Privacy Policy

Who We Are

We are Afyatech Ltd, trading as Dr Bhavin Garara and Zuri Medical Clinic.

Registered Company Address: Alpha House, 296 Kenton Road, Harrow, England, HA3 8DD.

Clinic Locations: Niva Medical Clinic, Stanmore, HA7 4EB | City Medispa, City of London, EC4R 2SU.

Contact Email: info@drbhavingarara.com. ICO Registration Number: ZC178885.

Dr Bhavin Garara is registered with the General Medical Council (GMC No. 7155707) and operates in accordance with GMC standards and UK data protection law.

Data We Collect

Information You Provide

• Identity Data: Full name, date of birth, gender.
• Contact Data: Email address, telephone number, billing address.
• Financial Data: Payment card details, processed securely via Stripe.
• Transaction Data: Details of payments made and treatments received.
• Profile Data: Booking history, treatment preferences, and feedback.
• Health Data: Medical history, current medications, allergies, lifestyle factors, and any information relevant to your treatment suitability. This data is collected only with your explicit consent and is used solely to inform safe treatment planning.
• Photographic Data: Clinical photographs taken before and after treatment, retained securely for medical record purposes and only used with your explicit consent for any other purpose.

Information Collected Automatically

• Usage Data: Pages visited, session durations, and interaction metrics.
• Device Data: Browser type, operating system, IP address, and device details.
• Cookies: Used for analytics and website performance.

Special Category Data (Health Information)

As a medical aesthetics practice, we regularly collect and process health information. This is a special category of personal data under UK GDPR and requires an additional lawful basis for processing.

We process your health data on the basis that it is necessary for the provision of healthcare treatment. You may be asked to provide information about current medications, allergies, medical conditions, previous cosmetic or aesthetic treatments, lifestyle factors relevant to treatment planning, and any contraindications.

This information is stored securely, accessed only by Dr Garara and relevant clinical staff, and used solely to ensure your treatment is safe and appropriate.

We do not collect other special categories of personal data (religious beliefs, sexual orientation, biometric or genetic data, political opinions, or trade union membership) unless directly relevant to treatment. We do not collect information about criminal convictions.

How We Use Your Data

We process your personal data for the following purposes:

Data Sharing

We share your data only where necessary and always with appropriate safeguards. Recipients include:

• Zenoti (clinic booking and management software) — for appointment and patient record management.
• Stripe (payment processing) — for secure processing of payments. Stripe's privacy policy applies: www.stripe.com/gb/privacy.
• Website and email hosting providers — for the operation of our website and communications.
• Google Analytics — for anonymised website analytics and performance tracking.
• Your GP or other healthcare professionals — where referral or disclosure is in your clinical interest or required by law.
• Regulatory bodies — including the GMC, ICO, or other relevant authorities where legally required.

We do not sell, rent, or share your personal data with third parties for marketing purposes without your explicit consent.

Data Retention

We retain clinical records (including health data, consultation notes, and treatment records) for a minimum of 8 years from the date of your last treatment, in line with medical regulatory standards and the NHS Records Management Code of Practice.

Financial transaction data is retained for 7 years in accordance with HMRC requirements.

Marketing data is retained until you withdraw consent.

Website usage data is retained for a shorter period unless required for security or legal purposes.

You may request deletion of your personal data at any time, subject to our legal retention obligations.

Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

• Right of access: You may request a copy of the personal data we hold about you (Subject Access Request).
• Right to rectification: You may ask us to correct inaccurate or incomplete data.
• Right to erasure: You may request deletion of your data, subject to legal retention requirements.
• Right to restrict processing: You may ask us to limit how we use your data in certain circumstances.
• Right to data portability: You may receive your data in a structured, machine-readable format.
• Right to object: You may object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: You may withdraw any consent given at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at: info@drbhavingarara.com.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk or by calling 0303 123 1113.

Cookies

Our website uses cookies to improve functionality and gather analytics. Cookies we use include those for session management, website analytics (Google Analytics), and user experience optimisation. Full details of the cookies we use, including their names, durations, and purposes, are set out in our Cookie Policy at www.drbhavingarara.com/cookie-policy.

You can manage or disable cookies through your browser settings. Disabling cookies may affect certain features of the website. For more information on cookies, visit www.allaboutcookies.org.

We use Google Analytics to understand how visitors use our website. Google may process data outside the UK/EEA. For details on how Google handles this data, see: www.google.com/policies/privacy/partners.

Data Security

We take the security of your personal and health data seriously. We maintain appropriate technical and organisational measures to protect against unauthorised access, loss, or disclosure. Access to patient records is restricted to authorised clinical personnel only.

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the ICO in accordance with our legal obligations.

Children's Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from anyone under 18 without verified parental or guardian consent. If you believe a child has provided us with personal data, please contact us promptly.

Data Transfers Outside the UK

Where service providers are based outside the UK or EEA (for example, Google Analytics), we ensure that adequate safeguards are in place, including Standard Contractual Clauses approved by the UK Information Commissioner, or transfers to countries with an adequacy decision.

Links to Third-Party Websites

Our website may contain links to third-party sites. We are not responsible for the content or privacy practices of those sites. We encourage you to review their privacy policies independently.

Updates to This Policy

We may update this Privacy Policy from time to time. The current version will always be published on our website. We will notify you of material changes by email where we hold your contact details.

Contact Us

For questions, requests, or concerns about this policy or how your data is handled:

Email: info@drbhavingarara.com.

Post: Data Queries, Afyatech Ltd, Alpha House, 296 Kenton Road, Harrow, England, HA3 8DD.

ICO Registration: ZC178885.