(Private GP, Menopause, Dermatology, Aesthetics and Minor Surgery)
Shenfield Private GP, product of Aesthetk Ltd ("the Practice", "we") is an independent healthcare provider offering various services including but not limited to, private GP services, menopause care, dermatology, aesthetic treatments and minor surgery.
The Practice is the "data controller" for the personal data it collects and uses about you, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
The Practice collects and uses:
We use your personal data to:
We will not use your information for automated decision making that produces legal or similarly significant effects about you.
Under UK GDPR, we must have a lawful basis to process your data. For most of our activities we rely on:
Because we provide healthcare, we regularly process "special category" data (health information) and sometimes images, including close up photographs of skin, treatment areas or procedure sites.
These are processed only where necessary for your care, our legitimate interests in providing specialist services, or where required by law, and with extra safeguards such as restricted access, secure storage and, where appropriate, explicit consent.
We only share your information where it is necessary and appropriate, and we ensure anyone we share information with is subject to strict confidentiality and data protection obligations. Examples include:
We do not sell your data to third parties. If we ever wish to share your identifiable information for purposes such as teaching or marketing, we will ask for your explicit consent.
Patients are informed that the practice uses Heidi, a secure medical transcription/AI scribe service, to help document consultations. The practice privacy notice explains that Heidi is used solely to support accurate clinical record‑keeping, sets out what personal data may be processed during transcription, and describes how that data is stored, how long it is retained, and the technical and organisational measures in place to protect confidentiality and security.
We use Semble clinical software to manage appointments, medical records and related administration for our services. Semble acts as a secure electronic health record and practice management system, and processes personal data such as your contact details, demographic information, medical history, consultation notes, test results, prescriptions and invoices for the purposes of providing and organising your care. Semble operates under our written instructions and in accordance with UK data protection law, using appropriate technical and organisational measures (including access controls and encryption) to keep your information confidential and secure. Our privacy policy explains what information is stored in Semble, the legal basis for this processing, how long it is retained, who it may be shared with when necessary for your care or legal obligations, and the rights you have over your data, including access, rectification and complaint routes.
We use digital phone systems supplied and supported by Interact Technology Technical, to handle incoming and outgoing calls, voicemail and call routing for our services. These systems process personal data such as callers’ phone numbers, call timings, voicemail recordings and, where applicable, brief information you choose to share during calls for the purposes of managing enquiries, booking appointments and supporting your care. Interact Technology provides this service under our instructions and is required to comply with UK data protection law, including implementing appropriate technical and organisational measures (such as access controls, secure transmission and controlled retention of call data) to protect your information. Our privacy policy explains what information may be captured via our phone systems, the lawful basis for processing it, how long it is kept, who it may be shared with where necessary (for example, for clinical, safeguarding or legal reasons), and your rights over your data, including access, rectification and how to raise concerns or complaints.
Most data is stored and processed within the UK or European Economic Area.
If we need to use services that store or process data outside the UK/EEA, we will ensure appropriate safeguards are in place, such as UK approved standard contractual clauses or equivalent protections required by data protection law.
We keep your information only for as long as necessary for the purposes described in this notice and in line with relevant guidance and legal requirements (for example, recommended minimum retention periods for medical records).
When records are no longer required, they are securely deleted or destroyed in accordance with our retention policy.
We take appropriate technical and organisational measures to protect your data, including secure electronic systems, access controls, staff training and confidentiality agreements.
Only staff and clinicians who need to see your information for their role are allowed to access it, and all staff are bound by duties of confidentiality.
You have rights over your personal data, including the right to:
These rights are subject to some legal limitations, particularly in relation to health records where information may need to be retained for clinical or legal reasons.
To exercise your rights, please contact us using the details below.
We do not automatically add patients to marketing lists.
If you choose to receive information about new services, events or promotions (for example, aesthetic treatment offers), we will rely on your consent or legitimate interests as appropriate, and you can opt out at any time using the unsubscribe instructions in our messages or by contacting the Practice.
If you use our website, it may collect limited information such as IP address, device information and browsing behaviour using cookies or similar technologies.
This helps us maintain and improve the website; details are provided in our separate Cookie Policy where relevant.
If you have any questions about this privacy notice or how we use your data, or if you wish to exercise your data protection rights, please contact:
Last updated: February 2026