Privacy Notice

This notice explains how Bravita Clinic Ltd ("Bravita", "we", "us") collects and uses your personal information, and the rights you have over it. We are the data controller for the information described here and are registered with the Information Commissioner's Office under registration number ZC183060. Bravita is an aesthetics clinic; treatments are provided by Rafaela Thomson, Advanced Aesthetic Practitioner.

Who to contact

Post: Bravita Clinic Ltd, 6 Julia Drive, Sandwith, Whitehaven, Cumbria, CA28 9US.
Email: hello@bravitaclinic.com

What information we collect

• Identity and contact details: your name, date of birth, email address, phone number and address.
• Health information: allergies, relevant medical and surgical history, previous cosmetic treatments, your concerns, consultation and treatment notes, and any incidents. This is "special category" data and receives extra protection.
• Photographs: clinical before/after and assessment photographs of your face or body. These can identify you and are treated as special category data.
• Consent records: records of the consents you give, including signatures.
• Payment information: details needed to take payment. Card details are handled securely by our payment provider, Stripe — we do not store your card number.
• Technical information: app and device information, your communication preferences, and limited records needed for security and to keep an audit trail.

Why we use it, and our lawful basis

Where we rely on consent (marketing, AI photo analysis), you can withdraw it at any time without affecting care you have already received.

Who we share it with

We do not sell your data. We share it only with service providers who help us run the clinic, under contract and only as needed:

• Supabase — secure database and storage (hosted in the EEA/Ireland).
• Resend — sending emails.
• Stripe — processing payments.
• OpenAI and Anthropic — AI analysis of photographs and clinical drafting you have consented to (United States).
• Netlify — website and app hosting.
• Sentry — error monitoring (configured not to collect personal data).

A full list is kept in our internal processor register and can be provided on request.

Sending data outside the UK

Some of our providers are based in the United States. Where your data is transferred outside the UK, we put in place an approved safeguard (the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses) and assess the risks.

How long we keep it

• Clinical records and clinical photographs: at least 8 years after your last treatment (a recognised clinical standard).
• Payment and financial records: 6 years plus the current year (tax law).
• Marketing consent: until you withdraw it; we keep a minimal record so we can honour your opt-out.

More detail is in our retention schedule (available on request).

Your rights

• Access the personal data we hold about you — you can download a copy from the patient portal, or ask us.
• Correct inaccurate data — you can edit your profile in the portal, or ask us.
• Erasure ("right to be forgotten") — you can request this in the portal. We may need to keep clinical records for the legal and clinical retention period before they can be erased or anonymised.
• Restrict or object to certain processing.
• Data portability — receive your data in a usable format.
• Withdraw consent — for example, turn off marketing in the portal at any time.

To exercise a right, use the patient portal or contact us using the details above. We will respond within one month.

Complaints

If you are unhappy with how we handle your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/concerns, or 0303 123 1113.

Changes to this notice

We may update this notice from time to time. The current version and its date are shown at the top of this page.