Privacy Notice

1. Who we are

The data controller for all personal and clinical information is AEKHO LTD., a company registered in Scotland (company number SC895945), trading as aekho wellness. We are registered with the Information Commissioner's Office under reference ZC234993.

Clinical care is delivered from The Glen Clinic, Thornliebank, Glasgow. You can reach us about anything in this notice at info@aekho.co.uk or 07596 018063. We are not required to appoint a Data Protection Officer; privacy queries are handled by the clinical director, Dr Ahsan Qaisar, at the same address.

Registered office: 52 Morris Crescent, Motherwell, ML1 5NH.

2. The information we hold

Enquiry and appointment data: your name, email address, telephone number, contact preference, appointment details and the content of any message you send us.

Health data (special category): your medical history, medications and allergies, consultation notes, assessment findings, consent records, details of any treatment carried out, batch numbers of products used, aftercare and follow-up records, and clinical photographs.

Payment data: the fact, amount and date of a payment. We are card-only and payments are handled by our payment provider and, where you choose them, Klarna or Clearpay — we never see or store your full card number.

Website data: if you accept cookies, analytics data about how you use the site (pages viewed, approximate location, device and browser). Essential cookies that remember your cookie choice are always set. See section 8.

3. Where we get it from

Almost all information comes directly from you — through the website enquiry form, a social media message, email, telephone, or in person at your appointment. We may also receive information from your GP or another healthcare professional where that is relevant to your safe care.

4. Why we use it, and our lawful basis

To provide healthcare — assessing suitability, treating you safely, keeping medical records, follow-up and managing complications. Lawful basis: Article 6(1)(b) (contract) and, for health data, Article 9(2)(h) (provision of health care and management of health care services), supported by Schedule 1 Part 1 of the Data Protection Act 2018.

To answer enquiries and manage appointments — Article 6(1)(b) (steps prior to a contract) and Article 6(1)(f) (our legitimate interest in responding to people who contact us).

To meet legal and regulatory duties — record retention, Healthcare Improvement Scotland and GMC obligations, indemnity, adverse-event and yellow-card reporting, tax and accounting. Lawful basis: Article 6(1)(c) (legal obligation) and Article 9(2)(i) (public interest in public health) where health data is involved.

To establish, exercise or defend legal claims — Article 6(1)(f) and Article 9(2)(f).

Marketing use of photographs, and website analytics — consent only, Article 6(1)(a) (and Article 9(2)(a) for images). You can withdraw consent at any time without affecting your care or the lawfulness of processing before withdrawal.

Where we rely on legitimate interests, we have balanced those interests against your rights and are happy to share that assessment on request.

5. Clinical photography

Standardised before and after photographs are taken as part of your clinical record and are used for assessment, planning and review. They are stored securely within our clinical system. Any use beyond your medical record — for example our website or social media — is entirely separate, requires your specific written consent, is never a condition of treatment, and can be withdrawn at any time by emailing us. On withdrawal we remove the images from any material we control.

6. Who we share it with

We never sell your information. We share it only with:

• Aesthetic Nurse Software — our clinical records provider (processor).
• The Glen Clinic — where we hold practising privileges, for appointment and premises administration only.
• Prescribing and pharmacy partners where a prescription-only medicine is involved.
• Your GP or another clinician where clinically necessary, normally with your knowledge.
• Our email, hosting and analytics providers (processors), our payment providers, our accountants, and our indemnity provider or legal advisers if a claim arises.
• Regulators and public bodies — such as Healthcare Improvement Scotland, the GMC, the MHRA or HMRC — where we are legally required to do so.

All processors act on our written instructions under a contract that meets Article 28 of the UK GDPR.

7. International transfers

Our clinical records are held within the UK. Some of our website, email and analytics providers may process limited data outside the UK. Where that happens, the transfer is protected by UK adequacy regulations or by the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguards in place.

8. Cookies, analytics and social messaging

We set an essential cookie to remember your cookie choice. If you accept, we use Google Analytics 4 to understand how the site is used; you can change or withdraw that choice at any time from the cookie banner or by clearing site data.

To arrange an appointment, contact us using your preferred option below. If you contact us through a social media platform such as Instagram, that platform is a separate data controller and its own privacy policy and cookies apply to the message you send. You can contact us by telephone, email or our enquiry form instead.

9. How long we keep it

Adult medical records, including consent forms and clinical photographs, are kept for a minimum of 11 years after your last appointment, in line with Scottish healthcare record-keeping guidance and our indemnity requirements. Enquiries that do not lead to treatment are deleted within 12 months. Financial records are kept for 6 full financial years for HMRC. Analytics data is retained for 14 months. Marketing consents are kept for as long as the image is in use, plus a record of the consent itself.

10. Keeping it secure

Records are held in an access-controlled clinical system with encryption in transit and at rest, individual staff logins and multi-factor authentication. Paper notes, where they exist, are stored securely and transferred into the clinical record. Access is limited to those involved in your care.

11. Do you have to give us your information?

Providing enquiry details is voluntary, but without them we cannot reply to you. Providing an accurate medical history and consent is a requirement of safe treatment — if you decline, we will not be able to treat you. Marketing photograph consent and analytics cookies are entirely optional and refusing has no effect on your care.

12. Automated decisions

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects. Every clinical decision is made by a practitioner.

13. Your rights

Under the UK GDPR you have the right to: be informed about our use of your data; access a copy of it; have inaccurate data corrected; have data erased in certain circumstances (this is limited for medical records we must keep); restrict our processing; data portability; object to processing based on legitimate interests; object to direct marketing at any time; and withdraw consent where consent is our basis.

To exercise any right, email info@aekho.co.uk. We respond within one month and do not charge a fee for a reasonable request. We may ask you to confirm your identity first.

14. Complaints

Please tell us first at complaints@aekho.co.uk so we can put things right. You also have the right to complain to the Information Commissioner's Office at any time: ico.org.uk/make-a-complaint, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

15. Changes to this notice

We review this notice at least annually. If we make a material change to how we use your information, we will update the date at the top of this page and, where appropriate, tell you directly.

AEKHO LTD. · Registered in Scotland · Company number SC895945 · Registered office: 52 Morris Crescent, Motherwell, ML1 5NH · ICO reference ZC234993.