Privacy Policy

Last updated: 21 August 2026

1. Who we are

ClinicOS Ltd ("ClinicOS", "we", "us") runs this website and the ClinicOS platform used by aesthetics clinics across the UK. We are UK-based and our systems are hosted in AWS London (eu-west-2). You can reach us about anything in this policy at privacy@clinicos-dev.com.

2. Two roles: controller and processor

For visitors to this website, ClinicOS is the data controller: we decide how and why the small amount of data described in section 3 is used.

For patient records held by clinics on the ClinicOS platform, the clinic is the data controller and ClinicOS is a data processor. We process patient records only to provide the platform and on the clinic's instructions. If you are a patient and want to know how your clinic uses your data, ask the clinic: it is their record, held on their behalf.

3. What we collect on this website

Very little. This website has no visitor accounts and sets no analytics or advertising cookies. Browsing it does not require you to tell us who you are.

Like almost every website, our servers keep short-lived technical logs (such as IP address, request URL, time and browser type) that we use for security and to keep the service running. If you email us, we hold your message and address for as long as we need them to deal with your enquiry.

4. What the platform processes when you book

When you book an appointment with a clinic through ClinicOS, the platform processes, on that clinic's behalf:

• identity data, such as your name and date of birth;
• contact data, such as your email address and phone number;
• appointment data, such as the service, clinician, time, location and any notes, forms or consents attached to your visit;
• payment data for deposits and payments, processed by Stripe; ClinicOS does not store full card numbers.

All of this is kept in AWS London (eu-west-2).

5. Lawful bases

• Performance of a contract: taking and managing your booking, and providing the platform to clinics.
• Legitimate interests: keeping our services secure, preventing abuse, and answering enquiries.
• Legal obligation: where we must keep or disclose information to comply with the law.
• Consent, where a clinic relies on it: clinics collect their own consents for treatment and communications, using the platform's consent tools.

6. Who we share data with

• Stripe, which processes deposits, payments and saved cards.
• Messaging providers, which deliver appointment reminders and messages by email, WhatsApp and SMS.
• Google: the ratings and reviews shown on this site come from Google's data for each clinic, which we cache; we do not send Google your booking data for this.
• Amazon Web Services, which hosts the platform in London.

We do not sell personal data, and we do not share it with advertisers.

7. International transfers

The platform and its data are hosted in the UK (AWS London, eu-west-2). Where a service provider processes limited data outside the UK or EEA, for example to deliver a payment or a message, we rely on appropriate safeguards such as UK adequacy decisions or standard contractual clauses.

8. Retention

We keep personal data only as long as it is needed for the purposes above and to meet legal obligations. Clinical records are subject to retention obligations that apply to the clinic as controller; patients can ask their clinic how long their records are kept. Server logs are short-lived and rotated automatically.

9. Your rights

Under UK GDPR you have the right to:

• access the personal data held about you (a subject access request);
• have inaccurate data corrected;
• have data erased where it is no longer needed;
• restrict or object to certain processing;
• receive certain data in a portable format.

The ClinicOS platform has subject access export and erasure built in, so clinics can act on these requests without delay. For data about your bookings or treatment, contact your clinic first, as the controller of that data. For data ClinicOS controls, contact privacy@clinicos-dev.com.

10. Complaints

If you are unhappy with how your data has been handled, we would like the chance to put it right: contact privacy@clinicos-dev.com. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

11. Changes to this policy

We will update this policy when our practices change, and the date at the top shows the current version. Significant changes will be flagged more clearly, for example by email to clinics. See also our Cookie Policy.