1. Introduction
NESA Clinic London ("we", "our", "us") is committed to protecting your privacy and handling your personal data responsibly.
This Privacy Notice explains how we collect, use, store, and share your personal information when you use our website, book appointments, or receive treatment from us.
We are the data controller for your personal data. Our contact details are:
NESA Clinic London 26-27 Bedford Square, Bloomsbury, London WC1B 3HP Email: hello@nesa.clinic Phone: +44 7899 121 612
2. What Data We Collect
We collect and process the following categories of personal data:
IDENTITY DATA • Full name • Date of birth • Gender (where relevant to treatment)
CONTACT DATA • Email address • Phone number • Postal address
HEALTH DATA (Special Category Data) • Medical history and current health conditions • Medications and supplements • Treatment notes and progress records • Symptoms and presenting complaints • Contraindication screening information
FINANCIAL DATA • Payment card details (processed securely via our payment provider) • Billing address • Transaction records
TECHNICAL DATA • IP address • Browser type and version • Device information • Pages visited on our website • Time and date of visits
COMMUNICATION DATA • Correspondence via email, WhatsApp, or phone • Feedback and reviews you provide • Waitlist registration information
3. How We Collect Your Data
We collect data through:
DIRECTLY FROM YOU • Consultation forms and health questionnaires • Waitlist and booking forms on our website • Email, phone, or WhatsApp communications • In-person conversations during appointments
AUTOMATICALLY • Website cookies and analytics (with your consent) • Server logs recording technical data
FROM THIRD PARTIES • Referrals from other healthcare providers (with your consent) • Payment confirmation from our payment processor
4. Legal Bases for Processing
Under UK GDPR, we process your data based on the following lawful bases:
CONTRACT We process identity, contact, and financial data to fulfil our contract with you—booking appointments, providing treatment, and processing payments.
LEGITIMATE INTERESTS We process data for our legitimate business interests, including: • Responding to enquiries and providing customer service • Improving our services based on feedback • Sending service-related communications (appointment reminders, treatment updates) • Website analytics to improve user experience • Protecting against fraud and maintaining security
CONSENT We only send marketing communications with your explicit consent. You can withdraw consent at any time.
LEGAL OBLIGATION We may process data to comply with legal requirements, such as maintaining financial records for HMRC.
VITAL INTERESTS In a medical emergency, we may share relevant health information to protect your vital interests.
EXPLICIT CONSENT (for Special Category Health Data) We process your health data based on your explicit consent, which you provide when completing our health questionnaire. You may withdraw consent at any time, but this may affect our ability to provide treatment.
5. How We Use Your Data
We use your personal data to:
• Process bookings and manage appointments • Conduct health assessments and provide personalised treatment • Maintain accurate clinical records • Process payments and manage accounts • Send appointment reminders and service updates • Respond to enquiries and provide customer support • Improve our services and website • Comply with legal and regulatory requirements • Send marketing communications (only with your consent) • Analyse website usage (anonymised/aggregated)
6. Data Sharing
We may share your data with:
SERVICE PROVIDERS • Payment processors (to process card payments securely) • Email service providers (to send appointment confirmations) • Website hosting and analytics providers • IT support and maintenance services
All service providers are contractually bound to protect your data and only process it on our instructions.
PROFESSIONAL BODIES If required for regulatory compliance or in response to a complaint, we may share information with the General Dental Council.
HEALTHCARE PROVIDERS With your explicit consent, we may share treatment summaries with your GP or other healthcare providers involved in your care.
LEGAL REQUIREMENTS We may disclose data if required by law, court order, or to protect our legal rights.
We do NOT sell your personal data to third parties.
7. Data Retention
We retain your data for the following periods:
CLINICAL RECORDS • Adult patients: 10 years from the date of last treatment (in line with professional guidelines) • Patients treated as children: Until the patient's 25th birthday or 10 years after last treatment, whichever is longer
FINANCIAL RECORDS • 7 years (as required by HMRC)
MARKETING CONSENT RECORDS • Duration of consent plus 2 years
WEBSITE ANALYTICS • 26 months (Google Analytics default)
ENQUIRIES AND WAITLIST DATA • 2 years from last contact, unless you become a patient
After retention periods expire, data is securely deleted or anonymised.
8. Your Rights
Under UK GDPR, you have the following rights:
RIGHT OF ACCESS Request a copy of your personal data (free of charge for the first request).
RIGHT TO RECTIFICATION Request correction of inaccurate or incomplete data.
RIGHT TO ERASURE ("Right to be Forgotten") Request deletion of your data in certain circumstances. Note: We may need to retain clinical records for legal/regulatory reasons.
RIGHT TO RESTRICT PROCESSING Request that we limit how we use your data.
RIGHT TO DATA PORTABILITY Request your data in a structured, machine-readable format for transfer to another provider.
RIGHT TO OBJECT Object to processing based on legitimate interests or for direct marketing.
RIGHT TO WITHDRAW CONSENT Withdraw consent at any time where processing is based on consent.
RIGHTS RELATED TO AUTOMATED DECISION-MAKING We do not use automated decision-making or profiling that produces legal effects.
To exercise these rights, contact us at hello@nesa.clinic. We will respond within one month.
9. Data Security
We implement appropriate technical and organisational measures to protect your data, including:
• Encrypted connections (HTTPS) for all website data transmission • Secure, password-protected systems for clinical records • Regular security updates and vulnerability assessments • Staff training on data protection and confidentiality • Limited access—only authorised personnel can access your data • Secure disposal of paper records
While we take all reasonable precautions, no internet transmission is completely secure. We cannot guarantee the security of data transmitted to us online.
10. International Transfers
Your data is primarily stored and processed in the UK. Some of our service providers may process data outside the UK (e.g., cloud services, email providers).
Where data is transferred internationally, we ensure appropriate safeguards are in place, such as: • Standard Contractual Clauses approved by the UK ICO • Adequacy decisions recognising equivalent protection • Binding Corporate Rules for multinational providers
Contact us if you want more information about specific transfers.
11. Cookies
Our website uses cookies. Please see our separate Cookie Policy for full details on what cookies we use and how to manage your preferences.
You can control cookies through: • Our cookie consent banner (displayed when you first visit) • The "Cookie preferences" link in our website footer • Your browser settings
12. Children's Privacy
Our services are generally intended for adults. For patients under 18, we require parental or guardian consent for treatment and data processing.
If you are a parent/guardian providing consent on behalf of a child, you have the same rights over their data as described in Section 8.
13. Changes to This Notice
We may update this Privacy Notice to reflect changes in our practices or legal requirements. The current version will always be on our website with the "Last updated" date shown above.
For significant changes, we will notify you by email (if we have your contact details) or via a prominent notice on our website.
14. Complaints
If you have concerns about how we handle your data, please contact us first at hello@nesa.clinic. We will try to resolve your concern promptly.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office Wycliffe House, Water Lane Wilmslow, Cheshire SK9 5AF Website: www.ico.org.uk Helpline: 0303 123 1113
15. Contact Us
For any privacy-related questions or to exercise your rights:
Data Controller: NESA Clinic London Address: 26-27 Bedford Square, Bloomsbury, London WC1B 3HP Email: hello@nesa.clinic Phone: +44 7899 121 612