity and security of your personal information. This Privacy Policy explains how IH Aesthetics Sanctuary Ltd collects, uses, stores, protects, retains and shares personal information when you: * Make an enquiry; * Visit our website or social-media pages; * Use our online booking platform; * Book or attend a consultation, assessment, treatment or review; * Complete a medical-history, consultation, consent, treatment-record, aftercare or feedback form; * Communicate with us by telephone, email, text message, social media or another method; * Make a payment; * Provide or allow us to take clinical photographs; * Make a complaint, request or data-protection enquiry; or * Otherwise receive services from IH Aesthetics Sanctuary. This policy applies to personal information processed electronically and in paper form. We process personal information in accordance with: * The UK General Data Protection Regulation (“UK GDPR”); * The Data Protection Act 2018; * The Privacy and Electronic Communications Regulations 2003 (“PECR”), where applicable; * Relevant professional confidentiality requirements; and * Other applicable UK laws and regulatory requirements. 2. Data controller and contact details For the purposes of UK data-protection law, the data controller is: IH Aesthetics Sanctuary Ltd Company number: 16134973 Registered office: 18 Kingston Road, New Malden, England, KT3 3LS Clinic trading address: Talex Beauty Studio 194 Cheam Common Road Worcester Park London KT4 8QW Email: info@ihaestheticssanctuary.co.uk Instagram: @ih_aesthetics_sanctuary IH Aesthetics Sanctuary Ltd determines why and how personal information is processed in connection with its services. Data-protection enquiries and requests should be sent to: Email: info@ihaestheticssanctuary.co.uk IH Aesthetics Sanctuary Ltd is registered with the Information Commissioner’s Office (“ICO”) as a data controller. ICO registration reference: ZB951877 Date registered: 4 August 2025 Current registration expiry date:** 3 August 2027 The clinic will maintain its ICO registration for as long as registration remains legally required. 3. Our data-protection commitments IH Aesthetics Sanctuary will process personal information lawfully, fairly and transparently. We will: * Collect personal information only for specified, explicit and legitimate purposes; * Collect only information that is adequate, relevant and reasonably necessary; * Take reasonable steps to ensure information is accurate and current; * Retain information only for as long as necessary; * Protect information against accidental or unlawful loss, destruction, alteration, disclosure or access; * Restrict access to people who require the information for an authorised clinical, legal or administrative purpose; * Respect professional duties of confidentiality; * Maintain appropriate records of our data-processing activities; * Review the organisations that process information on our behalf; * Respect clients’ data-protection rights; and * Take reasonable steps to demonstrate compliance with applicable data-protection law. All personal information, including health information and other special category personal data, will be stored and processed in accordance with applicable UK data-protection law. 4. Personal information we may collect The information collected will depend on your relationship with the clinic and the services you request. 4.1 Identity and contact information We may collect: * Full name and preferred name; * Date of birth and age; * Pronouns, where voluntarily provided; * Home address and postcode; * Telephone number; * Email address; * Occupation, where relevant or voluntarily provided; * Emergency-contact details; * GP or other healthcare-professional details; * Signature; * Client, appointment or booking reference; * Proof of age or identity, where reasonably required; and * Details of an authorised representative, where applicable. 4.2 Appointment and administrative information We may collect: * Enquiries and consultation requests; * Appointment dates and attendance history; * Cancellations, rescheduling and failures to attend; * Treatment interests, requests and preferences; * Referral source; * Correspondence and communication records; * Forms, declarations and acknowledgements; * Records showing which policies or terms were accepted; * Complaints, concerns, feedback and their outcomes; * Booking restrictions; * Aftercare communications; and * Other administrative information necessary to manage your relationship with the clinic. 4.3 Financial and transaction information We may collect: * Treatments or services purchased; * Booking fees, treatment charges and refunds; * Payment dates and transaction references; * Invoices and receipts; * Outstanding balances; * Limited payment-card information supplied by the payment processor, such as card type or the final digits of the card; * Records required for accounting, taxation and financial reconciliation; and * Information reasonably necessary to prevent or investigate fraudulent transactions. Complete card details and card security codes are processed by an authorised payment provider. IH Aesthetics Sanctuary does not ordinarily receive or store your complete card number or card security code. 4.4 Medical and clinical information To assess suitability and provide treatment safely, we may collect: * Medical history and current health status; * Medical, dental and psychological conditions relevant to treatment; * Allergies, sensitivities and previous allergic reactions; * Prescribed and non-prescribed medicines; * Vitamins, herbal preparations and supplements; * Pregnancy, breastfeeding or fertility-treatment information; * Previous and planned medical, dental, surgical or aesthetic procedures; * Vaccination information where relevant to treatment timing or safety; * Previous aesthetic treatments, products used and outcomes; * Contraindications and relevant risk factors; * Smoking, sunbed use and other relevant lifestyle information; * Mental-health or psychological information where relevant to capacity, consent, expectations or treatment suitability; * Clinical assessments, observations and treatment plans; * Consent discussions and signed consent records; * Products administered and quantities used; * Product batch or lot numbers and expiry dates; * Treatment sites, techniques, anatomical areas and treatment records; * Needle, cannula or device information where relevant; * Practitioner, pharmacy and prescriber information; * Treatment responses, results and reviews; * Complications, adverse events and corrective treatment; * Aftercare provided; * Referrals and communications with healthcare professionals; and * Other information necessary to create a complete and accurate clinical record. 4.5 Photographs and recordings We may collect: * Photographs submitted before an appointment; * Standardised before-and-after clinical photographs; * Images used for assessment, treatment planning, documentation and monitoring; * Images documenting a complication or adverse event; * Facial or body-treatment mapping images; * Photographs or recordings used for professional education or training where an appropriate lawful basis and consent process applies; and * Photographs or recordings intended for marketing, but only where separate, specific and optional consent has been obtained. Clinical photography and marketing photography are treated as separate purposes. A photograph taken for a confidential clinical purpose will not automatically be used for marketing, social media or advertising. 4.6 Technical and online information When you use our website, online booking system or electronic forms, we may receive: * IP address; * Browser and device information; * Login, booking and form-completion activity; * Date, time and method of access; * Cookie preferences; * Website analytics, where permitted; * Communication-delivery records; * Security and audit information; and * Technical information needed to maintain and protect our systems. Further information about cookies should be provided through the relevant website cookie notice or consent tool. 5. Special category personal data Health information is classified as special category personal data under the UK GDPR and receives additional legal protection. Other information may also constitute special category data if it reveals or concerns: * Racial or ethnic origin; * Religious or philosophical beliefs; * Genetic or qualifying biometric information; * Health; * Sex life; or * Sexual orientation. IH Aesthetics Sanctuary may process special category personal data where necessary to: * Assess medical and clinical suitability; * Identify contraindications and treatment risks; * Obtain and document informed consent; * Provide treatment safely; * Maintain complete and accurate clinical records; * Provide aftercare; * Manage complications or adverse events; * Liaise with prescribers or other healthcare professionals; * Meet professional, insurance, safeguarding or regulatory requirements; * Investigate complaints; or * Establish, exercise or defend legal claims. Processing special category data requires both a lawful basis under Article 6 of the UK GDPR and an appropriate condition under Article 9. Depending on the particular purpose and circumstances, the Article 9 condition may include: Article 9(2)(a): explicit consent, where you have expressly agreed to a specific use; Article 9(2)(h): health or care treatment, where the applicable legal conditions are satisfied and processing takes place by, or under the responsibility of, a professional subject to confidentiality obligations; Article 9(2)(f): legal claims, where processing is necessary to establish, exercise or defend a legal claim; or Article 9(2)(c): vital interests, in a genuine emergency where processing is necessary to protect a person’s life and that person is physically or legally unable to consent. Where the Data Protection Act 2018 requires an additional Schedule 1 condition, Appropriate Policy Document, Data Protection Impact Assessment or other safeguard, the clinic will maintain the required documentation. 6. Why we use personal information We may use your information to: * Respond to enquiries; * Arrange and administer appointments; * Confirm your identity and age; * Assess clinical suitability; * Review your medical history and medications; * Plan and provide treatments; * Obtain prescribing input where required; * Maintain clinical records; * Provide aftercare and follow-up; * Monitor treatment progress; * Identify and manage complications or adverse events; * Communicate safety information; * Process booking fees, treatment payments and refunds; * Send appointment confirmations and reminders; * Manage cancellations, rescheduling and failures to attend; * Respond to complaints and concerns; * Defend or pursue legal claims; * Meet professional, insurance, accounting, taxation and legal requirements; * Protect our clients, practitioners, systems and business; * Prevent or investigate fraud, misuse or security incidents; * Improve our services; * Send marketing where permitted; and * Use photographs or recordings for separately agreed purposes. 7. Lawful bases for processing We will only process personal information where an appropriate lawful basis applies. 7.1 Contract and steps before entering a contract We may process information where necessary to: * Respond to a request for a consultation or treatment; * Create and manage a booking; * Assess whether we can provide a requested service; * Provide a consultation or treatment; * Process a booking fee or payment; * Send information connected with the service; or * Manage contractual obligations. 7.2 Legal obligation We may process information where necessary to comply with applicable legal duties, including requirements relating to: * Taxation and accounting; * Data protection; * Medicines and prescribing; * Court orders; * Regulatory investigations; * Safeguarding; * Health and safety; and * Reporting or record-keeping obligations. 7.3 Legitimate interests We may process information where it is necessary for our legitimate interests or those of another person, provided those interests are not overridden by your rights. Our legitimate interests may include: * Operating and protecting the clinic; * Maintaining accurate clinical and business records; * Delivering safe and effective services; * Providing appropriate aftercare; * Investigating concerns, complaints and adverse events; * Preventing fraud or misuse; * Securing our systems; * Maintaining evidence for insurance and legal purposes; * Recovering lawful debts; * Improving our services; and * Protecting clients, practitioners and the public. Where we rely on legitimate interests, we will consider whether the processing is necessary and proportionate and whether your rights override those interests. 7.4 Consent We may rely on consent for specific optional activities, including: * Electronic direct marketing where consent is required; * Public use of identifiable photographs or recordings; * Certain educational or promotional uses; and * Other processing where consent is the most appropriate lawful basis. 7.5 Vital interests In an emergency, we may use or disclose information where necessary to protect your life or the life of another person. 8. Consent and withdrawal of consent Consent for aesthetic treatment is separate from consent for data processing. Where we rely specifically on your consent or explicit consent to process information, you may withdraw that consent at any time by contacting: info@ihaestheticssanctuary.co.uk Withdrawal of consent: * Does not affect processing that was lawful before consent was withdrawn; * Does not automatically require deletion of information we must retain under another lawful basis; * Will stop the relevant consent-based processing wherever reasonably possible; and * May mean we cannot provide a service if the information is genuinely necessary to assess or deliver that service safely. You may refuse or withdraw consent for marketing or public use of photographs without affecting your eligibility for clinical care. Withdrawal of marketing-photography consent will prevent new clinic-controlled use wherever reasonably possible. It may not be possible to recall printed material already distributed or copies subsequently made by third parties following lawful publication. 9. Clinical photography Clinical photographs may be necessary to: * Record your presentation before treatment; * Support facial, skin or body assessment; * Plan treatment; * Document treatment sites; * Compare treatment progress; * Assess results; * Investigate concerns or complications; * Support continuity of care; and * Maintain an accurate clinical record. Clinical photographs form part of the confidential clinical record where they are necessary for treatment, assessment, documentation, safety or follow-up. Clinical photography is a mandatory requirement of treatment at IH Aesthetics Sanctuary Ltd. This requirement is in place in accordance with professional indemnity insurance obligations and clinical governance standards. Before-and-after clinical photographs will be taken as part of your medical record for all treatments where this is required for safe practice, documentation and insurance compliance. If a client does not consent to the taking and storage of clinical photographs for medical record-keeping purposes, treatment cannot proceed, as it would not be possible to meet insurance, clinical safety and professional record-keeping requirements. Clinical photographs will not be published solely because they were taken for a clinical purpose. Separate, specific and optional consent will be requested before an identifiable image or recording is used for: * Social media; * The clinic website; * Advertising; * Printed promotional materials; * Public presentations; * External education or training; or * Any purpose not reasonably necessary for your direct care or the clinic’s legal obligations. Where relevant, we will explain: * Which images or recordings may be used; * Whether you will be identifiable; * The intended purpose; * The proposed platforms or media; * The intended audience; and * How to withdraw consent for future use. Booking or attending an appointment does not constitute consent to marketing, filming, live streaming or publication. 10. Direct marketing Where permitted, we may send information about: * Treatments and services; * New services; * Events; * Appointment availability; * Offers; and * Relevant clinic news. Marketing consent is optional and is not a condition of receiving treatment. You may opt out at any time by: * Selecting the unsubscribe option in the communication; * Replying with an opt-out request; or * Emailing info@ihaestheticssanctuary.co.uk We may retain a minimal suppression record to ensure that your opt-out continues to be respected. Appointment confirmations, payment communications, safety information, aftercare instructions and direct responses to enquiries are administrative or clinical communications rather than marketing. We will not sell your information or provide it to another organisation for that organisation’s independent marketing without your specific consent. 11. How we collect information We may collect information: * Directly from you; * Through forms you complete; * During consultations, treatments and reviews; * Through the clinic’s booking platform; * Through the clinic website; * Through telephone, email, text, messaging or social media; * From an independent prescriber; * From another healthcare professional involved in your care; * From an authorised representative; * From payment processors; * From a person making a referral; * From product suppliers or manufacturers investigating an adverse event; * From publicly available sources where necessary and lawful; or * In an emergency, from a relative, companion or healthcare professional. Where information is obtained from another source, we will provide appropriate privacy information within the period required by law unless an exemption applies. 12. Information you need to provide You are not generally required by law to provide personal information merely to make an initial enquiry. However, certain identity, contact, medical, clinical and consent information is necessary before we can safely assess or provide treatment. If you do not provide relevant information, or provide incomplete or inaccurate information, we may be unable to: * Process or confirm your booking; * Determine clinical suitability; * Obtain valid informed consent; * Arrange prescribing; * Provide treatment safely; * Respond safely to a complication; * Process a payment or refund; or * Meet our professional and legal responsibilities. You must inform the clinic if relevant information changes, particularly your: * Contact details; * Medical history; * Current medication; * Allergies; * Pregnancy or breastfeeding status; * Recent or planned dental treatment; * Recent or planned surgery; * Recent vaccination history; or * Other information that could affect treatment safety. 13. Sharing personal information We will not routinely disclose personal information outside IH Aesthetics Sanctuary unless there is a lawful and legitimate reason. Where necessary and proportionate, information may be shared with: * Practitioners providing your consultation or treatment; * Independent prescribers; * Pharmacies; * Healthcare professionals involved in your care; * Emergency services; * Your GP or another clinician, normally with your knowledge unless an emergency, safeguarding concern or other lawful justification applies; * AesthetiClinic or another authorised clinic-management and booking provider; * Jotform or another authorised electronic-form provider where used; * Stripe or another authorised payment processor; * Secure email, communication, website-hosting, cloud-storage and IT providers; * Accountants, bookkeepers, legal advisers and insurers; * Product manufacturers, pharmacies or suppliers where necessary to investigate an adverse event, complaint, product defect or recall; * Professional regulators; * The Information Commissioner’s Office; * Safeguarding, public-health or law-enforcement authorities where disclosure is required or permitted by law; * Courts, tribunals and legal representatives; * Debt-recovery or fraud-prevention services where proportionate and lawful; and * A prospective purchaser or professional adviser in connection with a genuine business sale, restructuring or transfer, subject to appropriate confidentiality safeguards. Only information reasonably necessary for the relevant purpose will be shared. Service providers acting as data processors must process information under appropriate instructions, protect it securely and comply with applicable contractual and legal requirements. Where another healthcare professional creates their own clinical or prescribing record and determines its use, that professional may act as an independent data controller. Their own privacy information may also apply. 14. Talex Beauty Studio IH Aesthetics Sanctuary operates from premises within Talex Beauty Studio. Talex Beauty Studio does not automatically receive access to confidential IH Aesthetics Sanctuary medical records, clinical forms or treatment photographs merely because the clinic operates from its premises. Information will only be shared with Talex Beauty Studio where this is necessary, lawful and appropriately disclosed—for example, limited information required for premises access, appointment coordination or safety. 15. Confidentiality and disclosure without consent IH Aesthetics Sanctuary owes clients a professional duty of confidentiality. There may be limited circumstances in which information is disclosed without consent, including where: * Disclosure is required by law; * A court or regulator lawfully requires the information; * It is necessary to protect your life or another person’s life; * There is a serious safeguarding concern; * There is a significant risk of serious harm; * Disclosure is necessary to establish, exercise or defend a legal claim; * A product-safety investigation or recall requires disclosure; or * Another lawful exemption or justification applies. Where appropriate and lawful, we will inform you about the disclosure. We will disclose no more information than is reasonably necessary. 16. International transfers Some booking, payment, communication, form, cloud-hosting or IT providers may process information outside the United Kingdom. Where personal information is transferred internationally, we will take reasonable steps to ensure that an appropriate legal transfer mechanism is in place. This may include: * UK adequacy regulations; * The UK International Data Transfer Agreement; * The UK Addendum to approved standard contractual clauses; or * Another safeguard permitted under the UK GDPR. Where required, we will assess whether additional technical or organisational safeguards are necessary. Information about applicable transfer safeguards may be requested by contacting: info@ihaestheticssanctuary.co.uk 17. How we protect personal information IH Aesthetics Sanctuary uses technical, physical and organisational safeguards appropriate to the nature and sensitivity of the information processed. These may include: * Password-protected systems; * Multi-factor authentication where supported; * Encryption in transit and, where available, at rest; * Role-based and need-to-know access; * Secure device controls; * Secure backups; * Audit trails and access logs; * Confidentiality requirements; * Secure storage and disposal of paper records; * Secure booking, form and payment providers; * Software updates and malware protection; * Incident-response procedures; * Review of access permissions; * Data minimisation; * Professional and data-protection training; and * Secure deletion or destruction processes. No electronic system can be guaranteed to be completely risk-free. However, we take reasonable and proportionate measures to protect personal information against unauthorised access, accidental loss, alteration, destruction or disclosure. Clients should avoid sending sensitive clinical photographs or detailed medical information through public comments or insecure communication channels. Where available, information should be submitted through the clinic’s approved forms or systems. 18. Personal data breaches A personal data breach may include accidental or unlawful loss, destruction, alteration, unauthorised disclosure of, or access to personal information. If a suspected or confirmed breach occurs, IH Aesthetics Sanctuary will: * Act promptly to contain and investigate it; * Assess the potential effect on affected individuals; * Record the breach and the response; * Take reasonable steps to reduce further risk; * Notify the ICO without undue delay and, where required, within 72 hours of becoming aware of the breach; and * Inform affected individuals without undue delay where the breach is likely to create a high risk to their rights and freedoms. 19. How long we retain information We will not keep personal information indefinitely. Retention periods depend on: * The nature and purpose of the information; * Professional and clinical record-keeping requirements; * Insurance conditions; * Medicines and prescribing requirements; * Taxation and accounting law; * Complaint and legal limitation periods; * Product-recall requirements; and * Whether an adverse event, complaint, investigation or legal claim exists. Our general retention approach is as follows. Adult clinical records Consultation forms, medical histories, consent forms, treatment records, clinical photographs and related clinical communications will normally be retained for a minimum of eight years after the last treatment or last clinical entry. Records may be retained longer where required by an insurer, prescriber, applicable professional requirement, investigation, complaint, adverse event, safeguarding concern or legal claim. Prescribing and medicine-related records Prescribing, pharmacy and medicine-administration records will be retained in accordance with applicable medicines, prescribing, professional, pharmacy, insurance and legal requirements. Complications, adverse events and complaints Records relating to complications, adverse events, complaints, safeguarding matters and legal claims will be retained for the applicable legal or insurance period and longer where an investigation, complaint, regulatory process or legal proceeding remains open or reasonably anticipated. Financial and taxation records Invoices, transaction information and accounting records will normally be retained for at least six years after the end of the relevant financial period, or longer where legally required. Enquiries that do not lead to treatment Enquiries that do not lead to an appointment or treatment will normally be retained for up to 24 months, unless longer retention is necessary because of a complaint, safeguarding matter, safety concern or legal claim. Appointment and communication records Appointment and communication records will be retained for as long as reasonably necessary for clinical, contractual, accounting, complaint, safety or legal purposes. Marketing records Marketing contact details will be retained until consent is withdrawn, the person unsubscribes or the information is no longer required. A minimal suppression record may be retained to ensure that a marketing opt-out continues to be respected. Marketing photographs and recordings Marketing photographs and recordings will be used for the period covered by the relevant consent or until consent is withdrawn for future use, subject to the limitations relating to material already lawfully published or distributed. Security logs and analytics Website, system-security and analytics information will be retained according to the relevant provider settings and cookie notice and only for as long as reasonably necessary. At the end of an applicable retention period, information will be securely deleted, destroyed or irreversibly anonymised. 20. Your data-protection rights Depending on the circumstances and the lawful basis used, you may have the right to: * Be informed about how your information is used; * Request access to your personal information; * Request correction of inaccurate or incomplete information; * Request deletion of information; * Request restriction of processing; * Object to processing based on legitimate interests; * Object to direct marketing; * Receive certain information in a portable, machine-readable format; * Withdraw consent where processing relies on consent; and * Request human review where a legally or similarly significant decision is made solely through automated processing. These rights are not absolute. For example, we may need to retain an accurate clinical record despite a deletion request because of legal, professional, insurance, safety or legal-claims requirements. Where a clinical record needs correction, we may retain the original entry and add an auditable correction rather than deleting the original record. You have an absolute right to object to the use of your personal information for direct marketing at any time. You may also object to processing based on legitimate interests. If you object, we will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for legal claims. 21. Exercising your rights Requests should be sent to: Email: info@ihaestheticssanctuary.co.uk Please explain which information or processing your request concerns. We may request reasonable proof of identity before disclosing information or making a significant change to a record. This is to protect personal information from unauthorised access. We will normally respond without undue delay and within one month. Where a request is complex or several requests have been made, the response period may be extended as permitted by law. We will explain the reason and applicable timeframe. We will not normally charge a fee. A reasonable fee may be charged, or a request refused, where it is manifestly unfounded or excessive, as permitted by law. 22. Automated decision-making IH Aesthetics Sanctuary does not currently make treatment or eligibility decisions based solely on automated processing where those decisions produce legal or similarly significant effects. Clinical suitability and treatment decisions are made by an appropriately qualified practitioner using professional judgement. If this changes, this policy will be updated and affected individuals will be provided with the information and rights required by law. 23. Children and people under 18 IH Aesthetics Sanctuary does not provide cosmetic injectable treatments to anyone under 18. If information concerning a person under 18 is received through an enquiry, it will be processed only as necessary to: * Respond to the enquiry; * Verify age; * Protect the person’s safety; * Meet safeguarding responsibilities; or * Comply with the law. We will not knowingly use a child’s personal information for marketing. 24. Third-party websites, booking services and social media Our website, booking communications or social-media pages may contain links to independent third-party websites or services. Those organisations control their own privacy practices. You should review their privacy notices before providing information through their services. Information sent through social-media platforms may also be processed by the relevant platform provider under its own terms. Sensitive medical information and clinical photographs should preferably be submitted through the clinic’s approved secure forms or systems rather than through public comments or social-media messages. 25. Changes to this policy We may update this Privacy Policy where: * Our services or systems change; * We appoint or change a service provider; * Our professional or insurance requirements change; * Data-protection law or ICO guidance changes; * Our use of personal information changes; or * Stronger safeguards or clearer information are required. The current version and effective date will be displayed through the clinic website or booking platform. Where a change materially affects how existing personal information is used, we will take reasonable steps to bring the change to the attention of affected individuals and obtain consent where legally required. 26. Questions and complaints If you have a question, concern or complaint about how IH Aesthetics Sanctuary uses your personal information, please contact us first: IH Aesthetics Sanctuary Ltd 18 Kingston Road New Malden England KT3 3LS Clinic trading address: Talex Beauty Studio 194 Cheam Common Road Worcester Park London KT4 8QW Email: info@ihaestheticssanctuary.co.uk We will investigate data-protection concerns fairly and respond as soon as reasonably possible. You also have the right to complain to the Information Commissioner’s Office: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Telephone: 0303 123 1113 Website: https://ico.org.uk/make-a-complaint/data-protection-complaints/ You may contact the ICO at any time, although the ICO will normally expect you to raise the matter with the organisation first. 27. Acknowledgement of this policy By submitting personal information to IH Aesthetics Sanctuary, you acknowledge that you have been given access to this Privacy Policy and have had the opportunity to read it. Acknowledging or accepting this Privacy Policy does not: * Remove or restrict any statutory right; * Constitute consent to marketing; * Constitute consent to public use of photographs or recordings; * Replace informed consent to treatment; * Permit the clinic to process information for undisclosed purposes; or * Prevent you from exercising your data-protection rights. Where consent is the applicable lawful basis, it will be requested separately, specifically and clearly.