Your information, handled with care

Privacy policy

Last updated: 12 October 2026

This notice explains how Karen Turley trading as Aesthetics of Downpatrick collects and uses personal information through the clinic, website, booking system and social media enquiries.

1. Who is responsible for your information?

Karen Turley is an NMC-registered nurse prescriber and sole trader. She is the data controller for the clinic's patient information. In this notice, "we", "us" and "our" mean Karen Turley trading as Aesthetics of Downpatrick.

• Address: 10 Racecourse View, Downpatrick, County Down, BT30 6FL
• Email: hello@aestheticsofdownpatrick.co.uk
• Phone: 07725 750267

Please contact Karen with questions about this notice or requests concerning your information.

2. Treatment consent and privacy choices

Consent to treatment is your agreement to a procedure after Karen has explained its benefits, risks, alternatives and aftercare. It is separate from consent to optional uses of your information.

You can decline marketing, optional analytics cookies or publication of your photographs without affecting your care. Clinical records are kept on the legal bases explained below, rather than on consent to treatment. Withdrawing consent to a treatment does not mean records of care already provided can be deleted.

3. Your clinical care and records

We keep a confidential record for patients we assess or treat. Our booking and clinical-record platform is AesthetiDocs.

Your record may include your name, date of birth, contact details, emergency contact and relevant GP details; medical history, medicines, allergies and previous treatments; consultation notes, suitability assessments and treatment plans; signed treatment consent forms; products, batch numbers, doses and prescriptions; clinical photographs; and aftercare, follow-up and complication records.

We use this information to assess suitability, prescribe and provide treatment, follow up your care and manage complications. Accurate records also support professional accountability, product tracing, complaints and legal claims.

The legal bases for clinical information

• Assessment, treatment and clinical records: Article 6(1)(b), taking steps at your request before treatment and performing the treatment contract. For health information, Article 9(2)(h), healthcare, with the Data Protection Act 2018, Schedule 1, Part 1, paragraph 2. This applies to necessary healthcare processing under Karen's professional duty of confidentiality.
• Keeping records after treatment: Article 6(1)(f), legitimate interests in safe, accountable care and maintaining professional standards, together with Article 9(2)(h) where the healthcare condition applies.
• Required reporting: Article 6(1)(c), where a specific legal obligation requires a report, together with the applicable health-information condition, such as Article 9(2)(h) for healthcare or Article 9(2)(i) where the public-health requirements are met.
• Complaints, insurance matters and legal claims: Article 6(1)(f), legitimate interests in handling these matters, and Article 9(2)(f) where health information is necessary to establish, exercise or defend legal claims.
• A medical emergency: Article 6(1)(d), vital interests, and Article 9(2)(c) where necessary to protect life and the person is physically or legally unable to consent.

How long clinical records are kept

Adult clinical records, consent forms and clinical photographs are kept for eight years after your last appointment, following the retention period in the BAMAN notice adopted by the clinic. This is the clinic's retention policy, not a fixed period imposed by GDPR. Records may need to be kept longer for an ongoing complaint, claim, investigation or other applicable obligation.

Archiving a record in AesthetiDocs does not delete it. Records are reviewed when the retention period ends, and deletion must be arranged when continued retention is no longer justified. We may be unable to delete clinical records early while they are still needed for these purposes.

4. Enquiries, bookings and payments

When you contact us by website form, email, phone or social media, we use your name, contact details and message to respond. This relies on Article 6(1)(b) where you ask us to take steps towards booking, or Article 6(1)(f), our legitimate interest in answering general enquiries. Relevant information may become part of your clinical record if you proceed with care. Other enquiries are retained only while needed to resolve the enquiry and any related issue, then reviewed for deletion.

Please avoid sending detailed medical information through the website contact form or social media. We will ask for the information needed for your care through the clinical-record process. Where an enquiry includes health information used for a clinical assessment, the clinical bases in section 3 apply.

Bookings, appointment reminders and essential messages about your care rely on Article 6(1)(b). These are service messages and do not subscribe you to marketing.

Payments and deposits involve transaction information such as the amount, date and payment reference. Card payments and deposits are processed by Stripe through AesthetiDocs. Stripe handles the card-payment information under its privacy policy. We use transaction information to manage your booking under Article 6(1)(b) and meet applicable tax and accounting obligations under Article 6(1)(c). Financial records are retained for the relevant statutory period, normally at least five years after the 31 January submission deadline for the relevant self-assessment tax return, and longer where required.

5. Clinical photographs and published photographs

Clinical photographs help Karen plan treatment, assess changes and document care. They are part of your clinical record and are not automatically available for publicity.

Photographs used on our website, social media or in advertising require separate written consent covering the images and the intended channels. Publication relies on Article 6(1)(a) and explicit consent under Article 9(2)(a) where photographs reveal health information. Saying no does not affect your treatment.

You can withdraw publication consent by contacting Karen. We will stop new use and arrange removal from channels we control as soon as reasonably possible. We cannot recall printed material already distributed or copies other people have saved or shared. The clinical copy may still need to remain in your record.

Permission for reviews and testimonials is handled separately from treatment consent. Any agreed restrictions on names, photographs and publication channels must be respected.

6. Marketing

We only send promotional emails or texts when you have opted in. Our basis is consent under Article 6(1)(a). Marketing permission is separate from booking and treatment.

You can unsubscribe using the instructions in a message or contact Karen directly. We retain a minimal record of your preference so we can respect it. We do not sell your information or share it with other businesses for their own marketing.

7. The website, cookies and contact-form security

IONOS hosts the website and provides the clinic's email service. Website hosting and security logs may contain IP addresses, browser details and requested pages. We use this information on the basis of Article 6(1)(f), our legitimate interest in operating and protecting the website.

Cloudflare Turnstile checks contact-form submissions to help prevent automated spam. It processes technical information about the browser and request for security purposes. Our basis is Article 6(1)(f), our legitimate interest in preventing spam and abuse.

Essential cookies support the website and remember your privacy choices. Google Analytics is optional and runs only when you accept statistics cookies. It helps us understand visits and actions such as booking-button clicks, phone-link clicks and successfully sent enquiries. It does not give us access to your AesthetiDocs medical record or confirm that an appointment was completed. This processing relies on your consent.

Google Analytics is provided by Google Ireland Limited and may involve transfers to the USA. Analytics cookies such as _ga may remain for up to two years. You can change or withdraw your choices using the privacy settings control in the website footer.

Where website images or files are delivered through Automattic's WordPress.com content delivery network, that provider receives technical information such as your IP address and browser details and may process it in the USA. Delivery and security processing relies on our legitimate interest in operating the website.

Our links to Instagram, Facebook, TikTok and other external websites take you to services with their own privacy notices.

8. AesthetiDocs, sharing and international transfers

AesthetiDocs Ltd provides the platform for booking, medical history forms, consent, clinical photographs and patient records. It acts as a processor for clinic records under the clinic's written instructions. It also explains its own platform processing in its privacy policy. Its processing terms form part of its Terms & Conditions.

Other recipients may include IONOS for hosting and email, Stripe for payments through AesthetiDocs, an accountant for necessary financial records, and Google for analytics where you consent. Clinical information may be shared when necessary and legally permitted with professionals involved in your care, emergency services, Karen's indemnity insurer, legal advisers or relevant authorities. Only information needed for the particular purpose is shared.

AesthetiDocs has confirmed that patient records and backups may be stored or processed outside the UK or EEA. It has identified the UK International Data Transfer Addendum to the EU Standard Contractual Clauses as a safeguard for relevant UK transfers. You can request further information about the safeguards by contacting Karen. Other providers may use applicable UK adequacy arrangements or approved contractual safeguards for their transfers.

On termination of the platform service, the clinic can instruct AesthetiDocs to return or delete patient data, subject to legal retention requirements and copies held in backups inaccessible in normal use. Archiving and backup retention are different from permanent deletion.

9. Security

Clinical records are managed through AesthetiDocs. We limit access to information according to the needs of the clinic and use security measures appropriate to the information held. No online service can guarantee absolute security.

Where a breach requires notification to the ICO, we will report it within the applicable legal deadline, normally within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to your rights and freedoms, we will inform affected people without undue delay.

10. Your rights and complaints

Depending on the processing and the legal basis, you can request access to your information, correction of inaccuracies, deletion, restriction, objection or data portability. You can withdraw consent for optional processing at any time. These rights are subject to applicable conditions and do not always require clinical records to be deleted.

You can object to processing based on legitimate interests and to direct marketing. Contact Karen using the details above to exercise your rights. Requests are normally free and answered within one month, subject to permitted extensions. We may need to verify your identity.

You can raise a privacy concern with Karen. You also have the right to complain to the Information Commissioner's Office without first contacting the clinic: ico.org.uk/make-a-complaint or 0303 123 1113.

We will review this notice when our practices change and update the date at the top. Continuing to use the website is not consent to optional processing.