Privacy Notice

1. Who we are

KHJ Aesthetics & Academy ("we", "us", "our") is the data controller responsible for your personal data. You can contact us at info@khjaesthetics.com or by post at 49 High Street, Chellaston, Derby DE73 6TB.

2. What data we collect

• Enquiry data — name, email, phone number and any information you include in your message when you use our contact form.
• Booking & consultation data — appointment details, treatment preferences, medical history and consent forms collected in clinic or via our booking partners (Facesconsent and That Time).
• Course & academy data — details you provide when enrolling on a training course.
• Technical data — basic information about your device and how you use our website (IP address, browser, pages viewed) collected via essential cookies and analytics.

3. How we use your data

We use your personal data to:

• respond to your enquiries and manage your bookings;
• provide treatments and training courses safely and lawfully;
• keep medical, consent and aftercare records as required by our insurers and professional bodies;
• send appointment reminders and important service updates;
• improve our website and services.

4. Legal bases

We process your data under the following UK GDPR lawful bases:

• Consent — for marketing communications and non-essential cookies.
• Contract — to deliver treatments, courses and bookings you request.
• Legal obligation — to keep medical and financial records.
• Legitimate interests — to run and improve our clinic and website.
• Explicit consent (special category data) — for health information collected during consultation.

5. Who we share data with

We only share personal data with trusted service providers who help us run our business, including:

• Web3Forms — delivers contact form enquiries to our inbox.
• Facesconsent — digital consent and booking for aesthetic treatments.
• That Time — booking system used by some of our practitioners.
• Google (Search Console & Fonts) — analytics and website hosting essentials.
• Our hosting and infrastructure providers — to keep the website online and secure.

We never sell your personal data.

6. How long we keep it

We keep enquiry data for up to 2 years. Medical and treatment records are kept for a minimum of 8 years (or longer where required by our insurers or law). Financial records are kept for 7 years.

7. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• request correction or deletion of your data;
• object to or restrict processing;
• withdraw consent at any time (without affecting earlier lawful processing);
• request data portability;
• lodge a complaint with the Information Commissioner's Office (ico.org.uk).

To exercise any of these rights, email us at info@khjaesthetics.com.

8. Cookies

We use essential cookies to run this website and limited analytics cookies to understand how it is used. You can control cookies through your browser settings at any time.

9. Changes to this notice

We may update this notice from time to time. The latest version will always be available on this page with the "last updated" date above.