Our Privacy & Cookie Policy

Advanced Facial Aesthetics Ltd, trading as Dr Hass Clinic, is the data controller for your personal information. We are registered with the Information Commissioner’s Office under registration number ZB886976. Our clinic director is Dr Hasaneen Al Janabi MBBS (Lond) BSc (Hons) MRCS (ENT).

Registered office: 128 City Road, London EC1V 2NX

For anything relating to your information, please contact us at the clinic:

Address: 27 Hill Street, Mayfair, London W1J 5LP
Phone: 020 8168 8178
Email: info@drhassclinic.co.uk

3.1 Personal Information

• Name, address, telephone number, email address
• Date of birth and age
• Medical history and health information relevant to treatment
• Photographs for clinical documentation, treatment monitoring, and (if explicitly consented) for marketing purposes
• Payment and billing information
• Emergency contact details

3.2 Website Information

• IP address and browser information
• Cookies and similar tracking technologies
• Pages visited and time spent on our website
• Referral sources

3.3 Communication Records

• Consultation notes and treatment records
• Email correspondence and phone call records
• Appointment scheduling information
• Feedback and survey responses

3.4 Enquiry Information

When you enquire through our website, WhatsApp, social media, email or phone, we record your name, contact details, the treatment you are interested in, how you heard about us, and details of the advertisement or web page that brought you to us (such as the campaign name and the click identifiers that Google and Meta add to links). Please do not include detailed medical information in an enquiry; we ask for what we need at your consultation, where it is recorded in your clinical record.

4.1 Primary Purposes

• Medical Care: Providing aesthetic treatments and medical services.
• Appointment Management: Scheduling and managing consultations and treatments.
• Treatment Planning: Developing personalised treatment plans.
• Health and Safety: Ensuring safe treatment delivery and appropriate aftercare.
• Legal Compliance: Meeting regulatory, professional, and statutory obligations.

4.2 Secondary Purposes

• Service Communications: Sending appointment reminders and aftercare information.
• Marketing: Where you have provided consent, sending newsletters, clinic updates, and treatment information.
• Quality Improvement: Reviewing and analysing service delivery and patient satisfaction.
• Website Functionality: Improving user experience, performance, and site optimisation.

4.3 SMS, WhatsApp and Direct Messaging Communications

We may use your mobile telephone number to communicate with you via SMS text message and/or WhatsApp in the following circumstances:

Service and Appointment Communications
We may send appointment confirmations, appointment reminders, treatment preparation instructions, aftercare guidance, follow-up messages, and responses to your enquiries. These communications are necessary for the performance of our contract with you and to support safe and effective medical care.

Marketing Communications
Where you have provided clear consent, we may send promotional messages relating to treatments, clinic updates, events, or special offers via SMS or WhatsApp. Marketing messages will only be sent where you have opted in, in accordance with the Privacy and Electronic Communications Regulations (PECR).

Opting Out
You may opt out of marketing communications at any time by:

• Replying “STOP” to an SMS or WhatsApp message;
• Using the unsubscribe link in any marketing email;
• Sending us a message requesting removal;
• Emailing us at info@drhassclinic.co.uk;
• Informing us during your appointment.

Opting out of marketing messages will not affect essential service or appointment communications.

Use of Third-Party Messaging Providers
We may use secure third-party service providers to facilitate SMS and WhatsApp communications. These providers process your information strictly on our instructions and in compliance with UK data protection law.

4.4 Measuring Our Advertising

We advertise on Google and on Meta’s platforms (Facebook and Instagram). To understand which advertisements genuinely help people find us, and to avoid showing advertising that isn’t useful, we tell Google and Meta when someone who responded to one of their advertisements later makes an enquiry, books or attends a consultation, or pays for treatment, together with the value of that payment.

To do this we send them a limited set of information:

• your email address and phone number in hashed form (converted into a scrambled code so that Google and Meta can only match it to an account they already hold, and cannot read your actual details);
• the click identifier from the advertisement you clicked, where there is one;
• the type of event (for example “enquiry”, “consultation booked” or “purchase”), its date, and the amount paid.

We never send the name of any treatment, your medical history, clinical notes, photographs or any other health information.

Our lawful basis is our legitimate interest in measuring and improving our advertising. Google and Meta process this information under their business and data processing terms. You can object at any time by contacting us, and we will stop including you; this does not affect your care or how we communicate with you.

We process your personal data under the following legal bases:

• Consent: For marketing communications and non-essential photography
• Contract: For providing requested treatments and services, and taking steps at your request before you become a patient
• Legal Obligation: For regulatory compliance and professional standards
• Vital Interests: For medical emergencies or urgent health concerns
• Legitimate Interests: For business operations, responding to enquiries, fraud prevention, service improvement, and measuring the effectiveness of our advertising (see section 4.4)

Information about your health is special category data. We process it because it is necessary for the provision of health care and treatment (UK GDPR Article 9(2)(h)), under the professional duty of confidentiality that applies to doctors. Where we use clinical photographs for marketing, we rely on your explicit consent.

We may share your information with:

6.1 Healthcare Professionals

• Referring doctors or specialists (with your consent)
• Emergency services (if medically necessary)
• Professional advisors for complex cases

6.2 Service Providers

• Appointment booking and practice management systems
• Enquiry management and messaging platforms (for handling enquiries, email, SMS and WhatsApp)
• Payment processors (secure, encrypted transactions)
• IT support and website maintenance providers
• Professional indemnity insurers
• Advertising platforms (Google and Meta), only for measuring our advertising as described in section 4.4

6.3 Legal Requirements

• Regulatory bodies (GMC, CQC) when required
• Law enforcement agencies when legally obligated
• Courts or tribunals when compelled by law

6.4 Sub-processors

We work with trusted third-party service providers who may process your data on our behalf. A full list of current sub-processors is available upon request by contacting info@drhassclinic.co.uk.

We never sell your personal information to third parties.

We implement appropriate technical and organisational measures to protect your personal information:

• Encryption: Sensitive data is encrypted in transit and at rest
• Access Controls: Limited access on a need-to-know basis
• Regular Backups: Secure backup systems with encryption
• Staff Training: All staff members with access to your data are bound by strict confidentiality agreements and receive ongoing training
• Physical Security: Secure premises with controlled access

We retain your personal information for the following periods:

• Medical Records: 8 years from last treatment (adults) or until age 25 (minors)
• Financial Records: 7 years from last transaction
• Enquiries that do not lead to treatment: 24 months after our last contact, then deleted
• Marketing Consents: Until withdrawn or 3 years of inactivity
• Website Analytics: 26 months maximum
• CCTV Footage: 30 days (if applicable)

Under UK data protection law, you have the right to:

• Access: Request copies of your personal information
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data (subject to legal obligations)
• Restrict Processing: Limit how we use your information
• Data Portability: Receive your data in a structured format
• Object: Opt out of marketing communications, advertising measurement (section 4.4), or other legitimate interest processing
• Withdraw Consent: Remove consent for specific processing activities

To exercise these rights, contact us at info@drhassclinic.co.uk or 020 8168 8178.

10. Cookies and Website Analytics

Our website uses cookies to improve functionality and user experience. You can manage your cookie preferences through the banner displayed on your first visit or through your browser settings.

10.1 What Are Cookies?

Cookies are small text files that are placed on your device when you visit our website. They help us provide you with a better browsing experience and allow certain features to function properly.

10.2 Types of Cookies We Use

Essential Cookies (Always Active)

These cookies are necessary for the website to function and cannot be switched off in our systems:

• Session Management: Maintains your session as you navigate the site
• Security: Protects against cross-site request forgery attacks
• Load Balancing: Ensures optimal website performance
• Cookie Consent: Remembers your cookie preferences

Analytics Cookies (Optional)

These cookies help us understand how visitors interact with our website:

• Google Analytics: Tracks website usage, page views, and user behaviour
• Performance Monitoring: Identifies technical issues and loading times
• Traffic Sources: Shows how visitors find our website
• Popular Content: Helps us understand which pages are most useful

Data Collected: Page views, time spent on site, bounce rate, geographic location (city level), device type, browser information Retention Period: 26 months maximum Third Parties: Google Analytics

Marketing Cookies (Optional)

These cookies are used for advertising and remarketing purposes:

• Facebook Pixel: Tracks conversions and enables targeted advertising
• Google Ads: Measures ad performance and enables remarketing
• Social Media Integration: Enables sharing and social media features

Data Collected: Pages visited, actions taken, interests, demographics Retention Period: Up to 2 years Third Parties: Meta (Facebook), Google, LinkedIn

Functional Cookies (Optional)

These cookies enhance your experience but are not essential:

• Live Chat: Remembers your chat preferences and history
• Form Completion: Saves partially completed forms
• Language Preferences: Remembers your preferred language
• Accessibility Settings: Maintains your accessibility preferences

10.3 Managing Your Cookie Preferences

Cookie Banner

When you first visit our website, you’ll see a cookie banner allowing you to:

• Accept all cookies
• Reject non-essential cookies
• Customise your preferences
• View detailed information about each cookie type

Browser Settings

You can also manage cookies through your browser settings:

• Chrome: Settings > Privacy and Security > Cookies and other site data
• Firefox: Settings > Privacy & Security > Cookies and Site Data
• Safari: Preferences > Privacy > Cookies and website data
• Edge: Settings > Cookies and site permissions

Opt-Out Links

You can opt out of specific tracking services:

• Google Analytics: Google Analytics Opt-out
• Facebook Pixel: Facebook Ad Preferences
• Google Ads: Google Ad Settings

10.4 Impact of Disabling Cookies

If you disable cookies, you may experience:

• Reduced website functionality
• Inability to remember your preferences
• Need to re-enter information on each visit
• Less personalised experience

Essential cookies cannot be disabled as they are necessary for the website to function properly.

10.5 Third-Party Cookies

Some cookies are set by third-party services that appear on our pages:

• Google Analytics: Web analytics service
• Facebook Pixel: Social media and advertising platform
• YouTube: Video content (if embedded)
• Google Maps: Location services (if embedded)

These third parties have their own privacy policies and cookie policies, which we recommend you review.

10.6 Cookie Updates

We may update our cookie usage from time to time. When we make significant changes, we will:

• Update this policy
• Notify you through our website
• Request fresh consent where required

Some of our service providers, including our enquiry management platform and Google and Meta, may process data outside the UK. When this occurs, we ensure adequate protection through:

• Adequacy Regulations: Transfers to countries the UK recognises as providing adequate protection
• UK Transfer Safeguards: The UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses
• UK Extension to the EU–US Data Privacy Framework: For US providers certified under it

We do not knowingly collect personal information from children under 16 without parental consent. If you believe we have collected information from a child inappropriately, please contact us immediately.

We may update this Privacy Policy periodically. Significant changes will be communicated through:

• Website notifications
• Email alerts (for registered users)
• Direct communication for material changes affecting your rights

If you have concerns about how we handle your personal information, please contact us first. If you remain unsatisfied, you can lodge a complaint with:

Information Commissioner’s Office (ICO)

Website: ico.org.uk

Phone: 0303 123 1113

Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

For any privacy-related questions or to exercise your rights:

Dr Hass Clinic (Advanced Facial Aesthetics Ltd)
Address: 27 Hill Street, Mayfair, London W1J 5LP
Phone: 020 8168 8178
Email: info@drhassclinic.co.uk
Website: https://drhassclinic.co.uk/