Privacy Policy

Privacy Policy

Bodyvie Ltd is committed to protecting your privacy. Patients have a right to expect us to retain accurate records, and for us to act upon any requests to rectify inaccuracies in your personal information. This Privacy Policy explains how we use any personal information we collect about you or you provide to us. Please read the Policy carefully to understand our views and practices regarding your personal information and how we treat it. Bodyvie Ltd is registered in England with company number 3849113. Our registered office is Bodyvie Medi-Clinic, 133-135 Kew Road, Richmond, Surrey, TW9 2PN. Our Data Protection Officer is Natalie Weber. Main Policy Content Summary:

• What information do we hold on you
• How we obtain that information
• Where we store information
• Whom information is shared with
• Why do we hold and process personal data
• How long we hold records and on what basis
• Online Shop & Vouchers

Principles of our Privacy Policy:

• We will never spam you with irrelevant emails.
• You have a right to require us to erase your personal data without undue delay on certain grounds e.g. where it is no longer necessary based on the reason it was originally recorded or where you withdraw your consent and there is no other legal grounds for processing. Where we process your clinical records we do so in order to provide you with health care, under Article 6(1)(b) and Article 9(2)(h) of the UK GDPR, rather than relying on your consent. This means we are required to keep your medical records for the retention periods set out below, even if you ask us to stop processing your data. Where we do rely on your consent, for example for marketing, you can withdraw it at any time.
• You have the right to request a copy of the personal data we hold about you. We will provide this free of charge, and normally within one month. We may charge a reasonable fee, or decline, only where a request is manifestly unfounded or excessive, or where you ask us for further copies of the same information.
• You may opt-out of our email communications at any time. You can unsubscribe from emails by clicking ‘unsubscribe’ or replying directly to info@bodyvie.co.uk.
• We will never sell, rent, make public or distribute your personal information.
• We will only collect and process your personal data when absolutely necessary.

We may change this Policy from time to time. However, we will not reduce your rights under this Privacy Policy. We will always update this Privacy Policy on our website, so please try to read it when you visit the website. The ‘last updated’ reference tells you when it was the last updated. Relevant Privacy Legalisation In line with our internal processes and systems, Bodyvie internal documentation and website content are designed to comply with the following policies:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018 (DPA 2018)
• Privacy and Electronic Communications Regulations 2003 (PECR)
• EU General Data Protection Regulation (EU GDPR), where it applies to patients in the EEA

The compliance of internal documentation and website content with the above policies will likely mean that they are compliant with UK data protection and privacy legislation. What information do we collect about you and where do we store it? We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online and internally. We may collect and process the following personal information about you, which is stored on our secure encrypted and passworded platforms, including our practice management system, Pabau, on our PC’s, internal password encrypted systems spreadsheets, word documents, ipads and as paper records. Bodyvie does not obtain information or purchase databases from any third parties or sell information. Information you give to us * Medical Records – A requirement for your clinic registration. This includes information such as your name, address, date of birth, gender, e-mail address, phone number, next of kin, GP, and medical history. Medical records are recorded in the form of consent forms, treatment records, photography (pre and post-treatment imagery where were required for insurance purposes), complaints/adverse events/communication between Us and You. Failing to provide us with this information will result in us being unable to provide treatment. * Clinical Photographs – For some appointments we ask you to provide clinical photographs before you attend. You will receive a secure personal link by email which opens your own record in our practice management system, Pabau, where you upload the images directly. The photographs are saved straight onto your medical record. We do not ask for or accept clinical photographs by email, and the link is personal to you and to that appointment. We use these images to pre-assess your case, to confirm that the treatment is suitable for you, and to give you a more accurate idea of the procedure and its cost before you attend. This is used most often for cosmetic surgery, minor operations and follow-up appointments, but it may apply to any treatment. Only the practitioner treating you and the clinical staff involved in your care can access these images. They form part of your medical record and are retained on the same basis as the rest of your clinical records. They are never used for marketing, and they are never shared outside the clinic without your separate explicit consent. * Enquiries – We may record your details in order to track and follow up on enquiries, in addition to scheduling appointments. This includes information such as your name, e-mail address or phone number and details of the nature of your enquiry. Failing to provide us with this information for marketing purposes will have no impact upon the provision of your treatment. We will automatically collect the following information, for each visit made, when you visit our online domain www.bodyvie.com. * Technical information, including the Internet Protocol (IP) address used to connect your computer to the internet, browser type and version, time zone setting, browser plug-in types and version, operating system and platform; and * Information about your visit, including the full Uniform Resource Locators (URL), clickstream to, through and from our Site (including date and time), products you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks and mouse-overs) and methods used to browse away from the page. Like most websites, our website uses Google Analytics. This tool collects information in an anonymous form, including the number of visitors to the site, where visitors have come to the site from and the pages they visited. We use this information to better understand how visitors find us and how they interact with our website. We can use this to make adjustments to our website, to deliver a better user experience. We keep all web usage data in an anonymised form in google analytics, but we do not connect this in any form to personalised data or use to contact anyone. *Call Recordings – Calls to and from the clinic are recorded. We use recordings to confirm the details of enquiries and appointments, to train and support our staff, to monitor the quality and accuracy of the information we give, and to identify and respond to concerns and complaints. Recordings of enquiry calls are transcribed and reviewed for these purposes; recordings of other calls are not reviewed in this way. Transcription and review are carried out by a service provider acting as our processor under a written contract, which may involve processing outside the United Kingdom under appropriate safeguards. No decision affecting you is made by automated means. Recordings may contain information about your health. We process this information on the basis of our legitimate interests in providing and improving our services (Article 6(1)(f) UK GDPR) and, where the information concerns your health, on the basis that processing is necessary for the management of health care services (Article 9(2)(h) UK GDPR and paragraph 2 of Schedule 1 to the Data Protection Act 2018). Recordings are held for 30 days and transcripts for no longer than seven days, after which they are deleted. Access is restricted to staff bound by a duty of confidentiality. * Online Contact forms – We collect the following information about you when you complete a form on our website:

• Full name
• Email address
• Telephone number
• Other information you supply relevant to your enquiry

A copy is sent to us by email and the information is stored on our customer management system and mailbox (info@bodyvie.co.uk). Where you ‘opt in’ for the ‘subscribe to our mailing list’ data is also stored on Mailchimp. See section ‘Email Newsletter’. * Email newsletter – If you choose to join our mailing list, your email address will be stored in Mailchimp. Mailchimp is a third-party data processor. At any time, you can unsubscribe from our newsletters, either from within the newsletter or by emailing us. Mailchimp’s Privacy and Terms. How do we use the information we collect from you? When you provide personal information to us, the purpose for which you are providing the personal information will always be made clear. We need to gather and hold data in order to provide our service and care, maintain medical records and also provide our clients with information. We collect information about you to understand your needs and provide you with a better service. Specifically, we use your information for: We may use this information for some or all of the following reasons:

• To provide you with the information, treatments, products and services that you request from us
• Internally, to inform decisions about our business operations or strategy
• To notify you about changes to our service
• To send you text notifications to remind you of any appointments booked with us
• To contact you for post-treatment, follow up and care, including survey requests in order to improve our service and ensure continuity of care
• To contact you from time to time to market other services, treatments and products we provide and think may be of interest to you, based on your interests and preferences where you have made them known to us
• Provide you with any information that we are required to send you to comply with our regulatory or legal obligations; (GMC, NHS England, Insurers)
• Detect, prevent, investigate or remediate, crime, illegal or prohibited activities or to otherwise protect our legal rights (including liaison with regulators and law enforcement agencies for these purposes);

Information we collect about you We may use this information for some or all of the following reasons:

• To administer our website www.bodyvie.com and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes
• To improve our website to ensure that content is presented in the most effective manner for you and for your computer
• To allow you to participate in interactive features of our website when you choose to do so
• As part of our efforts to keep our website safe and secure
• To measure or understand the effectiveness of advertising we serve to you and others, and to deliver relevant advertising to you
• To make suggestions and recommendations to you and other users of our site about goods or services that may interest you or them.

Who do we share your personal data with? We take our obligations under the General Data Protection Regulation and our clinical confidentiality requirements very seriously. Sensitive information relating to your medical history will be kept confidential and will only be disclosed to the individuals involved in delivering your treatment. We will never sell, distribute or lease your personal information to third parties unless we have your permission or are required to do so by law. Some information sharing is absolutely necessary for Bodyvie to provide your service and care, for example – the information shared in a prescription. Without consent, treatment cannot be provided. For contact or marketing purposes and information sharing, we must gain consent. You must ‘opt in’ to allow us to use your data. We offer selective consent, rather than requiring all or nothing consent. If you’re unclear as to what you have ‘opted in’ for or wish to make any changes, please contact us at Bodyvie and speak with our Data Protection Officer. We may share your personal information with: * Other members of Bodyvie staff as part of your ongoing care provisions, or for the purpose of analysing the business. * Selected third parties such as The Doctors Laboratory for diagnostics, or Healthxchange Pharmacy for prescriptive purposes in order to provide your agreed treatment. Opting out of sharing your information with these providers may affect our ability to treat you. *There may also be circumstances where we are under a duty to disclose your personal information or share your personal information in order to comply with any legal or regulatory requirement, obligation or request. This includes the police for the prevention or investigation of a crime, or our Insurers, legal advisors or other third parties who need access to it in the context of managing, investigating or defending claims or complaints. YOUR INFORMATION We cannot guarantee that the information you send us over the internet is secure, but once we receive it we will take all reasonable steps to protect the information you supply to us. Bodyvie will not transfer your data outside of the European Economic Area. Backups of electronically stored data are taken regularly, with strong encryption used to protect all files. If you have concerns as to the safety of your data sent via an online channel, including emails to info@bodyvie.co.uk, we would advise you to minimise and risk but opting for direct communication by phone. Under the General Data Protection Regulation and in line with Legal Requirements, we will only hold personal identifiable data for the maximum retention periods:

TEXT MESSAGE (SMS) COMMUNICATIONS We use text messages for two different purposes, and we treat them differently. Messages about your care. We send appointment confirmations, reminders, pre-treatment instructions and aftercare advice by text. These form part of providing your treatment and are not marketing. You will receive them while you are a patient with us, although you can ask us to contact you by another method instead. Marketing messages. We will only send you marketing text messages where you have opted in to receive them, or where you have previously purchased a treatment from us and we are telling you about something similar, as permitted by the Privacy and Electronic Communications Regulations 2003 (PECR). When you opt in, we will send you a single message confirming your subscription. How often we send marketing messages will vary. Every marketing message will identify Bodyvie and will tell you how to stop receiving them. You can opt out at any time by replying STOP to any marketing message, by following the unsubscribe link in a message, by emailing info@bodyvie.co.uk, or by telling a member of our team. We will confirm once you have been unsubscribed and will send you no further marketing texts. Opting out of marketing does not stop appointment reminders or other messages about your care. If you change your mobile number, or transfer it to somebody else, please tell us at info@bodyvie.co.uk so that we do not send messages to the wrong person. We use Mailchimp, a service provided by Intuit Inc., to send our email and text marketing. Your name and contact details are shared with Mailchimp for that purpose only, and they act as our processor. Where this involves transferring your personal data outside the UK, the transfer is made under safeguards permitted by the UK GDPR, such as the International Data Transfer Addendum to the European Commission Standard Contractual Clauses. Your mobile provider’s standard charges may apply to any message you send us, including a STOP reply. Your mobile provider is not responsible for delayed or undelivered messages. Consenting to marketing messages is never a condition of receiving treatment with us. CCTV We employ CCTV on the exterior and public areas of the building in order to aid the security of our staff, patients and premises. CCTV cameras are not in use in our treatment rooms. A Subject Access Request may be made for footage of you. All CCTV footage is held for a maximum of two weeks. In certain circumstances, we may need to disclose CCTV footage for legal reasons. COOKIES Website cookies – A cookie is a piece of code that allows the webserver to identify and track the activity of the web browser. They are widely used in order to make websites work more efficiently, as well as to provide information to the owners of the website. You can enable or disable your cookie settings. For further details please consult the help menu in your browser or visit allaboutcookies.org. YOUR RIGHTS You have the right to ask us not to process your personal information, but where consent is withdrawn for the processing of personal data from your medical records, our ability to continue your treatments will be impaired. You have the right to ask us not to process your personal information for marketing purposes. We will only contact you for marketing purposes if you have opted in to receive such communications. If you wish to stop receiving some or all marketing communications from us, you can let us know by email: info@bodyvie.co.uk Our website www.bodyvie.com may, from time to time, contain links to and from the websites of third parties. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites. In some circumstances, you have the right to be forgotten and we will erase all data held about you. Medical records are exempt from erasure before our maximum retention periods. Requests for erasure should be made in writing to info@bodyvie.co.uk and will be assessed on a case by case basis. ACCESS TO INFORMATION AND CORRECTION If you provide us with your personal information, you have the following rights:

• To review the user information that you have supplied to us.
• To request that we correct any errors, outdated information, or omissions in user information that you have supplied to us.
• To request that your user information not be used to contact you.
• To request that your user information be deleted from our records.

To exercise any of these rights, please email info@bodyvie.co.uk or contact our Data Protection Officer. We will respond to your request to change, correct, or delete your information within a reasonable timeframe and notify you of the action we have taken. It is important to note that whilst personal data can be removed from our systems in relation to marketing, we will be unable to remove any medical records relating to treatment received – which cannot be erased and will be retained as required by our insurers and professional regulatory bodies – for a period of 10 years. You have the right to request a copy of the personal data we hold about you. We will provide this free of charge, and normally within one month. We may charge a reasonable fee, or decline, only where a request is manifestly unfounded or excessive, or where you ask us for further copies of the same information. All requests will be subject to the appropriate identification checks. PAYMENTS AND OUTSTANDING FEES

Where you pay for an appointment, treatment or product, we process your name, contact details and a record of the payment. Payments are handled by our payment providers; Bodyvie does not see or hold your full card number.

We process this information in order to perform our contract with you, and for our legitimate interests in maintaining accurate financial records and in recovering fees that remain unpaid. Fees for telephone, video and other remote consultations are payable in advance at the time of booking, and the payment record is held on your patient account.

Where a fee remains outstanding we may contact you by telephone, email or post to request payment. Where it is necessary to recover the sum due, we may share the minimum information required with a debt recovery service or with our legal advisers.

ONLINE SHOP & VOUCHERS

Protecting Your Personal Data.

This privacy statement relates only to the purchasing of vouchers and products, for Bodyvie Ltd. info@bodyvie.co.uk. 02071000744

By placing an online order via our ecommerce platform you are providing us with Personally Identifiable Information (PII).

This information will only be use for the following purposes:

• Order fulfilment and, if for the benefit of someone else, communicating purchase information to them.
• Payment Processing (which involves providing the 3^RD party payment processing provider with PII)
• Where consented to, marketing communications.
• Statistical analysis*
• Your specific consent is not required for data processing as this is a necessary requirement which enables us to fulfil our contractual obligations to you. Please note this is only used where there is a legitimate interest in using your data for statistical analysis.

PII collected will be retained for ten years, following which it will be deleted and all your PII except any data necessary to evidence the fact that your PII has been deleted.

In relation to marketing communications, we will cease using PII for that purpose if you withdraw consent by informing us using the contact details set out above, or by unsubscribing from our emails.

In line with the UK GDPR and the Data Protection Act 2018, you have the right to ask us what PII of yours we hold, to have it corrected if incorrect and to object to the way in which we use it. To request for your data to be removed from our system, please contact us directly.

When placing orders, online payment is made and provided to a 3^rd party payment processing provider. We do not see or hold your full card payment details. Where you pay a booking deposit for an appointment, we also hold a record of the credit balance on your client account and of the appointments or treatments that balance is applied to.

Bodyvie is registered with and regulated by the Information Commissioner’s Office (“ICO”). If you have a complaint relating to data management or processing you can complain to the ICO. We would request that you contact us first so we have the opportunity to manage this internally where possible.

CONTACT AND COMPLAINTS Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to the Practice Manager, Bodyvie Medi-Clinic, 133-135 Kew Road, Richmond, Surrey, TW9 2PN or info@bodyvie.co.uk. You have the right to complain to a supervisory authority if you feel that we have breached the terms outlaid in our Privacy Policy. Complaints can be made to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF or further information can be found at www.ico.org.uk Bodyvie Ltd is registered with the Information Commissioner’s Office under registration number Z7088232. This privacy policy was last updated on 25 September 2026.