Privacy Policy

1. Who we are

Dr Amena Shelleh, trading as Dr Shelleh Aesthetics, is the controller of the personal information described in this Privacy Policy. This means that Dr Shelleh decides why and how that information is used.

Email: info@drshellehaesthetics.com

2. What this policy covers

This Privacy Policy explains how personal information is handled when you:

• visit this website;
• submit the website consultation-request form; or
• contact Dr Shelleh Aesthetics about an initial enquiry, consultation request or your data-protection rights.

The website and consultation-request service are intended for people aged 18 or over.

This policy covers the initial website enquiry only. If you proceed to a medical consultation or treatment, relevant information may become part of a separate clinical record and may be covered by additional patient privacy information.

3. Personal information we collect

Information you provide

When you submit the consultation-request form or contact us about an enquiry, we may collect:

• your name;
• your email address;
• the treatment or consultation type you select;
• the contents of your optional message; and
• any subsequent correspondence about your request.

Your treatment selection or message may reveal information about your health. Please do not include a detailed medical history or other information that is not reasonably necessary for an initial enquiry. Relevant medical information can be discussed through the appropriate consultation process.

Information collected automatically

When you use the website, the website and its service providers may collect limited technical and security information, including:

• your IP address;
• browser, device and operating-system information;
• the date and time of a request;
• referring-page and limited website-interaction information;
• security and anti-spam signals; and
• information connected with the website’s cookie notice.

This information may be recorded in server logs or processed by website security and administration tools, including Google reCAPTCHA and CookieYes.

What you need to provide

You are not legally required to submit information through the website. However, if you do not provide your name, a working contact address or enough information to understand your request, we may be unable to respond or identify an appropriate next step.

We do not ask you to provide a detailed medical history through the initial website form.

4. How and why we use personal information

Responding to enquiries and consultation requests

We use your contact details, treatment selection, message and correspondence to:

• receive and respond to your request;
• take steps you have asked us to take before any possible consultation or service agreement;
• communicate about an appropriate next step; and
• maintain an appropriate record of the enquiry.

The lawful basis is Article 6(1)(b) of the UK GDPR where processing is necessary to take steps at your request before entering into a possible contract.

For a general enquiry that is not connected with a possible consultation or contract, the lawful basis is our legitimate interest under Article 6(1)(f) in responding to genuine enquiries about the practice.

Health information included in an enquiry

Information about health is treated as special-category personal information.

If you voluntarily provide health information that is necessary to consider your request for medical aesthetic care, we process it under the relevant Article 6 lawful basis described above.

Where the applicable requirements are met, we also rely on the health or social care condition in Article 9(2)(h) of the UK GDPR, together with condition 2 in Schedule 1, Part 1 of the Data Protection Act 2018. Such information is handled under applicable duties of professional confidentiality.

We only use health information submitted through an initial enquiry where it is reasonably necessary to understand or respond to that request.

Operating and protecting the website

We use technical, log and security information to operate the website, deliver its functions, prevent spam and misuse, investigate faults and protect the website and its users.

The lawful basis is our legitimate interest under Article 6(1)(f) in running a reliable and secure website. Where processing is necessary to comply with a legal obligation, we rely on Article 6(1)(c).

Cookie information and notice records

We use CookieYes to display information about the necessary cookies and similar technologies used by the website and to remember when a visitor has closed or continued past the cookie notice.

This supports our legitimate interest in operating the website properly and providing clear information about the technologies in use. It may also support compliance with applicable privacy and electronic-communications requirements.

The website does not currently use Google Analytics, Meta Pixel, advertising cookies, performance cookies or marketing cookies.

More information is available in our Cookie Policy.

Legal duties, rights and complaints

We may use relevant information to:

• respond to requests to exercise data-protection rights;
• investigate and respond to data-protection complaints;
• comply with legal, regulatory or professional duties; and
• establish, exercise or defend legal claims.

The lawful bases are legal obligation under Article 6(1)(c) and, where appropriate, our legitimate interests under Article 6(1)(f) in protecting our legal rights and responding properly to concerns.

5. Who receives personal information

Only Dr Shelleh routinely accesses consultation enquiries. Personal information may also be processed where necessary by trusted service providers that support the website, including:

• website hosting, maintenance, security and backup providers;
• website and form-software providers where support or technical access is required;
• the email provider used to receive and respond to enquiries;
• CookieYes, which provides the website’s cookie-information functions; and
• Google reCAPTCHA, which helps protect the consultation form against spam and automated misuse.

These providers may process information only for the relevant service and under their applicable contractual and data-protection obligations.

We may also disclose information where reasonably necessary to professional advisers, insurers, courts, regulators, law-enforcement bodies or other authorities, or where required by law.

We do not sell personal information. We do not share website-enquiry information with other organisations for their own marketing.

The website contains links to external services such as Facebook, Instagram and Google. If you choose to follow an external link, that service will handle information under its own privacy terms. We do not control those external services.

6. International transfers

Some technology providers, including Google, may process personal information in countries outside the United Kingdom.

Where a restricted international transfer takes place, it must be protected by a lawful transfer mechanism. Depending on the provider and destination, this may include UK adequacy regulations, appropriate contractual safeguards or another mechanism permitted by UK data-protection law.

You may contact us using the details below to request further information about safeguards relevant to your personal information.

7. How long we keep information

Website enquiries that do not become patient records

These are kept for up to 12 months from the last contact and are then securely deleted, unless there is a legal, regulatory or professional reason to retain them for longer.

Enquiries that progress to consultation or treatment

Relevant information may become part of a separate clinical record. It will then follow the applicable clinical, legal and professional retention requirements rather than the 12-month website-enquiry period.

Technical and security records

These are kept only for as long as reasonably necessary to operate and protect the website, investigate incidents and meet legal obligations, taking account of the retention settings of the relevant service provider.

Cookie-notice records

These may be kept for as long as reasonably necessary to remember that the cookie information has been displayed or closed, in accordance with the website’s CookieYes settings.

Rights requests, complaints and legal correspondence

These are kept for as long as reasonably necessary to respond, demonstrate compliance and manage any related legal or regulatory issue.

Information held in routine backups may remain until the relevant backup is securely overwritten or deleted.

8. How we protect information

We use reasonable technical and organisational safeguards designed to protect personal information from loss, misuse, unauthorised access, alteration or disclosure.

These measures include secure website connections, access controls, security tools and limiting routine access to consultation enquiries to Dr Shelleh.

No internet or email system can be guaranteed to be completely secure. Please do not use the website form for urgent medical matters or to submit unnecessary sensitive information.

9. Your data-protection rights

Depending on the circumstances and the lawful basis being used, you may have the right to:

• be informed about how your personal information is used;
• request access to your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to erase information in certain circumstances;
• ask us to restrict how information is used in certain circumstances;
• receive certain information in a portable format where the right applies; and
• object to certain uses of your information.

These rights are not absolute and may depend on the purpose, lawful basis and circumstances of the processing.

Your right to object

Where we rely on legitimate interests, you may object to the processing because of your particular situation. We will stop the processing unless we can demonstrate compelling legitimate grounds to continue or the processing is necessary for legal claims.

Automated decision-making

We do not use website-enquiry information to make decisions based solely on automated processing that produce legal or similarly significant effects. We do not profile website visitors for advertising or marketing.

Exercising your rights

To exercise a data-protection right, email: info@drshellehaesthetics.com .

We may need to request information to confirm your identity before acting on a request.

10. Data-protection complaints

If you are concerned about how we have collected or used your personal information, you can make a data-protection complaint by emailing: info@drshellehaesthetics.com .

Please state that you are making a data-protection complaint and provide enough information for us to understand the issue.

We will acknowledge receipt of a data-protection complaint within 30 days. We will investigate the complaint appropriately and without undue delay, keep you informed where appropriate and communicate the outcome of our investigation.

You also have the right to complain to the Information Commissioner’s Office, the UK’s data-protection regulator:

Make a complaint to the Information Commissioner’s Office
Telephone: 0303 123 1113

We would appreciate the opportunity to address your concern first, but you do not have to contact us before approaching the Information Commissioner’s Office.

11. Changes to this policy

We may update this Privacy Policy if the website, our services, our providers or applicable requirements change.

The date at the top of the page shows when the current version was last updated. Where a material change affects how we use personal information, we will take reasonable steps to bring it to the attention of affected people before the new use begins.

12. Contact us

Questions about this Privacy Policy or the use of your personal information can be sent to:

Dr Amena Shelleh trading as Dr Shelleh Aesthetics
Business and correspondence address:
50 Heyes Lane
Timperley
Altrincham
Cheshire
WA15 6DZ

Email: info@drshellehaesthetics.com

This is an administrative address only. No consultations or treatments take place at this address, and visits are not accepted.