Privacy policy | Avalera

Who we are

Avalera Medical Aesthetic is the trading name of Avalera Medical Aesthetic Ltd, a company registered in England and Wales with company number 17438128. Our clinic is at The Light Centre, Belgravia, London.

We are the controller of the personal information described here. For anything about your information, email us at info@avalera.co.uk.

What we collect

When you send an enquiry: your name, email address, how you would like us to get back to you, and if you choose to give them, your phone number, the treatment you are interested in, your message and how you heard about us. With it we note which website or link brought you to this website, such as a Google search or one of our Instagram posts, and the campaign name if the link had one. Your browser keeps this in its memory only while you visit, not on your device, and sends it only if you send the form.
When you email us: your email address and whatever you include in your message.
When you message us on WhatsApp, or ask us to contact you there: your phone number, your WhatsApp name and your messages. WhatsApp is provided by WhatsApp Ireland Limited (Meta), which handles them under its own terms and privacy policy. Please do not send detailed medical information by WhatsApp; we discuss it at your consultation.
When you send the form: to stop spam and repeated sending, we keep scrambled codes made from your IP address and your email address for 30 minutes, then delete them; they do not show the addresses themselves. Your browser also completes a small automatic check that shows the form came from our website. It needs nothing from you and stores nothing on your device.
If you become a client: your contact details, your medical history and your treatment records. Information about your health is special category data, and we explain how we use it at your consultation before any treatment.
Before and after photos: taken only with your written consent. We publish a photo only with your separate written consent, which you can withdraw at any time.
When you visit this website: we do not use analytics or advertising cookies. The companies that host this website may keep technical logs for a short time, such as IP addresses, to keep it secure.

How we use it, and our lawful basis

To reply to your enquiry and arrange a consultation. Lawful basis: taking steps at your request before providing a service, and our legitimate interest in answering enquiries. If your message includes anything about your health, we use it only to reply, with your explicit consent, given with the tick box on the form.
To assess suitability, provide treatment and aftercare, and keep clinical records. Lawful basis: performing our agreement with you. For health information, your explicit consent, which we ask for at consultation.
To comply with legal, insurance and regulatory obligations. Lawful basis: legal obligation.
To see which of our adverts, posts and listings bring enquiries, from how you heard about us and the link that brought you. Lawful basis: our legitimate interest in knowing which of our marketing works. We look at these answers together, to compare where enquiries come from, not to profile you.
To keep this website secure and our enquiry form free of spam. Lawful basis: our legitimate interest in protecting them.

We do not send marketing emails, and we never sell or rent your information.

Do you have to give us your information?

No. Without your name and email address we cannot reply to an enquiry. Before any treatment we need your medical history, and we cannot treat you without it. We do not make decisions about you by automated means.

Who we share it with

We share it only where needed:

Service providers who work for us under contract and only on our instructions: Netlify hosts this website, Resend delivers the emails from our enquiry form and Microsoft hosts our email inbox.
Our insurers and professional advisers.
Regulators or authorities, where the law requires it.

Netlify and Resend are based in the United States, so information you send through this website is processed there. Resend is certified under the UK Extension to the Data Privacy Framework, which UK law treats as giving adequate protection. For Netlify, and any other provider that processes information outside the UK, we rely on the safeguards in its data processing agreement with us, such as standard data protection clauses. To get a copy of these safeguards, email us.

How long we keep it

We keep personal information only for as long as we need it for the purposes above, including any period required by law, our insurers or professional guidance. We keep treatment records after your treatment ends, so we can answer questions about it and deal with any claims. Then the information is securely deleted. You can ask us for the retention period that applies to you at any time.

Your rights

Under UK data protection law, and the EU GDPR if you live in the European Economic Area, you have the right to:

ask for a copy of the information we hold about you;
ask us to correct information that is wrong or incomplete;
ask us to delete your information, or to restrict how we use it;
object to how we use it, where we rely on legitimate interests;
ask for your information in a portable format;
withdraw consent at any time, where we rely on consent.

To use any of these rights, email info@avalera.co.uk. We will reply within one month. There is normally no charge.

Complaints

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk (opens in a new tab). If you live in the European Economic Area, you can also complain to your local data protection authority.

Cookies

The cookies and storage this website uses, and how to change your choice, are on our Cookies page.

Changes to this policy

If we change how we use personal information, we will update this page and the date at the top.