Privacy Policy

Body Bonito (“we,” “our,” or “us”) is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (bodybonito.com) or use our services.

1. Information We Collect

1.1 Personal Information

We may collect personal information that you voluntarily provide to us when you:

• Book an appointment or consultation
• Fill out forms on our website
• Subscribe to our newsletter or marketing communications
• Contact us via email, phone, or through our website
• Attend our clinic for treatments

This information may include:

• Name and contact details (email address, phone number, postal address)
• Date of birth
• Medical history and health information relevant to aesthetic treatments
• Photographs (before and after treatment images, with your explicit consent)
• Payment and billing information
• Treatment preferences and booking history
• Any other information you choose to provide

1.2 Automatically Collected Information

When you visit our website, we may automatically collect certain information about your device and browsing actions, including:

• IP address
• Browser type and version
• Operating system
• Referring website addresses
• Pages viewed and time spent on pages
• Date and time of visits
• Cookies and similar tracking technologies

2. How We Use Your Information

We use the information we collect for the following purposes:

• To provide and manage our services: Including scheduling appointments, providing treatments, maintaining treatment records, and following up on your care
• To communicate with you: Sending appointment confirmations, reminders, treatment aftercare instructions, and responding to your inquiries
• To improve our services: Understanding how our website and services are used to enhance user experience and treatment offerings
• For marketing purposes: Sending you information about our services, special offers, and news (only with your consent, and you may opt out at any time)
• To comply with legal obligations: Meeting regulatory requirements for medical and aesthetic services, including record-keeping and safety reporting
• To process payments: Handling transactions and maintaining billing records
• To protect our rights: Preventing fraud, ensuring security, and enforcing our terms and conditions

3. Legal Basis for Processing (UK GDPR)

We process your personal data under the following legal bases:

• Consent: When you have given explicit consent for specific processing activities (e.g., marketing communications, photography for promotional purposes)
• Contract performance: To fulfill our obligations when providing aesthetic treatments and services to you
• Legal obligation: To comply with healthcare regulations, tax laws, and other legal requirements
• Legitimate interests: For business operations, fraud prevention, and improving our services (where not overridden by your rights and interests)

4. Sharing Your Information

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

4.1 Service Providers

We may share your information with trusted third-party service providers who assist us in operating our business, including:

• Booking and appointment management systems
• Payment processors
• Email and SMS communication platforms
• Website hosting and analytics providers
• Professional indemnity insurers

These service providers are contractually obligated to protect your information and use it only for the purposes we specify.

4.2 Medical Professionals

Where necessary for your care or safety, we may share relevant medical information with:

• Your GP or other healthcare providers (with your consent)
• Medical professionals we consult regarding your treatment
• Regulatory bodies if required

4.3 Legal Requirements

We may disclose your information if required by law, court order, or regulatory authority, or to protect the rights, property, or safety of Body Bonito, our clients, or others.

5. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Medical records: Maintained for a minimum of 8 years from the date of last treatment, in accordance with professional guidelines and regulations
• Marketing data: Retained until you withdraw consent or request deletion
• Financial records: Kept for 6 years as required by HMRC
• Website analytics: Typically retained for 26 months

6. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance your browsing experience. Cookies are small text files stored on your device that help us:

• Remember your preferences and settings
• Understand how you use our website
• Improve website functionality
• Provide relevant content and advertisements

You can control cookie settings through your browser preferences. Please note that disabling cookies may affect the functionality of our website. For more information, please see our Cookie Policy.

7. Your Rights

Under UK data protection law, you have the following rights:

• Right to access: Request a copy of the personal information we hold about you
• Right to rectification: Request correction of inaccurate or incomplete information
• Right to erasure: Request deletion of your personal data (subject to legal and professional obligations)
• Right to restrict processing: Request limitation on how we use your data
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests or for marketing purposes
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us using the details provided in Section 11.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of sensitive data
• Secure storage systems with restricted access
• Regular security assessments and updates
• Staff training on data protection and confidentiality
• Physical security measures at our clinic premises

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

9. Third-Party Links

Our website may contain links to third-party websites, including our booking system and social media platforms. We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any third-party sites you visit.

10. Children’s Privacy

Our services are not directed to individuals under the age of 18 without parental or guardian consent. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can delete such information.

11. Contact Us

12. Complaints

If you are not satisfied with how we handle your personal information, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113
• Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by posting the updated policy on our website with a new “Last Updated” date. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

14. Medical Confidentiality

As a healthcare provider, we adhere to professional standards of medical confidentiality. All medical information shared during consultations and treatments is treated with the strictest confidence and is only disclosed when:

• You have given explicit consent
• Required by law or regulatory authorities
• Necessary for your safety or the safety of others
• Essential for providing your treatment

15. Consent for Photography and Marketing

We may request your consent to take before and after photographs of treatments for the following purposes:

• Your medical records and treatment documentation
• Marketing and promotional materials (website, social media, brochures)
• Educational purposes

This consent is entirely voluntary and separate from your treatment consent. You may withdraw consent for marketing use of your photographs at any time, although images used in your medical records will be retained as required by professional guidelines.