Privacy Policy

This Privacy Policy sets out how we handle the Personal Data of our customers, patients and users of our website. We are a private dermatology and aesthetic medicine clinic. This Privacy Policy relates to our website only. If you go to a website that is linked from this website then you should read their Privacy Policy.

Background

We are committed to protecting and respecting your Privacy. Midland Skin Ltd is a data controller and complies with UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and with the confidentiality guidelines set out but not limited to by professional bodies including the General Medical Council. We process your data in a lawful, fair and transparent manner.

We make every effort to protect the security of your personal data and we have put in place certain physical, electronic and operational procedures to make sure that your data is secure. Your records with us may be electronic, on paper or a mixture of both.

We do not have a Data Protection Officer. However, the directors are responsible for overseeing this Privacy Policy. The directors can be contacted at Midland Skin Ltd, 38 Harborne Road, Birmingham B15 3HE.

Please contact us with any questions about this Policy or if you have any concerns that this Privacy Policy is not being or has not been followed.

What does this Policy cover?

This Policy applies to your use of the Site and to the Services. The Site may contain links to other websites. Please note that we have no control over how your data is collected, stored, or used by other websites and we advise you to check the Privacy policies of any such websites before providing any data to them.

What data do we collect?

If you visit our site, or make an enquiry via our site or by email, we may hold the following information about you:

• Name
• Contact details such as email and telephone number (mobile or landline)
• Gender
• Your payment method
• Enquiry details
• Information on how you found out about us
• IP address
• Web browser type and version
• Operating system

If you choose to make an appointment or ask another practitioner to refer you to us then we may hold the following additional information about you:

• Contact details such as your address
• Your date of birth
• GP details and details of your referrer if applicable
• Emergency contact details including next of kin
• Details of the private medical insurances you may hold
• Your occupation
• Emergency contact details

By choosing to make an appointment with us, you enter into a contract for us to provide you with our services.

Being a provider of healthcare services, we will also need to collect and hold special categories of personal information as this allows us to do our job. This includes:

• Your medical history
• Information on your ethnicity, race, religion, sexual orientation and sexual history
• We keep a record about your health including any treatment or care you have received previously.

Where do we obtain information from?

We may obtain information from the following sources:

• From you or someone acting on your behalf:
  • If you contact us via our site, email us, write to us, message us on our social media channels, or telephone us.
  • If you make an appointment and enter into a contract for us to provide healthcare services to you
  • If you receive healthcare or other services from us
  • If you participate in our marketing activities
• From medical records, referral letters and other correspondences received from other health related establishments such as those listed below. This could be if a referral is made to us from these parties or in instances where it is necessary for the provision of safe and effective health services to you.
  • Your GP
  • Other specialists you have seen
  • Your dentist
  • Other NHS and private health providers
• From other individuals and organisations who we may be liaising with such as
  • Your private medical insurer (former or current)
  • Debt collection and credit reference agencies
  • Your family members

How do we use your data?

We use your data to:

• Respond to your emails and queries
• Provide you with healthcare and related services.
• Write to you to summarise your skin condition and treatment plan.
• Write to your GP so that they are aware of your skin condition and treatment plan.
• Settle your account with us, or to make any fraud, credit, anti-money laundering and other regulatory checks
• To conduct clinical audits and surveys, which assess the quality of our services and any areas where improvements can be made. These are not marketing exercises and are a compulsory requirement for our regulators the Care Quality Commission.
• Defend or exercise our legal rights.
• Comply with our legal and regulatory obligations. For example we may be required to share records with the Care Quality Commission and the Private Health Care Information Network.
• Provide marketing to you in line with the preferences you have expressed in our Patient Registration Form.

How will we communicate with you?

It is inevitable that we will need to correspond with you about your treatment. We will do this by telephone, SMS, email and/or post.

Appointment and appointment reminders are sent by SMS, email and/or post. We may contact you by telephone if there is a change to the appointment time.

Clinical updates and results are sent by post or by email. If necessary, we may telephone you with clinical updates too.

Referral letters to other practitioners are sent by post.

We may contact you for patient feedback surveys by phone, SMS or email. These are not for marketing but for assessing the quality of our services and your experience with us. Participation in surveys is voluntary and it is possible to opt-out from future surveys.

If you have chosen not to be contacted by SMS or email on your registration form then we will contact you by post, and in cases where urgent clinical information must be related to you, by telephone.

Who do we share your information with?

We may communicate with the following by email, voice message, post, fax or telephone. We only share information with others if there is a genuine need for it or if it is required for the delivery of our business Services to you:

• Your GP so they are up to date with your medical condition
• Another healthcare provider (or their administrative staff) involved in your care such as a nurse, a doctor, a Psychologist, a dentist, or another professional
• Pathology laboratory if you have pathological tests done
• Heidi, the secure AI clinical note-taking tool used during consultations, which acts as our contracted data processor. Heidi creates a real time transcript so your clinician can focus on you. We do not store audio recordings. Consultation data is processed and stored in the UK with encryption and strict access controls, and is used only to deliver your care and manage your records, not for marketing or unrelated product training.
• Anyone you ask to communicate with us as your representative
• NHS organisations
• Insurance companies
• Care Quality Commission
• Private Healthcare Information Network
• Third parties we use in the usual course of our business to carry out services for us including record management, credit control, administration, call handling, and secretarial services, legal services, IT suppliers. Only data that is essential for third parties to carry out their duty is shared with them. We ensure that third parties attest that they operate under current data protection regulations before engaging them.

What marketing activities do we carry out?

If you have consented for us to do so then we will use your personal information to provide you with information on our products and services by email or by post.

If you do not wish to receive marketing from us then you may decline this on the Patient registration form, or click an unsubscribe link, or contact us at any other time.

We may use automated processing of your personal data, that is where a computer analyses your data, in order to evaluate certain characteristics and to give us an insight on how to focus our marketing with targeted ads on Facebook, Instagram and Linkedin. All information used for profiling by third parties will be anonymised and you can opt out of automated profiling by contacting us.

How long do we keep your information for?

We only keep your Personal Data for as long as we need to in order to use it and/or for as long as We have your permission to keep it. Some or all of your data may be stored outside of the United Kingdom and you are deemed to accept and agree to this by using the Site or engaging our Services and submitting information to us. If we do store data outside the United Kingdom, We will take all reasonable steps to ensure that your data is treated as safely and securely as it would be within the UK under the Data Laws. The duration we keep data depends on the type of data as below.

• CCTV records in our clinics are kept for up to a maximum of 30 days
• Telephone call recordings are kept for a maximum of one year and financial information is not taken on a recorded line. Downloaded calls are deleted as soon as their use is complete.
• Patient enquiries by email or telephone notes thereof, and prospective patient information obtained from marketing activities such as open days are kept for 6 years.
• Medical records, patient surveys, invoicing information are kept for the life of your account with us and for eight years thereafter.

Change of business ownership and control

If our business changes ownership or control then the personal data you give us will, if it is appropriate, be transferred to any new owner but always under the terms of the Policy and for the permissions for use of your data that you have provided. We will not notify you if there is a change of business ownership or control.

Changes to this Policy

We may change this Policy from time to time or as required by law. Please check back regularly to obtain the latest version of this Policy. We last revised this Policy on 26 September 2026.

This Privacy Standard does not override any applicable national data Privacy laws and regulations in countries where the Company operates.

How can you access your data?

You have the right to ask for a copy of any of your Personal Data held by us (where such data is held). No fee is payable and we will provide any and all information in response to your request free of charge. Please contact us for more details. Please note that you will need to give adequate information so that your identity can be verified. Asking for a copy of your Personal data will not affect your ongoing care.

Cookies

What is a Cookie?

A cookie is a small file that is sent from a website and stored on your device which identifies you from other users of our Site.

Types of Cookie

The Site may place and access certain first party Cookies on your computer or device. First party Cookies are those placed directly by us and are used only by us. We use Cookies to facilitate and improve your experience of the Site and to provide and improve our services. We have carefully chosen these Cookies and have taken steps to ensure that your Privacy and Personal Data is protected and respected at all times.

By using the Site you may also receive certain third party Cookies on your computer or device. Third party Cookies are those placed by websites, services, and/or parties other than us. Third party Cookies are used on the Site, usually, for marketing and analysis purposes. These Cookies are not integral to the functioning of the Site and your use and experience of the Site will not be impaired by refusing consent to them.

All Cookies used by and on The Site are used in accordance with Cookie Law.

Cookie notice on this Site

Before Cookies are placed on your computer or device, you will be shown a prompt explaining that our Site uses cookies. Your adherence to our Site or accepting this notice provides consent for the use of Cookies.

Disabling and deleting Cookies

You can choose to disable Cookies in your internet browser. Most internet browsers also enable you to choose whether you wish to disable all cookies or only third party Cookies. By default, most internet browsers accept Cookies but this can be changed. For further details, please consult the help menu in your internet browser or the documentation that came with your device.

You can choose to delete Cookies on your computer or device at any time, however you may lose any information that enables you to access the Site more quickly and efficiently including, but not limited to, login and personalisation settings.

First party Cookies

Certain features of the Site depend on Cookies to function. Cookie Law deems these Cookies to be “strictly necessary”. These Cookies are shown below. Your consent will not be sought to place these Cookies, but it is still important that you are aware of them. You may still block these Cookies by changing your internet browser’s settings, but please be aware that the Site may not work properly if you do so. We have taken great care to ensure that your Privacy is not at risk by allowing them.

The following first party Cookies may be placed on your computer or device:

No first party Cookies in current usage.

Third party Cookies

The following third party Cookies may be placed on your computer or device:

DoubleClick	Google	Used for certain Google Ad services, user data is anonymous
Google maps	Google	Cookies are stored when you access a page with Google maps embedded on it
Google Analytics	Google	Anonymous website usage information.
Facebook pixel	Facebook	When you use this Site and then visit Facebook, a targeted ad may be shown to you based on your visit to this site.
Instagram pixel	Instagram	When you use this Site and then visit Instagram, a targeted ad may be shown to you based on your visit to this site.

The Site uses analytics services provided by Google and other service providers. Website analytics refers to a set of tools used to collect and analyse anonymous usage information, enabling us to better understand how the Site is used. You do not have to allow us to use these Cookies, however whilst our use of them does not pose any risk to your Privacy or your safe use of the Site, it does enable us continually to improve the Site, making it a better and more useful experience for you.

Definitions

We, Us, Our	Midland Skin Ltd. Registered in England and Wales Company number 12295594 Registered office address: 38 Harborne Road, Birmingham B15 3HE
You, Your	are a visitor to this Site and/or anyone using our Services;
Site	www.midlandskin.co.uk;
Content	means any text, graphics, images, audio, video, software, data compilations and any other form of information capable of being stored in a computer that appears on or forms part of this Site;
Privacy Laws	means the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and any other Privacy laws to which these terms and conditions may be subject.
Services	means the medical advice, services and treatment we provide to you;
System	means any online communications infrastructure that we make available through the Site or an App either now or in the future;
Third Party	means any person, firm or company which is not you or employed by you under a contract of employment;
Cookie	means a small text file placed on your computer or device by The Site when you visit certain parts of The Site and/or when you use certain features of The Site.
Cookie Law	means the relevant parts of the Privacy and Electronic Communications (EC Directive) Regulations 2003;
Data Laws	the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018;
Personal Data	means any and all data that relates to an identifiable person who can be directly or indirectly identified from that data. In this case, it means Personal Data that you give to us when you use the Site or the services we offer. Personal Data includes Sensitive Personal Data and Pseudonymised Personal Data but excludes anonymous data or data that has had the identity of an individual permanently removed. Personal data can be factual (for example, a name, email address, location or date of birth) or an opinion about that person’s actions or behaviour.
Sensitive Personal Data	information revealing racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health conditions, sexual life, sexual orientation, biometric or genetic data, and Personal Data relating to criminal offences and convictions