Privacy Notice
Last updated: 28 September 2026
1. Who we are
Shumaila’s Aesthetic and Laser Clinics, operated by Shumaila’s London, is responsible for deciding how and why your personal information is used. This means we are the data controller.
This Privacy Notice applies when you enquire about, book or receive our treatments, use our website, contact us, make a payment or apply for finance.
Company Name: Shumaila’s London
Company Number: 11340795
Registered Office: 104 Cranbrook Road, Ilford, IG1 4FG
Contact for data protection matters:
Email: hello@shumailas.com
Telephone: 0208 050 9091
2. The information we collect
Depending on how you use our services, we may collect the following information about you:
Type of information | What this may include |
|---|---|
Identity information | Name; date of birth; gender |
Contact information | Email address; telephone number; postal address |
Health information | Medical history; allergies; current medication; skin assessments; treatment suitability information; consultation records |
Treatment information | Treatment history; appointment records; clinical notes; before and after photographs |
Financial information | Payment details; finance application information where applicable |
Technical information | IP address; device information; website activity; cookie data |
We collect personal information directly from you when you contact us, complete forms, book appointments, attend consultations, receive treatment, make payments or use our website.
We may also receive information from payment or finance providers where this is necessary to provide a service you have requested.
Where we ask you to provide information needed to assess treatment suitability, provide treatment, take payment or meet a legal requirement, we will explain this at the time. If you do not provide information that is necessary, we may be unable to provide the relevant treatment or service.
3. How we use your information
The table below explains why we use your information and the lawful basis we rely on. A lawful basis is the legal reason that allows us to use your information.
Purpose | Lawful Basis |
|---|---|
Managing appointments | Contract |
Providing treatments | Contract |
Maintaining treatment records | Legitimate interests and healthcare provision |
Processing health information | Article 9(2)(h) – health care provision |
Taking clinical photographs | Contract and healthcare provision |
Using photographs for marketing | Explicit consent |
Customer service | Legitimate interests |
Complying with legal obligations | Legal obligation |
Direct electronic marketing | Consent |
4. Health information
Information about your health is sensitive personal information under data protection law. We need it to decide whether a treatment is safe and suitable for you and to provide appropriate care.
We will only use this information where data protection law allows us to do so.
Depending on the circumstances, we rely on the following UK GDPR provisions:
- Article 6(1)(b) – Contract
- Article 6(1)(c) – Legal Obligation
- Article 9(2)(h) – Health Care Provision
If the law requires us to obtain your explicit consent, we will ask for it clearly before using the information in that way.
5. Clinical photographs
Clinical photographs may be taken:
- To assess suitability for treatment.
- To monitor treatment progress.
- To maintain clinical records.
- For clinical governance purposes.
Using photographs for marketing is optional and separate from their use as part of your clinical care.
We may use photographs for marketing on:
- Our website
- Social media
- Advertising material
We will only use your photographs for these marketing purposes if you have given your explicit consent.
You can withdraw your marketing consent at any time by contacting us. This will not affect any other treatment or service you receive.
6. Who we share information with
We may share your information with the organisations below where this is necessary to provide our services, run our business or meet a legal or regulatory requirement:
- Employees and practitioners involved in providing treatment
- Payment providers
- Finance providers
- IT service providers
- Professional advisers
- Insurers
- Regulators
- Law enforcement agencies where legally required
We do not sell personal data.
7. Transfers outside the UK
If we transfer your personal information outside the UK, we will use safeguards recognised by UK data protection law to protect it.
These may include:
- UK International Data Transfer Agreement (IDTA)
- Adequacy Regulations
- Other approved transfer mechanisms
This is particularly important if information is accessed from overseas clinic locations.
8. How long we keep your information
Record Type | Retention Period |
|---|---|
Clinical records | 8 years after last treatment |
Financial records | 6 years |
Marketing preferences | Until withdrawn |
Call recordings | 30 days unless required longer |
Clinical photographs | 8 years after last treatment unless longer retention is required |
We may keep information for longer where this is necessary to meet a legal or regulatory requirement, deal with a complaint or legal claim, or protect your vital interests.
9. Your data protection rights
Depending on the circumstances, you may have the right to:
- Access your personal data
- Correct inaccurate data
- Request erasure
- Restrict processing
- Object to processing
- Data portability
- Withdraw consent
- Not be subject to automated decision making
To exercise any of these rights, please contact us:
Email: hello@shumailas.com
Telephone: 0208 050 9091
10. Marketing
We will only send electronic marketing where:
- You have consented; or
- The law allows us to contact existing customers about similar services, sometimes referred to as the soft opt-in.
You can opt out of marketing at any time by using the unsubscribe option in a message or by contacting us.
11. Cookies
Our website uses cookies and similar technologies to make the site work and to help us understand how it is used.
Full details are available in our Cookie Policy.
12. How to complain
If you have concerns about how we use your information, please contact us first so that we can try to resolve them.
You can also complain to the UK data protection regulator:
Information Commissioner’s Office (ICO)
Website: www.ico.org.uk
13. Changes to this Privacy Notice
We may update this Privacy Notice from time to time. The latest version will be available on our website, so please check it occasionally for changes.