Our Commitment
Clinic Policies
Your safety and confidentiality are at the heart of everything we do. This policy ensures that:
- Personal data is processed lawfully and safely
- Patient confidentiality is always maintained
- Staff follow consistent, auditable procedures
- The clinic meets its obligations under the UK GDPR & Data Protection Act 2018, the NMC Code, ICO guidance, and aesthetic sector best practice (JCCP, BAMAN)
It applies to all patient and staff data — electronic, paper or verbal — across every clinical and administrative system we use.
Purple Aura operates a shared clinical environment, where independent practitioners deliver services within the same premises. Each practitioner runs their own business, keeps independent clinical records, and uses their own secure Aesthetic Nurse Software (ANS) patient records system. Systems are kept separate and secure, with no routine shared access between practitioners.
Holly Price is the Data Controller for her own clients, and Lorna Timms is the Data Controller for hers. The treating practitioner is always the Data Controller for your records.
To protect patient safety, ensure continuity of care, manage risk and maintain business continuity, another practitioner may occasionally need to access your records — for example during sickness or absence cover, an emergency or out-of-hours treatment, or in the event of serious illness, incapacity or operational disruption affecting your usual practitioner. Any such access is necessary, proportionate and documented. In these situations the accessing practitioner acts only as a Data Processor; your treating practitioner remains the Data Controller throughout.
We process your data lawfully, fairly and transparently, and collect it only for specific clinical purposes. We gather only the information that is relevant, keep records accurate and up to date, and retain data only for as long as it is required. Your data is stored securely at all times to protect its integrity and confidentiality.
We collect your name, date of birth and contact details, medical history, treatment records, photos (with your consent), and payment and appointment information. This is used to provide safe treatment, meet our legal and insurance obligations, manage your appointments, communicate with you, and — only with your consent — for marketing purposes.
We rely on healthcare provision (Article 9), contractual necessity, legal obligation, and your consent as the lawful bases for processing your personal data.
You have the right to request a copy of your personal data (a Subject Access Request) in writing or by email; this will be provided securely and in a clear, readable format within 30 days. You can ask us to correct inaccurate data, though we may need evidence to maintain clinical accuracy, and you can request erasure of your data — though clinical records required for legal or insurance purposes must be retained, while marketing data can be removed immediately. You may also ask us to restrict how your data is used, request it in a structured electronic format for transfer to another provider, or object to certain processing such as marketing. We do not carry out any automated decision-making that affects your care.
Health and treatment records are stored securely using encrypted systems and kept for a minimum of 8 years in line with our storage limitation obligations. Paper records are digitised and safely destroyed, and marketing data is removed as soon as you ask us to stop.
If you have concerns, contact us first. You can also raise complaints with the ICO if needed.
You are responsible for keeping your personal and health information accurate and up to date.
