Last updated: 12 September 2026
Arya Clinic is committed to respecting your privacy and protecting the personal information you share with us.
This Privacy Notice explains how Arya Clinic collects, uses, stores and protects personal information when you use our website, contact us, arrange a consultation, or receive services from us.
We aim to be clear about what information we collect, why we need it, how it is used, who it may be shared with, and the rights you have in relation to your personal information.
1. Who we are
Arya Clinic is the trading name of Arya Clinic of Facial Aesthetics.
Our website is: https://aryaclinic.co.uk
Arya Clinic operates from within Heatwave Worcester in Lower Wick, Worcester.
For the purposes of UK data protection law, Arya Clinic is responsible for the personal information it collects and uses in connection with its website, enquiries, consultations and services.
If you have a question about this Privacy Notice, how we use your personal information, or wish to exercise your data protection rights, please contact:
Karl Bhattacharyya
Arya Clinic
Email: info@aryaclinic.co.uk
Telephone: 07804 577824
2. What personal information we collect
The information we collect depends on how you interact with Arya Clinic and the services you use.
Contact and enquiry information
When you contact us through our website, by email or telephone, we may collect:
- your name;
- email address;
- telephone number;
- details of your enquiry; and
- any other information you choose to provide.
Our website enquiry form is intended for general enquiries, booking enquiries and service enquiries.
Please avoid including sensitive medical or confidential health information in the general website contact form. Where health information is required, it should normally be provided through the appropriate consultation and client-record process.
Website enquiries submitted through our contact form are transmitted to Arya Clinic’s business email address. We do not retain contact-form submissions in the website’s form database after submission.
Consultation and treatment information
If you become a client of Arya Clinic, we may collect information necessary to conduct a consultation, assess suitability for a proposed treatment, provide services and maintain appropriate records.
Depending on the service involved, this may include:
- name and contact details;
- date of birth and age;
- address;
- consultation information;
- medical history;
- medication;
- allergies and other relevant health information;
- information about previous treatments;
- information relevant to treatment suitability, risks or contraindications;
- treatment and aftercare information;
- appointment information;
- records of treatments provided;
- information about products used during treatment, including relevant product lot numbers and expiry dates; and
- records of consent.
Some of this information is special category personal data, including information concerning your health.
We only seek information that is relevant and necessary for the services being considered or provided.
Clinical photographs and videos
Where clinical photographs or videos are taken as part of a consultation or treatment, these may form part of your confidential client and treatment records.
Any separate consent required for the taking or use of clinical photographs or videos will be obtained through the relevant consent process.
Payment information
Arya Clinic accepts payments by card, including payments processed through SumUp, and by bank transfer.
Arya Clinic does not store full card or bank account details in Fresha or Faces.
Where a payment is processed through a third-party payment provider, that provider may process your payment information in accordance with its own privacy information and terms.
Arya Clinic may also make payment options available through Fresha, including third-party payment services. Where you choose to use such a service, the relevant provider will process your payment information in accordance with its own terms and privacy information.
Website and technical information
When you use our website, certain technical information may be processed as part of operating, securing and maintaining the website.
This may include:
- IP address;
- browser and device information;
- technical information relating to your visit; and
- information required for website security and protection against automated abuse.
Our website uses Cloudflare Turnstile to help protect online forms from spam and automated abuse. Turnstile processes limited technical signals for bot detection and security purposes. Cloudflare states that these signals are used for this security function and that Turnstile does not access or transmit the contents of form submissions. Further information is available in Cloudflare’s [Turnstile Privacy Addendum].
Our website does not currently use Google Analytics or Google Tag Manager.
Cookies and similar technologies
Arya Clinic currently uses cookies and similar technologies that are necessary for the operation, security and functionality of the website.
We do not currently use advertising or behavioural tracking cookies.
We use embedded YouTube videos on some pages. Where YouTube videos are embedded, we use YouTube’s privacy-enhanced mode where supported.
Third-party services such as YouTube may process technical information when embedded content is displayed. Their own privacy terms apply to that processing.
3. How we collect your information
We may collect personal information:
- directly from you through our website;
- when you submit an enquiry or booking request;
- by email;
- by telephone;
- during a consultation;
- during the provision of services;
- through client and treatment records;
- when you provide information as part of a consent process;
- when you subscribe separately to our newsletter; and
- where appropriate, from an independent professional practitioner involved in a consultation or service, where this is necessary and lawful.
Where we receive information from a source other than you, we will provide any privacy information required by applicable data protection law.
4. How we use your personal information
We may use personal information for purposes including:
- responding to enquiries;
- arranging consultations and appointments;
- communicating with you about appointments and services;
- conducting consultations;
- assessing suitability for services;
- identifying relevant risks or contraindications;
- providing aesthetic treatments and related services;
- maintaining client and treatment records;
- recording relevant products used during treatments;
- providing relevant pre-treatment and aftercare information;
- administering payments;
- dealing with queries, complaints and requests;
- meeting applicable legal, insurance and professional requirements;
- maintaining the security of our website, systems and premises;
- managing and protecting our business; and
- sending newsletter or marketing communications where you have separately subscribed or where another lawful basis permits this.
We do not use information submitted through the general contact form to automatically enrol you in marketing communications.
5. Our lawful bases for using personal information
Under UK data protection law, Arya Clinic must have a lawful basis for processing personal information. The lawful basis depends on the purpose for which the information is being used.
Depending on the circumstances, Arya Clinic may rely on:
- Contract or steps before entering into a contract — where processing is necessary to arrange or provide a service you have requested;
- Legitimate interests — where processing is necessary for Arya Clinic’s legitimate business interests and those interests are not overridden by your rights and interests;
- Legal obligation — where processing is necessary for Arya Clinic to comply with a legal requirement; and
- Consent — where consent is the appropriate lawful basis, including for newsletter subscriptions and certain other processing where you have been given a genuine choice.
Where we process special category personal data, such as information concerning your health, we must also have an additional condition under Article 9 of the UK GDPR.
For relevant health information, Arya Clinic may rely on explicit consent where this is the appropriate Article 9 condition. Explicit consent is obtained through the client consent process and specifically relates to the processing of relevant health information for consultation, suitability assessment, treatment, safety, aftercare and maintaining appropriate client and treatment records.
The Article 6 lawful basis and Article 9 condition are separate requirements and are considered according to the purpose and circumstances of the processing.
Where Arya Clinic relies on consent, you can withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
If you withdraw consent to the processing of health information that is necessary to assess the suitability or safety of a treatment, we may be unable to provide that treatment.
6. Health and special category information
Some services provided by Arya Clinic require relevant information about your health and circumstances to be considered before treatment.
Health information is special category personal data under UK data protection law and receives additional protection.
During a consultation, you may be asked about matters such as:
- your medical history;
- current medication;
- allergies;
- previous treatments;
- previous reactions or complications; and
- other health information that may be relevant to the proposed treatment.
This information may be necessary to assess suitability, identify relevant risks or contraindications, determine whether a treatment can safely and appropriately proceed, provide appropriate aftercare and maintain accurate client and treatment records.
You are expected to provide accurate and relevant information about your health. If sufficient information is not available to assess the suitability or safety of a treatment, Arya Clinic may be unable to provide that treatment.
Arya Clinic will only collect and use health information that is relevant and necessary for the purposes for which it is processed.
Where an independent prescribing nurse is involved in a consultation, relevant health information may be shared with that practitioner where necessary for the consultation and prescribing process.
The prescribing nurse operates independently in her own professional capacity and makes her own professional and prescribing decisions.
7. Client and treatment records
Arya Clinic uses specialist third-party systems to manage client, appointment, consent and treatment information.
Fresha
Arya Clinic uses Fresha for relevant client and appointment management and treatment-record functions.
Information held in Fresha may include client details such as name, date of birth, age, email address and telephone number, appointment information, records of treatments performed, and relevant product information including lot numbers and expiry dates.
Fresha operates on global cloud infrastructure and personal information may be transferred to and processed outside the UK. Fresha states that it uses appropriate legal safeguards for international transfers, including applicable contractual safeguards where required.
Further information is available in the [Fresha Privacy Policy] and [Fresha Data Protection Addendum].
Faces
Arya Clinic uses Faces for relevant client consent and treatment records, including digital consent records.
Faces also stores relevant client information such as addresses.
Faces states that client data is stored within secure data centres in the United Kingdom and that data is encrypted in transit and at rest.
Further information is available in the [Faces Privacy Policy and Terms].
Arya Clinic remains responsible for determining why and how client information is used in connection with its services.
Access to client information is restricted to people who need it for the relevant business, consultation or treatment purpose.
8. When we share personal information
We do not sell your personal information.
We may share relevant personal information where necessary and lawful with:
- service providers who support the operation of our website, email, systems or business;
- client-management and treatment-record providers such as Fresha and Faces;
- an independent prescribing nurse or other appropriately qualified professional practitioner involved in a consultation or service;
- payment service providers where required to process payments;
- insurers;
- accountants, legal advisers or other professional advisers where necessary;
- authorities or organisations where disclosure is required by law; and
- other organisations where disclosure is necessary to protect our legal rights, property, safety or the rights of others.
We only share information that is relevant and necessary for the purpose for which it is disclosed.
Arya Clinic does not share client information with third-party companies for their own direct marketing purposes.
9. Independent professional practitioners
Arya Clinic may work with an independent prescribing nurse or another appropriately qualified professional practitioner where a service requires their involvement.
The prescribing nurse operates independently in her own professional capacity and has her own professional responsibilities, insurance and decision-making responsibilities.
Where she is involved in a consultation, she may be provided with relevant client and health information where necessary to assess the client’s circumstances and make an independent prescribing decision.
Arya Clinic will only provide information that is relevant and necessary for the consultation or service.
Where an independent practitioner processes personal information in their own professional capacity, they may have their own data protection responsibilities and privacy information.
10. Marketing communications
Arya Clinic keeps marketing communications separate from general enquiries, consultations and treatment records.
Arya Clinic uses EmailOctopus to manage and deliver its newsletter.
If you choose to subscribe, we may process your name, email address and information relating to your newsletter subscription, consent and marketing preferences.
Newsletter subscriptions use a separate opt-in process, including double opt-in.
Submitting an enquiry through our contact form does not automatically subscribe you to the newsletter.
We do not use EmailOctopus to store or manage client health or treatment information.
You can unsubscribe from marketing communications at any time using the unsubscribe facility included in the relevant communication or by contacting Arya Clinic.
EmailOctopus states that its application and email-sending infrastructure are hosted using Amazon Web Services in the European Union. It may also use service providers or staff outside the UK and EEA and states that appropriate safeguards are used where required.
Further information is available in the [EmailOctopus Privacy Policy] and [EmailOctopus GDPR information].
11. How we protect your information
Arya Clinic takes appropriate technical and organisational measures to protect personal information against unauthorised access, accidental loss, misuse, alteration or disclosure.
Client and treatment information is managed using access-controlled systems, including Fresha and Faces.
Our website and online enquiry forms use security measures including Cloudflare Turnstile to help prevent spam and automated abuse.
Access to client information is limited according to the requirements of the relevant business, consultation and treatment processes.
No method of transmitting or storing information can be guaranteed to be completely secure, but Arya Clinic takes reasonable and appropriate steps to protect the information it holds.
12. How long we keep your information
Arya Clinic retains personal information only for as long as it is necessary for the purposes for which it was collected, taking account of applicable legal, insurance, professional and business requirements.
Different types of information may therefore be retained for different periods.
As a general policy, client and treatment records are retained for 10 years following the relevant treatment or the end of the client relationship, unless a longer or shorter period is required or justified by the circumstances.
Other information, such as general enquiries and marketing information, may be retained for different periods according to its purpose.
Website contact-form submissions are not retained in the website’s form database after they have been transmitted to Arya Clinic’s business email system.
When information is no longer required, Arya Clinic will take appropriate steps to securely delete, destroy or otherwise dispose of it, subject to any requirement to retain it for a longer period.
13. International transfers
Some third-party technology providers used by Arya Clinic may process or store personal information outside the United Kingdom.
Where personal information is transferred outside the UK, Arya Clinic will take the steps required by applicable data protection law to ensure appropriate safeguards are in place.
For example, Fresha states that its services may involve international transfers and that it uses appropriate contractual safeguards and other transfer mechanisms where required.
Other providers may have their own international processing arrangements. Further information is available through the relevant provider privacy information linked in this notice.
14. Your data protection rights
Depending on the circumstances and the lawful basis for processing, you may have rights under UK data protection law including:
- the right to ask for access to personal information we hold about you;
- the right to ask us to correct inaccurate or incomplete information;
- the right to ask us to erase personal information in certain circumstances;
- the right to ask us to restrict processing in certain circumstances;
- the right to object to certain processing;
- the right to data portability in certain circumstances; and
- where processing is based on consent, the right to withdraw that consent.
These rights are subject to certain legal conditions and exemptions, so they will not apply in every circumstance.
You also have the right to object to direct marketing. This right will be brought to your attention clearly where applicable.
To exercise your rights, please contact:
Karl Bhattacharyya
Email: info@aryaclinic.co.uk
Telephone: 07804 577824
We may need to request information to verify your identity before responding to a request.
15. How to complain
If you have concerns about how Arya Clinic has handled your personal information, please contact us first so that we have an opportunity to understand and address your concern.
You also have the right to complain to the UK’s independent data protection regulator:
Information Commissioner’s Office (ICO)
Further information about making a complaint is available from the [ICO website].
16. Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes to our services, systems, legal obligations or the way we process personal information.
The latest version will be published on this page together with the date it was last updated.
17. Contact us
If you have a question about this Privacy Notice or how Arya Clinic uses your personal information, please contact:
Arya Clinic
C/O Heatwave Worcester
Lower Wick
Worcester
WR2 4XA
Email: info@aryaclinic.co.uk
Telephone: 07804 577824
Privacy contact: Karl Bhattacharyya
We will respond to privacy enquiries within the timescales required by applicable data protection law.