Privacy Policy

This Privacy Policy explains how Ola Aesthetics Ltd collects, uses, and protects your personal data in accordance with UK data protection law.

1. Introduction

Ola Aesthetics Ltd is committed to safeguarding your privacy. This policy applies to all personal data collected through our website, booking systems, treatments, and communications.

2. Data Controller

The data controller is Ola Aesthetics Ltd (Company No. 13963252). We are registered with the UK Information Commissioner’s Office (ICO).

3. Personal Data We Collect

We may collect and process the following categories of personal data:

– Identity and contact details

– Appointment and booking information

– Payment and transaction data (processed securely by Square)

– Medical and consultation records

– Before and after photographs (with explicit consent)

– Marketing preferences

– Website usage data, including cookies and analytics

4. How We Use Your Data

Your personal data is used to:

– Manage bookings, consultations, and treatments

– Process payments and enforce booking policies

– Comply with legal and regulatory obligations

– Send appointment reminders and aftercare information

– Provide marketing communications where consent has been given

5. Lawful Bases for Processing

We process personal data based on one or more of the following lawful bases:

– Performance of a contract

– Legal obligation

– Legitimate interests

– Explicit consent (particularly for medical data and marketing)

6. Payment Processing

All payments and card-on-file details are processed securely by Square. Ola Aesthetics does not store full card details.

7. Marketing Communications

We may contact you by email or SMS with updates or offers where you have opted in. You may withdraw your consent at any time by following the unsubscribe instructions or contacting us directly.

8. Photographs and Social Media

Before and after photographs are taken for clinical records and may be used for marketing purposes only with separate, explicit consent. Content shared via our social media channels is subject to the relevant platform’s privacy policies.

9. Data Sharing

We only share personal data with trusted third-party service providers where necessary for the operation of our business, including booking, payment, analytics, and marketing platforms.

10. Data Retention

Personal data is retained only for as long as necessary to fulfil clinical, legal, and operational requirements, in line with statutory retention periods.

11. Your Rights

You have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and to lodge a complaint with the ICO.

12. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website.

Last updated: 09/01/2026