Privacy Policy

Last updated: 9 August 2026

Who We Are

Dr Cristina Clinics and Academies ("we," "us," "our") is a medical aesthetics clinic based at 127 Fonthill Road, London N4 3HH. We are the data controller for the personal information described in this policy.

If you have any questions about this policy or how we handle your data, contact us at info@drcristina.co.uk or +44 772 205 7788.

What Information We Collect

Depending on how you interact with us, we may collect:

  • Contact details — name, email address, phone number, postal address.
  • Booking and appointment information — treatments booked, appointment dates and times, booking history, collected via our booking platforms.
  • Health and medical information — details you share during consultation or booking that are relevant to treatment suitability, such as medical history, allergies, current medications, and previous treatments. This is "special category data" under UK GDPR and is handled with additional care, only used to assess suitability and plan treatment, and only accessed by staff involved in your care.
  • Payment information — processed directly by our payment provider, Stripe; we do not store your full card details ourselves.
  • Technical and usage information — pages visited, how you found the site, general location and device information, collected via analytics and advertising tools when you consent to cookies.

How We Collect Your Information

  • Directly from you, when you book an appointment, attend a consultation, contact us by phone, email, or WhatsApp, or fill in a form on our website.
  • Automatically, through cookies and similar technologies when you browse our website (see Cookies section below).
  • From our service providers, such as booking confirmations passed between our booking platforms and our systems.

How We Use Your Information

We use your information to:

  • Manage bookings, appointments, and your treatment history.
  • Assess suitability for treatments and provide safe, informed care.
  • Process payments for treatments and consultations.
  • Respond to enquiries and provide customer support.
  • Send appointment reminders and essential service communications.
  • Send marketing communications, only where you have opted in, and always with an easy way to opt out.
  • Understand how visitors use our website, to improve it, using analytics.
  • Run and measure the performance of our advertising, where you have consented to advertising cookies.

Legal Basis for Processing

  • Contract — processing needed to book and provide treatments you've requested.
  • Consent — for marketing communications and non-essential cookies (analytics, advertising); you can withdraw consent at any time.
  • Legitimate interests — for essential website functionality and fraud prevention, balanced against your rights.
  • Explicit consent / provision of healthcare — for health and medical information specifically, processed only with your explicit consent and only to the extent necessary to assess suitability and provide safe treatment.

Service Providers We Use

We work with the following providers, who process personal data on our behalf or independently as part of delivering our services. Each has their own privacy policy governing how they handle data:

  • Stripe — payment processing. Stripe handles card details directly; we do not store full payment card information.
  • Amelia — appointment booking and scheduling.
  • Fresha — appointment booking and scheduling.
  • Hostinger — website hosting.
  • Google Ads — advertising, including tracking ad performance where you've consented to advertising cookies.
  • Google Analytics — website analytics, where you've consented to analytics cookies.
  • Rank Math — SEO and technical site functionality (does not itself process visitor personal data beyond standard website operation).
  • Doctify — patient review and reputation management platform; displays patient reviews on our website.
  • WhatsApp (Meta) — used for appointment enquiries and communication where you choose to contact us this way.

Some of these providers are based outside the UK/EU. Where that's the case, we rely on their own data transfer safeguards (such as Standard Contractual Clauses) to ensure your data is protected to UK standards.

Cookies

Our website uses cookies to operate correctly, understand how it's used, and support advertising. You'll be asked to consent to non-essential cookies (statistics and marketing) when you first visit, via our cookie consent banner managed by Complianz; essential cookies needed for the site to function don't require consent. You can change your cookie preferences at any time by reopening the cookie banner (usually via a "Cookie Settings" or "Manage Consent" link in the site footer) or through your browser settings.

How Long We Keep Your Information

We keep personal information only as long as necessary for the purposes described in this policy. For treatment and medical records specifically, we follow the UK standard for private medical records under the Records Management Code of Practice for Health and Social Care: records are retained for a minimum of 8 years from the end of treatment for adult patients. For patients who were under 18 at the time of treatment, records are retained until their 25th birthday, or 8 years from their last appointment, whichever is later.

Other information, such as marketing preferences or website analytics data, is kept only for as long as needed for that purpose, or until you withdraw consent.

Data Security

We use appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, or misuse, including secure hosting, restricted staff access to medical records, and secure payment processing through Stripe. No method of transmission or storage is completely secure, but we take reasonable steps to protect your information.

Your Rights

Under UK GDPR, you have the right to:

  • Access the personal information we hold about you.
  • Ask us to correct inaccurate information.
  • Ask us to delete your information, where applicable.
  • Restrict or object to how we process your information.
  • Request a copy of your information in a portable format.
  • Withdraw consent at any time, where we rely on consent.

To exercise any of these rights, contact us at info@drcristina.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk if you believe we haven't handled your information properly.

Automated Decision-Making

We do not use your personal information for automated decision-making that produces legal or similarly significant effects on you. Treatment suitability is always assessed by a qualified practitioner during consultation, not by automated means.

Children's Privacy

Our services are intended for adults. We do not knowingly collect information from children.

Changes to This Policy

We may update this policy from time to time. The "last updated" date at the top of this page reflects the most recent revision.

Contact Us

Dr Cristina Clinics and Academies
127 Fonthill Road, London N4 3HH
info@drcristina.co.uk
+44 772 205 7788