Privacy Notice and GDPR Compliance
BEYOO COSMETICS LTD Trading as Beyoo Medical Aesthetics, Skin and Laser
Effective Date: 13 July 2026
Beyoo Cosmetics Ltd, trading as Beyoo Medical Aesthetics, Skin and Laser, is committed to protecting your privacy and handling your personal information responsibly. This Privacy Notice explains how we collect, use, store and protect your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
Beyoo Cosmetics Ltd, trading as Beyoo Medical Aesthetics, Skin and Laser, is the Data Controller responsible for the personal information we collect about you.
Contact Details
Beyoo Cosmetics Ltd
Trading as Beyoo Medical Aesthetics, Skin and Laser
Address: Beyoo Medical Aesthetics, Skin and Laser, DF Studio, 18 Dalton Square, Lancaster LA1 1PL
Telephone: 01524 907014
Email: hello@beyoo.co.uk
If you have any questions about this Privacy Notice or how your information is handled, please contact us using the details above.
The Information We Collect
To provide safe, appropriate and effective care, we collect information relevant to your treatment and our legal obligations. This may include:
- Your name, date of birth, address, telephone number and email address.
- Emergency contact details where appropriate.
- Medical history, medications, allergies and relevant health information.
- Consultation notes, treatment records and consent forms.
- Clinical photographs taken before, during and after treatment.
- Payment and transaction information.
- Appointment history.
- Correspondence between you and the clinic.
- CCTV recordings within the clinic premises.
We ask that you provide accurate information and inform us of any changes that may affect your treatment.
Why We Collect Your Information
Your information is collected so that we can:
- Assess your suitability for treatment.
- Provide safe and appropriate healthcare.
- Maintain accurate medical records.
- Arrange appointments and send appointment reminders.
- Provide aftercare and follow-up advice.
- Process payments.
- Comply with legal, professional and regulatory obligations.
- Respond to complaints, insurance requests and legal enquiries where appropriate.
- Monitor and improve the quality and safety of our services.
Our Lawful Basis for Processing
Under the UK GDPR, we process your personal information using one or more of the following lawful bases:
- Provision of Healthcare – to provide safe and appropriate medical care.
- Performance of a Contract – to fulfil our agreement when you book appointments and receive treatment.
- Legal Obligation – to comply with healthcare, taxation and regulatory requirements.
- Legitimate Interests – to operate a safe, secure and effective clinic.
- Consent – where required, such as for marketing communications or the use of clinical photographs for education, advertising or social media.
Where processing is based on your consent, you may withdraw that consent at any time.
Clinical Photography
Clinical photographs are an essential part of your medical record.
We routinely take photographs before treatment and, where clinically appropriate, during and after treatment to assess your suitability for treatment, plan procedures, monitor healing and accurately document your clinical outcome.
Your photographs are stored securely as part of your confidential medical record.
They will never be used for marketing, advertising, social media, educational presentations or any other promotional purpose without your separate written consent.
Heidi AI Clinical Documentation
To assist with accurate clinical documentation, your clinician may use Heidi, a secure AI-assisted clinical documentation platform.
Heidi assists only with producing consultation notes. All clinical decisions remain the responsibility of your clinician, and every consultation note is reviewed and approved before becoming part of your medical record.
If you would prefer Heidi not to be used during your consultation, simply let your clinician know. Your consultation will continue using traditional manual note-taking.
CCTV
CCTV operates throughout the clinic for the safety and security of our patients, visitors, staff and premises.
Recordings are stored securely, treated as confidential and accessed only where necessary for security, crime prevention, health and safety or where required by law.
CCTV footage is never used for advertising, marketing or public purposes.
Who We Share Your Information With
Your information will only be shared where necessary for your care or where we are legally required to do so.
This may include healthcare professionals involved in your care, pharmacies, prescribing services, medical laboratories, insurance providers, professional regulators, professional indemnity insurers, legal advisers and government or law enforcement agencies where disclosure is required by law.
We do not sell your personal information to third parties.
International Data Transfers
Some of the secure software providers we use to deliver our services may process information outside the United Kingdom.
Where this occurs, we ensure that appropriate contractual and security safeguards are in place to protect your personal information in accordance with UK GDPR.
How We Protect Your Information
Protecting your personal information is extremely important to us.
Your records are stored securely using encrypted electronic patient management systems together with appropriate physical, organisational and technical security measures.
Access is limited to authorised members of staff who require the information to provide your care.
How Long We Keep Your Information
Medical records are retained in accordance with current legal, regulatory and professional guidance.
For adult patients, clinical records are generally retained for a minimum of eight years after your last treatment unless legislation or professional guidance requires a longer retention period.
When records are no longer required, they are securely destroyed or permanently deleted.
Your Rights
Under the UK General Data Protection Regulation, you have the right to:
- Request access to your personal information.
- Request correction of inaccurate or incomplete information.
- Request restriction of processing in certain circumstances.
- Request erasure of information where legally applicable.
- Object to certain types of processing.
- Request a copy of your personal information.
- Withdraw consent where processing is based upon your consent.
Please note that some of these rights may be limited where we have a legal obligation to retain healthcare records.
Appointment Reminders & Marketing
We may contact you by telephone, email or SMS regarding appointments, treatment information, aftercare, recalls and other communications necessary for your ongoing care.
If you choose to receive marketing communications, we may also contact you regarding new treatments, promotions, events and special offers.
Marketing communications are entirely optional, and you may withdraw your consent at any time without affecting your clinical care.
Website Cookies
Our website uses cookies to improve your browsing experience and understand how visitors use our website.
Further information is available within our separate Cookie Policy on our website.
Complaints
If you have any concerns about how your personal information has been handled, please contact the clinic in the first instance.
If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO).
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk
Changes to This Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in legislation, regulatory requirements or the way we process personal information.
The latest version will always be available from the clinic and on our website.