Your privacy, in plain English.

The Mansfield Park Clinic is a trading name of THE MANSFIELD PARK CLINIC LTD, a company registered in England and Wales under company number 17144565. Our registered clinic address is Carr Bank Stables, Windmill Lane, Mansfield, Nottinghamshire NG18 2AL.

We are the data controller for the information described in this policy. That means we decide what information is collected and what happens to it, and we are responsible for looking after it.

If you have a question about anything here, contact us on [email protected] or 01623 461 723.

Depending on how you interact with us, we may hold:

• Contact details — your name, email address, telephone number and, where relevant, your address.
• Appointment information — what you booked, when, and any notes you gave us when booking.
• Health information — your medical history, medications, allergies, skin assessment, treatment records, consent forms and any clinical photographs. This is special category data and is treated with the highest level of protection.
• Payment information — a record that a payment was made and what for. Card details are handled by our payment provider and are not stored by us.
• Website information — technical data such as your browser type and how you moved through the site, collected through cookies.

When you fill in an enquiry form or book a consultation through this website, the details you enter are sent to us and stored in our practice management system so we can respond to you and prepare for your appointment.

We use that information to reply to your enquiry, arrange and confirm your appointment, and send you practical reminders about it. Appointment reminders are part of providing the service you asked for, so they are sent whether or not you have opted into marketing.

If you enquire but never become a patient, we keep your enquiry for up to two years and then delete it.

Before any treatment, we take a medical history and assess your skin. That, along with what we discuss, what we agree, what is carried out and any aftercare, forms your clinical record.

These records exist so that your care is safe. They let us check that a treatment is appropriate for you, track how your skin responds over time, and act properly if anything unexpected happens.

Clinical records are confidential. They are seen only by the clinician treating you and, where strictly necessary, by someone involved in your care. They are stored securely and access is restricted.

Clinical photographs are part of your record. We will always ask before taking them, and we will ask you separately and explicitly if we would ever like to use an image publicly — for example on social media. You are free to say no, and saying no will never affect your treatment. You can withdraw that permission at any time.

We will only send you marketing — offers, news, membership information or skincare advice — if you have specifically agreed to receive it.

You can withdraw that agreement whenever you like. Use the unsubscribe link in any email, reply STOP to any text, or simply tell us. We will action it promptly, and it will not affect your care in any way.

Appointment confirmations, reminders, aftercare instructions and safety information are not marketing. We need to send those to look after you properly, and they will continue even if you have opted out of marketing.

Cookies are small files placed on your device when you visit a website. Some are necessary for the site to work — remembering your session, keeping forms and bookings functioning, and keeping the site secure. These cannot be switched off without breaking the site.

Others help us understand how the site is being used, so we can see which pages are useful and where people get stuck. These are only set if you agree to them.

You can control cookies through your browser settings at any time, including deleting ones already stored. Blocking all cookies may stop parts of the site working.

Data protection law requires us to have a specific reason — a ‘lawful basis’ — for using your information. Ours are:

• To take steps before entering a contract, and to carry it out — responding to your enquiry, arranging your appointment and providing your treatment.
• Our legitimate interests — running and improving the clinic, keeping proper business records, and keeping the site secure. We only rely on this where it does not override your rights.
• Your consent — for marketing, for non-essential cookies, and for any public use of clinical photographs. You can withdraw consent at any time.
• Legal obligation — where we are required to keep or disclose information, for example for tax purposes or by a court.

Health information carries an extra requirement. We handle it on the basis that it is necessary for the provision of health care and treatment by a health professional bound by a duty of confidentiality — the condition set out in Article 9(2)(h) of the UK GDPR.

• Clinical and treatment records — eight years after your last treatment.
• Enquiries that did not lead to treatment — up to two years.
• Financial records — six full financial years, as tax law requires.
• Marketing preferences — until you unsubscribe, plus a minimal record of the fact you unsubscribed so that we do not contact you again by mistake.

When a retention period ends, information is securely deleted or destroyed.

We do not sell your information, and we never share it with anyone for their own marketing.

We do share it, only as far as necessary, with:

• Our software providers — the systems that run our website, bookings, records and email. They act on our instructions and cannot use your information for their own purposes.
• Payment providers — to take payment securely.
• Our professional advisers — accountants, insurers or indemnity providers, where genuinely needed.
• Other healthcare professionals — only with your knowledge, or where it is necessary to protect your safety.
• Regulators or authorities — where the law requires it.

Some of the providers we rely on to run this website and our booking system store or process information outside the UK, including in the United States.

Where that happens, we make sure appropriate safeguards are in place so your information keeps the protection it has under UK law — ordinarily through the UK’s international data transfer agreement or an adequacy decision. You can ask us for details of the safeguards that apply.

Under UK data protection law you have the right to:

• See what we hold about you, and get a copy.
• Have it corrected if it is wrong or incomplete.
• Have it deleted in certain circumstances.
• Restrict how we use it while a concern is being resolved.
• Object to us using it, including for marketing.
• Receive it in a portable format, or have it sent to another provider.
• Withdraw consent at any time, where consent is what we relied on.

One honest caveat on deletion: where a clinical record must be retained for safety, legal or insurance reasons, we may not be able to erase all of it straight away. If that applies, we will tell you plainly which parts we have to keep and why.

To exercise any of these rights, email [email protected]. We will respond within one month. There is no charge.

If you are unhappy with how we have handled your information, please tell us first — email [email protected] or call 01623 461 723. Most things are quickest to put right directly.

You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator, at any time. You do not have to come to us first.

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline 0303 123 1113, or ico.org.uk/make-a-complaint.

We review this policy from time to time and will update it when how we handle information changes. The date at the top of the page always shows when it was last revised.

Where a change materially affects you, we will bring it to your attention rather than rely on you noticing.