Privacy Policy

RB Aesthetic Ltd (trading as Rojelle) is committed to protecting your privacy and handling your personal information with care, transparency, and respect. This Privacy Policy explains how we collect, use, store, and protect your information when you visit our website, contact us, book appointments, complete consultation forms, purchase products or treatments, or interact with our clinic.

Who We Are

Rojelle Aesthetic Clinic is an aesthetic and wellness clinic based in Manchester, United Kingdom. For the purposes of data protection law, Rojelle acts as the “data controller” of your personal information.

Information We Collect

We may collect personal information directly from you when you:

• book an appointment;
• complete a consultation or medical form;
• contact us by phone, email, WhatsApp, social media, or website forms;
• purchase products or services;
• subscribe to marketing communications;
• use our website or booking systems.

The information we collect may include:

Personal Information:

• full name;
• date of birth;
• address;
• email address;
• phone number;
• emergency contact details.

Medical and Treatment Information:

• medical history;
• allergies;
• medications;
• previous treatments;
• pregnancy or breastfeeding status;
• skin concerns or sensitivities;
• consultation notes;
• treatment records;
• clinical photographs.

Payment and Booking Information:

• appointment history;
• payment status;
• booking preferences;
• package or treatment records.

Website and Technical Information:

When you use our website, we may automatically collect:

• IP address;
• browser type;
• device information;
• pages visited;
• website usage data through cookies and analytics tools.

Lawful Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR), we rely on the following lawful bases to process your personal data:

• Performance of a Contract: To manage your appointments, bookings, and deliver the services or products you purchase from us.
• Legal Obligation: To comply with legal and clinical record-keeping obligations required of aesthetic and healthcare clinics in the UK.
• Consent: For sending marketing communications, newsletter subscriptions, or utilizing non-essential cookies.

Special Category Data (Health & Medical Records):

Because we process medical history, allergies, and clinical photographs, we process "special category data" under Article 9(2)(h) of the UK GDPR (processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment).

How We Use Your Information

We use your information to:

• provide consultations and treatments safely;
• assess treatment suitability;
• manage bookings and appointments;
• communicate with you about your appointments;
• maintain medical and clinical records;
• process payments;
• improve our services and customer experience;
• comply with legal and regulatory obligations;
• respond to enquiries or complaints;
• send marketing communications where you have given consent.

We only collect information that is relevant and necessary for the services we provide.

Medical Records and Clinical Information

Certain treatments require us to collect sensitive medical information to ensure your treatment is safe and appropriate. This information is treated with strict confidentiality and is only accessed by authorized members of the clinic team where necessary. Clinical photographs may also be taken before and after treatment for medical documentation, treatment monitoring, and progress assessment. We will never use your photographs for marketing or promotional purposes without your separate written consent.

Marketing Communications

If you choose to subscribe to our marketing updates, we may send you information about treatments, offers, events, new services, or clinic updates via email, SMS, or other communication channels. You can unsubscribe or withdraw your consent at any time by:

• clicking the unsubscribe link in emails;
• contacting us directly;
• requesting removal from our marketing list.

We do not sell your personal information to third parties for marketing purposes.

Sharing Your Information

We may share your information with trusted third parties where necessary to operate our clinic and provide services safely. This may include:

• booking software providers (e.g. Pabau Clinic Software);
• payment processors (e.g. Stripe);
• healthcare or medical professionals where appropriate;
• insurance providers;
• IT, analytics (e.g. Google Analytics) and communication service providers (e.g. WhatsApp Business);
• legal or regulatory authorities where required by law.

International Data Transfers:

Some of our third-party services (such as Pabau, WhatsApp, and Google Analytics) transfer or process data outside the United Kingdom and the European Economic Area (EEA). In these cases, we ensure that appropriate safeguards are in place—such as UK Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or adequacy regulations—to ensure your personal data remains protected to UK GDPR standards.

Data Security

We take reasonable steps to protect your information against unauthorized access, misuse, loss, disclosure, or alteration. Your data may be stored electronically, physically, or through secure third-party systems used by the clinic. While we aim to use commercially acceptable methods to protect your information, no online transmission or storage system can be guaranteed to be completely secure.

How Long We Keep Your Information

We do not retain your data indefinitely. We keep your information in accordance with UK statutory requirements and professional standards:

• Clinical & Medical Records: Retained for a minimum of 8 years from the date of your last treatment, in accordance with UK medical record retention guidelines and clinical insurance conditions.
• Financial & Transaction Records: Retained for 6 years following the end of the relevant tax year to comply with HMRC tax obligations.
• Marketing Contacts: Retained until you withdraw your consent (unsubscribe) or after 2 years of complete inactivity.

Cookies and Website Analytics

Our website may use cookies and similar technologies to improve user experience and understand how visitors interact with the website. Cookies may help us:

• remember website preferences;
• analyze website traffic;
• improve website functionality;
• support marketing and advertising performance.

You can control or disable cookies through your browser settings or our website's consent banner.

Your Rights

Under UK data protection law, you may have the right to:

• request access to your personal information;
• request correction of inaccurate information;
• request deletion of your information in certain circumstances;
• object to certain types of processing;
• restrict processing;
• withdraw consent for marketing;
• request transfer of your information where applicable.

To exercise any of these rights, please contact us directly. We may request proof of identity before responding to certain requests.

Third-Party Websites

Our website or social media pages may contain links to third-party websites, booking systems, or external platforms. We are not responsible for the privacy practices or content of third-party websites. We encourage you to review their privacy policies separately.

Children’s Privacy

Our services are generally intended for individuals aged 18 and over for aesthetic procedures. We do not knowingly collect personal information from children without appropriate consent or legal basis.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, clinic practices, or services. The latest version will always be available on our website.

Contact Us

If you have any questions about this Privacy Policy or how your information is handled, please contact us:

Email: admin@rojelle.co.uk

Data Protection Officer (DPO): Angel Bastanhagh

ICO Registration Number: ZB928472

Complaints

If you are unhappy with how your personal information has been handled, please contact us first so we can try to resolve your concern.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO):

Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk