Seoul Clinic ("we", "us", or "our") respects your privacy and is committed to protecting your personal and medical data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy explains how we collect, use, store, and safeguard your information when you visit our website (www.seoulclinic.uk) or attend our clinic in London.

Data Controller & Contact Details

Seoul Clinic is the data controller responsible for your personal data. If you have any questions about this policy or how we handle your data, please contact us at:

• Email: contact@seoulclinic.uk

• Website: www.seoulclinic.uk

  
  Information We Collect

• We may collect and process the following categories of personal data:

• Identity & Contact Data: Your full name, date of birth, postal address, email address, telephone number, and emergency contact details.

• Special Category Medical & Health Data: Your medical history, current medications, allergies, skin conditions, consultation notes, consent forms, treatment records, and clinical photographs (before-and-after images) required to safely deliver aesthetic and medical treatments.

• Transaction & Payment Data: Details of bookings and payments made for consultations and treatments. We do not store your full credit or debit card details; all payment transactions are processed securely through our third-party payment providers (Stripe for online bookings and SumUp for in-clinic transactions).

• Technical & Usage Data: IP address, browser type, device information, and website interaction data collected automatically via cookies and analytics tools hosted on Squarespace.

  
  How and Why We Use Your Data (Lawful Basis)

• We only process your personal data when the law allows us to. Under the UK GDPR, our lawful bases include:

• Performance of a Contract: To schedule appointments, process payments, send booking confirmations/reminders, and provide our services to you.

• Provision of Health or Medical Care (Special Category Data): To assess your clinical suitability, safely administer aesthetic treatments, maintain accurate medical records, and provide appropriate aftercare.

• Legal & Regulatory Obligations: To comply with medical recordkeeping requirements, insurance obligations, tax laws, and regulatory standards in the UK.

• Legitimate Interests: To manage our clinic operations, improve our website and services, and respond to your enquiries.

• Consent: Where you explicitly opt in to receive marketing communications or agree to the use of clinical photographs for educational or promotional purposes (which requires a separate, specific consent form). You may withdraw this consent at any time.

  
  Sharing Your Personal Data

• We do not sell or rent your personal data to third parties. We only share your data with trusted third-party service providers where necessary to operate our clinic:

• Website & Hosting Provider: Squarespace (for website hosting, enquiry forms, and analytics).

• Payment Processors: Stripe and SumUp (for secure payment processing).

• Clinical & Administrative Systems: Secure clinic management software, pharmacy partners (where prescriptions are required), and our medical indemnity insurers or legal advisers if required for regulatory or legal compliance. All third-party processors are required to safeguard your data in compliance with UK data protection laws.

  
  Data Security & Retention

• We implement strict technical and organisational security measures to protect your personal and medical information from unauthorised access, loss, or disclosure.

• Medical Records: In line with UK medical and insurance guidelines, clinical records, consent forms, and treatment notes are retained securely for a minimum of 8 years following your last treatment with us.

• General Enquiries: Data from individuals who make an enquiry but do not proceed with a consultation or treatment is securely deleted within 12 months.

  
  Cookies & Tracking Technologies

• Our website uses cookies to ensure core functionality, enhance your browsing experience, and analyse site traffic. You can manage your cookie preferences at any time via the cookie banner displayed on our website or through your browser settings.

  
  Your Legal Rights

  Under the UK GDPR, you have the right to:

• Request access to the personal data we hold about you (Subject Access Request).

• Request correction of any incomplete or inaccurate data.

• Request erasure of your personal data (subject to our legal and medical recordkeeping obligations, which may prevent the deletion of clinical records).

• Object to or request restriction of the processing of your data.

• Withdraw your consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at contact@seoulclinic.uk. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at www.ico.org.uk if you believe your data has not been handled in accordance with the law.