KAYORA CLINIC Privacy Policy Confidence, Scientifically Refined. Last updated: 14 October 2026 1. Introduction At Kayora Clinic, we respect your privacy and are committed to protecting your personal and medical information. This policy explains how we collect, use, store and protect your information when you visit our website, book appointments, attend consultations or receive treatments. Kayora Clinic is a UK-based, doctor-led aesthetics and skin health practice operating as a sole-trader business. Data Controller: [Full legal name], trading as Kayora Clinic ICO Registration Number: [Insert registration number] Business Contact Address: [Insert business correspondence address] Email: hello@kayoraclinic.com Website: www.kayoraclinic.com We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable legislation. 2. Information We Collect We may collect the following information: * Personal details, including your name, date of birth, telephone number and email address. * Medical information, including relevant medical history, medications, allergies and health conditions. * Consultation notes, clinical assessments and treatment records. * Clinical photographs taken for assessment, treatment planning or monitoring. * Appointment history, booking details and payment records. * Communications and enquiries submitted through our website, booking system or email. We collect only information reasonably necessary for the services we provide. 3. How We Use Your Information Your information may be used to: * Arrange and manage appointments. * Conduct consultations and assess treatment suitability. * Provide safe, appropriate and personalised care. * Maintain accurate clinical records. * Provide aftercare and follow-up support. * Process payments and refunds. * Respond to enquiries and communicate important appointment information. * Meet professional, legal and regulatory responsibilities. * Manage the security and administration of our services. We do not sell your personal information. 4. Our Legal Basis for Processing Under Article 6 of the UK GDPR, we rely on appropriate lawful bases depending on the purpose of processing, including: * Contract: To arrange and deliver services you request. * Legal obligation: To comply with applicable legal requirements. * Legitimate interests: To manage and protect our practice, where those interests are not overridden by your rights. * Consent: For specific activities where consent is required, such as certain marketing communications. Health information receives additional protection as special-category data under Article 9 of the UK GDPR. For clinical care and treatment records, we generally rely on the condition relating to the provision of healthcare by a professional subject to confidentiality obligations, where the legal requirements for that condition are met. Clinical consent to treatment is separate from the lawful basis used to process personal data. 5. How We Store and Protect Your Information Kayora Clinic uses AesthetiClinic, a practice management system, to manage patient appointments, consultations and clinical records. We take appropriate technical and organisational measures to protect your information, including access controls, secure systems and confidentiality safeguards. Only authorised individuals with a legitimate need may access patient information. We also take reasonable steps to protect information communicated through our website, email and other approved systems. 6. Sharing Your Information We may share relevant personal information with: * AesthetiClinic and other service providers supporting our clinical and administrative systems. * Payment processing providers. * Other healthcare professionals when necessary for your care and where disclosure is appropriate. * Regulatory, safeguarding or legal authorities when required or permitted by law. Service providers processing information on our behalf must be subject to appropriate contractual and data protection safeguards. We do not share identifiable patient information for unrelated commercial advertising. Where personal information is transferred outside the UK, we will ensure that an appropriate lawful transfer mechanism or applicable adequacy arrangement is in place. 7. Clinical Photography Clinical photographs may be taken where appropriate to document your skin concerns, support treatment planning or monitor clinical progress. These photographs form part of your confidential clinical records. We will not use identifiable clinical photographs for social media, advertising, testimonials or promotional materials without obtaining separate, appropriate permission. Refusing promotional photography will not affect your access to clinical care. 8. How Long We Keep Your Information We retain personal and clinical information for as long as necessary to fulfil the purposes described in this policy and comply with applicable legal and professional requirements. Clinical records are retained in accordance with the retention schedule adopted by Kayora Clinic, taking account of relevant healthcare recordkeeping guidance, professional obligations and the nature of the treatment. Other information, including financial and administrative records, is retained for the applicable statutory or operational period. Clinical record retention schedule: [Insert confirmed retention periods, including arrangements for children’s records if applicable.] At the end of the applicable retention period, information will be securely deleted or disposed of unless continued retention is legally justified. 9. Your Data Protection Rights Subject to applicable legal conditions and exemptions, you may have the right to: * Request access to your personal information. * Request correction of inaccurate or incomplete information. * Request deletion of information in certain circumstances. * Restrict or object to certain processing. * Request transfer of eligible personal information. * Withdraw consent where processing relies on consent. Some rights may be restricted where we must retain clinical information for legal, regulatory or professional reasons. To exercise your rights, please contact: hello@kayoraclinic.com We will respond within the time limits required by data protection law. 10. Marketing Communications We will only send promotional communications where permitted by applicable data protection and electronic marketing laws. Where consent is required, we will obtain it before sending marketing messages. You may opt out of marketing communications at any time. Appointment reminders and essential clinical communications are not treated as promotional marketing. 11. Website and Cookies Our website may use cookies and similar technologies to support functionality, security and user experience. Where non-essential cookies or tracking technologies are used, we will provide appropriate information and obtain consent where required. Further information will be provided through our website’s cookie notice or settings, where applicable. 12. Complaints and Concerns If you have concerns about how Kayora Clinic handles your personal information, please contact us first so we can investigate. Email: hello@kayoraclinic.com You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator. Website: www.ico.org.uk 13. Updates to This Policy We may update this privacy policy periodically to reflect changes in our services, legal requirements or information-handling practices. The latest version will be available through our website and booking platform. Kayora Clinic Confidence, Scientifically Refined. www.kayoraclinic.com hello@kayoraclinic.com