Privacy Policy
Last updated: 20th Aug 2026
This Privacy Policy explains how Dr Hanson/DR Hanson Clinic collects, uses, stores and protects personal information when you visit drhanson.co.uk, contact us, make an enquiry, book an appointment, attend a consultation, or receive treatment.
We are committed to handling your personal information carefully, lawfully and transparently.
1. Who we are
For the purposes of UK data protection law, the data controller is:
Dr Hanson
Website: drhanson.co.uk
Email: hello@drhanson.co.uk
Address: 98 Harley Street, London, W1G 7HZ
Where you are seen at a partner clinic, or where your booking is managed through a clinic administration system, that clinic may also act as an independent data controller for certain appointment, administrative or clinical information. Their own privacy policy may also apply.
2. Personal information we collect
We may collect and use different types of personal information depending on how you interact with us.
Enquiry and contact information
This may include:
your name
email address
telephone number
message or enquiry details
preferred appointment times
treatment areas of interest
information you choose to provide through website forms, email, telephone, social media, WhatsApp, SMS or other messaging platforms
Booking and administration information
This may include:
consultation or appointment details
clinic location
booking history
attendance records
payment status
deposit information
invoice or receipt details
communications relating to your appointment or treatment
Clinical and consultation information
If you request advice, attend a consultation, or receive treatment, we may collect health and clinical information, including:
medical history
allergies
medication history
previous aesthetic treatments
treatment goals and concerns
clinical observations
assessment notes
diagnosis or treatment rationale
consent forms
treatment records
product details, dosage, placement and technique
before-and-after photographs where clinically appropriate
aftercare communications
adverse event or complication records, if applicable
Health and clinical information is sensitive personal information and is handled with additional safeguards.
Payment information
We may process information required to manage payment, such as:
treatment fees
consultation fees
deposit records
invoices
receipts
payment confirmation details
We do not normally store full payment card details. Where card payments are processed by a third-party payment provider, that provider processes payment information under its own terms and privacy policy.
Marketing information
If you choose to receive updates from us, we may process:
your name
email address
telephone number
marketing preferences
communication preferences
subscription or opt-in records
responses to clinic updates, newsletters or campaigns
You may opt out of marketing communications at any time.
Website and technical information
When you visit our website, we may collect limited technical information, including:
IP address
browser type and version
device information
pages visited
time spent on the website
referral source
cookie preferences
analytics data
This helps us understand how visitors use the website and improve its performance.
3. How we collect your information
We may collect personal information when you:
visit drhanson.co.uk
complete a website enquiry form
contact us by email, phone, SMS, WhatsApp or social media
request information about treatments
book a consultation or appointment
attend a consultation
complete a medical history form
sign a consent form
provide photographs for assessment or clinical records
receive treatment
subscribe to clinic updates or educational content
interact with our website cookies or analytics tools
We may also receive limited personal information from clinic partners, call centre providers, booking platforms, payment providers, website service providers, professional advisers or other third parties where necessary.
4. Why we use your information
We use your personal information for the purposes set out below. For each purpose we identify the lawful basis we rely on under Article 6 of the UK GDPR. Where the information concerns your health, a further condition under Article 9 is also required, and that is shown separately.
RESPONDING TO ENQUIRIES
Information used: Name, contact details, enquiry content
Lawful basis (Article 6): Steps prior to entering a contract, Article 6(1)(b); legitimate interests, Article 6(1)(f)
Condition for health information (Article 9): Article 9(2)(h), where an enquiry describes a health concern
ARRANGING CONSULTATIONS AND APPOINTMENTS
Information used: Contact, booking and appointment details
Lawful basis (Article 6): Contract, Article 6(1)(b); legitimate interests, Article 6(1)(f)
Condition for health information (Article 9): Not normally required
SHARING ENQUIRY AND BOOKING DETAILS WITH CLINIC ADMINISTRATION OR CALL CENTRE TEAMS
Information used: Contact details and relevant enquiry or booking information
Lawful basis (Article 6): Contract, Article 6(1)(b); legitimate interests, Article 6(1)(f)
Condition for health information (Article 9): Article 9(2)(h), only where clinical information is necessarily involved
PROVIDING CLINICAL ASSESSMENT AND TREATMENT
Information used: Medical history, clinical notes, photographs, treatment records
Lawful basis (Article 6): Contract, Article 6(1)(b); legal obligation, Article 6(1)(c)
Condition for health information (Article 9): Article 9(2)(h), provision of health care and treatment
MAINTAINING CLINICAL RECORDS
Information used: Consent forms, clinical notes, photographs, treatment records
Lawful basis (Article 6): Legal obligation, Article 6(1)(c); legitimate interests, Article 6(1)(f)
Condition for health information (Article 9): Article 9(2)(h)
MANAGING AFTERCARE, COMPLICATIONS AND PATIENT SAFETY
Information used: Clinical information and related communications
Lawful basis (Article 6): Legal obligation, Article 6(1)(c); vital interests where relevant, Article 6(1)(d)
Condition for health information (Article 9): Article 9(2)(h); Article 9(2)(c) where vital interests apply
PROCESSING PAYMENTS AND ACCOUNTS
Information used: Payment, invoice and receipt information
Lawful basis (Article 6): Contract, Article 6(1)(b); legal obligation, Article 6(1)(c)
Condition for health information (Article 9): Not required
SENDING CLINIC UPDATES AND EDUCATIONAL CONTENT, INCLUDING JOIN THE CIRCLE
Information used: Contact details and marketing preferences
Lawful basis (Article 6): Consent, Article 6(1)(a); or legitimate interests, Article 6(1)(f), where the soft opt-in under Regulation 22 of PECR applies
Condition for health information (Article 9): Not required. Health information is never used for marketing
PUBLISHING TESTIMONIALS AND BEFORE-AND-AFTER IMAGES
Information used: Reviews, images, comments
Lawful basis (Article 6): Consent, Article 6(1)(a)
Condition for health information (Article 9): Explicit consent, Article 9(2)(a)
IMPROVING WEBSITE PERFORMANCE
Information used: Technical and analytics data
Lawful basis (Article 6): Consent, Article 6(1)(a), for non-essential cookies; legitimate interests, Article 6(1)(f), for essential website function
Condition for health information (Article 9): Not required
HANDLING COMPLAINTS, LEGAL CLAIMS AND REGULATORY MATTERS
Information used: Relevant records and communications
Lawful basis (Article 6): Legal obligation, Article 6(1)(c); legitimate interests, Article 6(1)(f)
Condition for health information (Article 9): Article 9(2)(f), legal claims; Article 9(2)(h) where clinical records are involved
Where we rely on Article 9(2)(h), we do so on the basis of the health and social care condition in paragraph 2 of Schedule 1 to the Data Protection Act 2018. Information processed on this basis is handled by, or under the responsibility of, a professional subject to a duty of confidentiality.
Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights and freedoms. You may object to processing on this basis at any time by contacting hello@drhanson.co.uk.
5. Health information and special category data
Some of the information we collect relates to your health, medical history, facial anatomy, treatment history, treatment suitability or clinical care. This is known as special category data under UK data protection law.
We only process this information where necessary and where an additional legal condition applies, such as:
provision of healthcare or treatment by a professional subject to confidentiality
your explicit consent, where required
compliance with legal or regulatory obligations
patient safety
establishment, exercise or defence of legal claims
Clinical information is only accessed by people who need it for appropriate professional, administrative, safety, legal or clinical governance reasons.
6. Sharing your details with clinic administration or call centre teams
If you submit an enquiry, request information, or ask to arrange a consultation or appointment, we may share your contact details and relevant enquiry or booking information with clinic administration teams or call centre providers who support appointment handling on our behalf.
This allows them to contact you about your enquiry, provide appointment information, arrange consultations, manage bookings, or assist with clinic administration.
We only share information that is necessary for this purpose.
Clinical or medical information is not shared with call centre providers unless it is necessary for appointment handling, patient safety, clinical administration, continuity of care, or another lawful reason.
Where these providers process personal information on our behalf, they are required to handle it securely, confidentially, and only in accordance with appropriate instructions and data protection obligations.
7. Clinical photographs
Clinical photographs may be taken or requested where they are relevant to assessment, treatment planning, clinical records, monitoring outcomes, or managing complications.
Clinical photographs form part of your medical record.
They are not used for marketing, social media, website content, teaching, training or promotional purposes unless you have given separate, explicit consent.
You may withdraw consent for marketing use of photographs at any time. Withdrawal will not affect lawful clinical record keeping or any use that took place before consent was withdrawn.
8. Marketing communications and “Join the Circle”
If you submit an enquiry, we or our clinic administration/call centre team may contact you about that specific enquiry, consultation, appointment or treatment request.
This is separate from marketing.
If you choose to Join the Circle, you agree to receive occasional treatment insights, clinic updates and priority information from Dr Hanson Clinic. These communications may be sent by email, SMS, WhatsApp or similar communication methods, depending on the contact details you have provided and your preferences.
We will not use your contact details for unrelated marketing emails, SMS, WhatsApp messages, promotional calls or campaign follow-ups unless you have given appropriate consent, or unless we are otherwise permitted to do so by law.
Where marketing consent is requested, it will be separate from any consent required to respond to your enquiry or manage your appointment.
You can withdraw marketing consent or opt out of marketing communications at any time by:
clicking the unsubscribe link in an email, where available
replying to a message where appropriate
contacting us at hello@drhanson.co.uk
We do not sell your personal information to third parties.
9. Cookies and analytics
Our website may use cookies and similar technologies.
Some cookies are essential for the website to function properly. Other cookies, such as analytics, advertising or tracking cookies, will only be used where you have given consent through the website cookie banner or preference tool.
Cookies may be used to:
make the website work correctly
remember your cookie preferences
understand how visitors use the website
improve website performance
support advertising or remarketing, where applicable and where consent has been given
You can change your cookie preferences at any time through your browser settings or through the cookie controls on our website, where available.
For more information, please see our separate Cookie Policy.
10. Who we share your information with
We only share personal information where necessary and appropriate.
This may include:
clinic partners involved in your appointment or treatment
clinic administration teams
clinic call centre providers
booking system providers
secure medical record or document systems
payment processors
website hosting and IT providers
email, SMS, WhatsApp or communication platforms
analytics providers, where consent has been given
insurers
legal advisers
accountants
professional advisers
professional regulators, clinical governance bodies or authorities where required
emergency medical providers where necessary for patient safety
All third-party service providers are expected to process personal information securely and only for authorised purposes.
11. International transfers
Some service providers may process personal information outside the UK.
Where this happens, we will take appropriate steps to ensure your information remains protected, such as using recognised safeguards, contractual protections or lawful transfer mechanisms.
12. How long we keep your information
We keep personal information only for as long as necessary for the purpose for which it was collected.
Typical retention periods include:
general website enquiries: usually up to 24 months
marketing records: until you unsubscribe, withdraw consent, or the information is no longer required
payment and accounting records: usually 6 years
clinical consultation and treatment records: retained in accordance with professional, legal, insurance and clinical record-keeping requirements
clinical photographs: retained as part of the clinical record where relevant
complaint, complication or adverse event records: retained for as long as necessary for patient safety, legal, insurance or regulatory reasons
In some circumstances, records may be retained for longer where necessary for patient safety, legal claims, insurance, regulatory obligations or professional standards.
13. How we protect your information
We take reasonable technical and organisational measures to protect personal information from unauthorised access, loss, misuse, alteration or disclosure.
These measures may include:
secure systems and restricted access
password protection
encrypted or secure communication where appropriate
staff and provider confidentiality obligations
professional record-keeping procedures
limiting access to those who need the information
using reputable service providers
maintaining appropriate administrative safeguards
No website or electronic communication system can be guaranteed to be completely secure, but we take data protection and confidentiality seriously.
14. Your data protection rights
Depending on the circumstances, you may have the right to:
request access to your personal information
request correction of inaccurate information
request deletion of certain information
request restriction of processing
object to certain uses of your information
withdraw consent where processing is based on consent
request data portability in certain cases
complain about how your information is handled
Some rights may be limited where information must be retained for clinical, legal, regulatory, insurance or patient safety reasons.
To exercise your rights, please contact:
hello@drhanson.co.uk
We may need to verify your identity before responding to a request.
15. Complaints
If you have concerns about how your personal information has been handled, please contact us first so we can try to resolve the issue.
Contact: hello@drhanson.co.uk
You also have the right to complain to the UK Information Commissioner’s Office, which is the UK data protection regulator.
Website: ico.org.uk
16. Links to other websites
Our website may contain links to third-party websites, booking systems, clinic partner websites, payment platforms, social media platforms or other external websites.
We are not responsible for the privacy practices of those websites. You should review their privacy policies before providing personal information.
17. Children
Our website and services are not directed at children. We do not knowingly collect personal information from children through the website for marketing purposes.
Where treatment enquiries involve a person under 18, information should be provided by a parent or guardian and will be handled in accordance with appropriate legal, safeguarding and professional obligations.
18. Changes to this Privacy Policy
We may update this Privacy Policy from time to time.
The latest version will be available on drhanson.co.uk. The date at the top of this page shows when it was last updated.