Booking

Privacy Policy

1. About this policy

This Privacy Policy explains how Flow Aesthetics (“we”, “us” or “our”) collects and uses personal information when you visit flowaesthetics.co.uk, contact us, enquire about a treatment or arrange an appointment. We provide non-surgical beauty and aesthetic treatments in Plymouth and the surrounding area.

Our published contact details are: Flow Aesthetics, 23 Mayflower Street, Plymouth, Devon, PL1 1QJ; info@flowaesthetics.co.uk; 01752 936 511.

Important: The website describes the business as “Flow Aesthetics Ltd”, but the precise current legal entity responsible for the clinic and its data processing should be confirmed. In this policy, “Flow Aesthetics” refers to the clinic operating the website. This wording does not determine its legal status.

2. Personal information we may collect

  • Contact and enquiry details: name, email address, telephone number and the contents of messages submitted through our contact form or sent to us directly.
  • Appointment information: appointment requests, booking details, treatment enquiries, communications about appointments and relevant service history.
  • Treatment and consultation information: information you choose to provide about your treatment preferences, skin, health, allergies, sensitivities, contraindications or relevant medical history. Some of this may be special-category health data under UK data protection law.
  • Transaction information: details needed to administer purchases, payments, refunds or treatment finance enquiries. We do not intend to collect or store full payment-card security details through this website.
  • Technical information: IP address, device and browser information, website usage and cookie or similar technology data, where collected.

3. How we collect information

We may collect information directly when you complete a website form, email or telephone us, attend a consultation or treatment, or make a booking. The website links to the Fresha booking platform. If you use that platform, information may also be collected and processed by Fresha under its own privacy terms. Please review the provider’s privacy information before submitting information through its service.

We may also receive information from service providers involved in operating our website, booking, communications, payment or finance processes, where applicable.

4. How we use personal information

  • To respond to enquiries and provide requested information.
  • To arrange and administer consultations, appointments and treatments.
  • To assess treatment suitability, discuss relevant risks and support safe service delivery.
  • To manage payments, refunds, finance-related enquiries and customer service.
  • To operate, maintain, protect and improve our website and services.
  • To meet legal, regulatory, insurance and record-keeping obligations.
  • To send marketing communications where permitted by law and, where required, with your consent.

5. Lawful bases for processing

Depending on the circumstances, we rely on one or more of the following lawful bases: taking steps at your request before entering into a contract and performing a contract; compliance with legal obligations; our legitimate interests in operating and improving the clinic and website, provided those interests are not overridden by your rights; and your consent.

Where we process health information or other special-category data, we will also identify and rely on an applicable additional condition under Article 9 UK GDPR and the Data Protection Act 2018. This may include explicit consent where appropriate or another condition permitted by law. We will explain the relevant basis when collecting such information. You may withdraw consent where consent is the basis, although this will not affect processing already carried out lawfully.

6. Sharing information

We may share relevant information with service providers who support the clinic, such as website hosting and maintenance providers, booking platforms, email and communications providers, payment processors, finance providers, insurers, professional advisers and regulators or public authorities where legally required. We only share information where there is an appropriate purpose and lawful basis.

The website currently links to Fresha for bookings and refers to treatment finance options. The specific providers, their roles and the data they receive should be checked against the services actually configured by the clinic. We do not name an unverified payment or finance provider in this policy.

We do not sell personal information.

7. International transfers

Some suppliers may process information outside the United Kingdom. Where personal data is transferred internationally, we will ensure that an appropriate UK GDPR transfer safeguard is in place, such as UK adequacy regulations or an approved contractual safeguard, together with any additional measures required by law.

8. How long we keep information

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including providing services, maintaining appropriate treatment and business records, resolving complaints and meeting legal or insurance requirements. Retention periods may differ for enquiries, booking records, treatment and consultation records, financial records and marketing preferences.

We have not published fixed retention periods for each category. The clinic should document and apply a retention schedule appropriate to its legal, professional, clinical and insurance obligations, and securely delete or anonymise information when it is no longer needed.

9. Your data protection rights

Subject to legal conditions and exemptions, you may have the right to request access to your personal data, correction of inaccurate information, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw that consent. You also have the right to complain to the Information Commissioner’s Office (ICO).

To exercise a right or ask a question, contact us at info@flowaesthetics.co.uk or 01752 936 511. You can find information about the ICO at ico.org.uk.

10. Security

We use appropriate technical and organisational measures designed to protect personal information. No method of internet transmission or electronic storage is completely secure, and we cannot guarantee absolute security.

11. Children

Our website and treatments are not intended to invite children to submit personal information without appropriate involvement of a parent, guardian or other lawful authority. If you believe a child has provided information inappropriately, please contact us.

12. Links to other websites

Our website may link to third-party services, including the booking platform. We are not responsible for the privacy practices of external websites. Please read their privacy notices before using them.

13. Changes to this policy

We may update this policy to reflect changes to our services, suppliers or legal obligations. The revised version will be published on this page with an updated date.

Last updated: 10 November 2026.