Privacy Notice

How Avsthetics Ltd collects, uses and protects personal information

Last updated: 28 August 2026
Company: Avsthetics Ltd (company number 17165234)
Website: avsthetics.com
Privacy contact: avstheticsldn@gmail.com | +44 7541 031871

This notice explains how Avsthetics Ltd uses personal information when you visit our website, contact us, enquire about treatment, book or receive care, make a payment, communicate through our social-media channels, or exercise your information rights.

Avsthetics currently provides services only to adults aged 18 or over. Our website and treatment services are not directed at children.

1. Who is responsible for your information

Avsthetics Ltd is the data controller. This means we decide why and how personal information is used. Dr Avani Williams, Director of Avsthetics Ltd, is responsible for data-protection oversight within the company.

Avsthetics is registered with the Information Commissioner’s Office (ICO). We do not publish the private clinic address in this notice; a postal contact route can be provided where reasonably required.

2. Personal information we may collect

• Identity and contact information, including your name, date of birth, telephone number, email address and, where needed, postal address.

• Enquiry and appointment information, including requested treatments, appointment history, messages, preferences and communication records.

• Health and clinical information, including medical history, medicines, allergies, previous treatments, assessment findings, consent discussions, treatment details, outcomes, aftercare and clinical notes.

• Clinical photographs or other visual records made for assessment, treatment planning, monitoring, documentation or another separately agreed purpose.

• Emergency-contact information and relevant information supplied by another person where this is necessary and appropriate.

• Payment and accounting information, such as invoices, amounts, payment status, transaction references and limited information supplied through a payment provider or bank.

• Marketing choices and any separate consent for newsletters, promotional contact, testimonials, photographs or social-media use.

• Website and technical information, such as IP address, device/browser information, security logs, cookie choices and interaction information collected by the website platform.

• Complaints, incidents, insurance, legal-claim and regulatory correspondence.

Health information is special-category personal data and receives additional protection under data-protection law. A photograph may also reveal health information or treatment status depending on its content and context.

3. How we obtain information

Most information comes directly from you, including when you:

• use the website, complete a form, send an email or telephone us;

• contact Avsthetics through WhatsApp Business or Instagram;

• attend a consultation or treatment appointment;

• provide medical information, photographs, consent choices or aftercare updates; or

• make a payment, complaint or information-rights request.

We may also receive limited information from a person acting with your authority, an emergency contact, another healthcare professional, an insurer, a payment provider, a bank, a regulator or another lawful source. If you give us someone else’s details, please tell them that you have done so and direct them to this notice where appropriate.

4. Why we use information and our lawful bases

We identify an Article 6 lawful basis for each purpose. Where health or other special-category information is involved, we also identify a condition under Article 9 of the UK GDPR and, where required, the Data Protection Act 2018.

Enquiries, consultations, bookings and treatment administration
Information used: Identity, contact, appointment and relevant treatment information
Lawful basis: Contract or steps requested before entering a contract (Article 6(1)(b)).

Clinical assessment, treatment, aftercare and clinical records
Information used: Health information, notes, consent records and clinical photographs
Lawful basis: Contract where necessary and legitimate interests in providing, documenting and safeguarding care (Articles 6(1)(b) and 6(1)(f)); health or social care (Article 9(2)(h) and Schedule 1, paragraph 2 of the Data Protection Act 2018).

Safety, quality assurance, audit and service evaluation
Information used: Clinical and operational information, minimised or de-identified where practicable
Lawful basis: Legitimate interests in safe and effective service management (Article 6(1)(f)); management of healthcare services (Article 9(2)(h)).

Accounting, taxation and other specific legal duties
Information used: Identity, transaction, invoice and limited supporting information
Lawful basis: Compliance with a legal obligation (Article 6(1)(c)); another Article 9 condition is identified if health information is genuinely necessary.

Complaints, incidents, insurance and legal claims
Information used: Correspondence, clinical records and other relevant evidence
Lawful basis: Legitimate interests or legal obligations as applicable (Articles 6(1)(f) or 6(1)(c)); legal claims (Article 9(2)(f)) where special-category data is necessary.

Medical emergencies
Information used: Relevant identity, contact and health information
Lawful basis: Vital interests where the legal conditions are met (Article 6(1)(d) and Article 9(2)(c)); direct-care bases may also apply.

Optional direct marketing
Information used: Contact details and marketing preferences
Lawful basis: Consent (Article 6(1)(a)) and the Privacy and Electronic Communications Regulations where applicable. Consent may be withdrawn at any time.

Identifiable promotional photographs, testimonials or social-media material
Information used: Images, recordings, quotations and agreed identifying details
Lawful basis: Separate consent (Article 6(1)(a)) and explicit consent (Article 9(2)(a)) where special-category information is revealed. This consent is independent of treatment.

Website operation, security and necessary technologies
Information used: Technical, device, log and cookie-choice information
Lawful basis: Legitimate interests in operating and securing the website (Article 6(1)(f)); consent is used where required for non-essential cookies or similar technologies.

Consent to examination or treatment is a clinical and professional requirement. It is separate from the lawful basis used to process information for direct care and clinical records.

5. Clinical photographs

Photographs taken for assessment, treatment planning, monitoring or documentation form part of the clinical record. We explain the clinical purpose and obtain appropriate clinical consent or other authority before making them. They are handled with the same confidentiality safeguards as other clinical information.

We do not use an identifiable clinical photograph for advertising, social media, education, publication or research merely because it was taken during care. Any such secondary use requires a separate, specific choice and any additional consent or governance that applies. Refusing promotional use does not affect access to treatment.

6. Marketing

Marketing is optional. We will record your preference and provide a simple way to stop future marketing. Withdrawing consent does not affect earlier processing that was lawful before withdrawal. Appointment, safety, treatment and aftercare communications are service messages rather than marketing.

7. Information needed for treatment

Some identity, contact, medical-history and treatment information is needed to assess suitability, provide safe care, maintain an adequate clinical record, arrange follow-up or meet a specific legal obligation. If necessary information is not provided, Avsthetics may be unable to offer or continue treatment. Marketing choices and promotional-photography consent are not required for treatment.

8. Who may receive information

Information is disclosed only where relevant, proportionate and lawful. Recipients may include:

• Dr Avani Williams and any future worker or contractor who is specifically authorised, appropriately trained and bound by confidentiality;

• website, email, form, cloud, IT-support and data-storage providers acting under applicable contractual safeguards;

• payment providers and banks where necessary to issue invoices, request or reconcile payment and meet financial obligations;

• professional advisers, insurers or indemnifiers where necessary;

• another healthcare professional, emergency service or person involved in your care where there is an appropriate legal and confidentiality basis;

• regulators, courts, law-enforcement bodies or public authorities where disclosure is required or lawfully justified; and

• a prospective purchaser or successor if the business is reorganised, subject to confidentiality and data-protection safeguards.

Avsthetics does not sell patient information.

9. Services and platforms

Wix
Website hosting, website forms and website technologies.

Google services
Business email, forms and administrative document handling, subject to account, access and contractual controls.

WhatsApp Business
Minimal appointment administration where you choose this channel. It is not an emergency service or the master clinical record.

Instagram/Meta
Public content and general enquiries. The platform also processes information under its own privacy terms.

Co-operative Bank and Go Get Paid/BankiFi
Banking, invoicing and payment requests. Providers process information under their own applicable notices and terms.

Dedicated external storage
Storage of clinical notes and clinical photographs, subject to Avsthetics’ technical, access, backup and physical-security controls.

Paper records
Limited clinical or administrative documentation where paper is required or appropriate.

If you contact Avsthetics through social media or a messaging platform, please avoid sending detailed medical histories, clinical photographs or urgent clinical concerns unless Avsthetics has specifically directed you to an approved route. Relevant information may be transferred into the clinical record.

10. International processing

Some technology providers or their subprocessors may process information outside the United Kingdom. Where UK data-protection law treats this as a restricted transfer, Avsthetics must rely on an applicable safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement or an approved UK addendum to standard contractual clauses, together with any required risk assessment. You may contact us for further information about the safeguards relevant to your information.

11. Security

Avsthetics uses proportionate technical and organisational measures intended to protect information against unauthorised access, alteration, disclosure, loss or destruction. These include access restriction, confidentiality controls, device and account security, secure storage arrangements, appropriate disposal and review of service-provider safeguards. No method of storage or transmission can be guaranteed completely secure, and we do not describe any system as risk-free.

12. How long we keep information

We retain information only for as long as it is needed for the purpose for which it was collected and for applicable clinical, professional, legal, tax, insurance, complaint and legal-claim requirements. We consider the sensitivity of the information, patient-safety needs, continuity of care, limitation periods, insurer requirements and whether information can be securely deleted or anonymised.

Enquiries that do not lead to treatment
Until the enquiry is resolved and for a limited follow-up period justified by administration, complaints and potential claims.

Clinical records and clinical photographs
For the approved adult clinical-record period measured from the last relevant clinical interaction, taking account of professional, insurer, safety and legal requirements.

Invoices and accounting records
For the applicable statutory accounting and tax period.

Marketing preferences
Until consent is withdrawn or the record is no longer needed to demonstrate and respect the preference; preferences are reviewed periodically.

Promotional images or testimonials
For the agreed use and review period. Withdrawal stops future use where reasonably possible, but material already published or copied by others may not be fully retrievable.

Complaints, incidents and claims
Until the matter and related insurer, regulatory or legal requirements are closed and the relevant retention period has expired.

Website and security logs
According to the justified security purpose and the configured provider retention period.

13. Your information rights

Depending on the circumstances and lawful basis, you may have the right to:

• be informed about how your information is used;

• request access to your personal information;

• ask for inaccurate or incomplete information to be corrected;

• request erasure or restriction where the legal conditions are met;

• object to processing based on legitimate interests or to direct marketing;

• receive or transfer certain information in a portable format;

• withdraw consent where processing relies on consent; and

• receive safeguards relating to qualifying automated decisions.

These rights are not absolute. For example, Avsthetics may need to retain parts of a clinical record despite an erasure request where there is a lawful and professionally justified reason. We may request proportionate information to verify identity before responding.

14. Complaints

You may complain directly to Avsthetics about how your information has been handled. Contact avstheticsldn@gmail.com and describe the concern and the outcome you are seeking. We will facilitate the complaint, normally acknowledge it within 30 days, make appropriate enquiries, keep you informed where needed and provide an outcome without undue delay.

You may also complain to the Information Commissioner’s Office. Information about making a complaint is available at ico.org.uk. We would welcome the opportunity to address the concern first, but you are not required to contact Avsthetics before approaching the ICO.

15. Cookies and website technologies

The website may use technologies necessary to display content, maintain security, remember choices or provide a service you request. Where consent is legally required for analytics, advertising or another non-essential technology, a clear choice must be provided before it is used. The website’s cookie controls or cookie notice should describe the technologies actually enabled and allow you to change relevant choices.

16. Automated decisions

Avsthetics does not currently make treatment decisions about you solely by automated means where the decision produces legal or similarly significant effects. Clinical suitability and treatment decisions are made by a clinician.

17. Changes to this notice

We review this notice when our services, systems, legal duties or information practices change. The latest version should be available on avsthetics.com. If a change materially affects existing patients, we will take proportionate steps to bring it to their attention.