Privacy Notice

Who we are

Bravita Clinic Ltd ("Bravita", "we", "us", "the clinic") is the data controller for the personal information described in this notice — both information collected through this website and information we hold about you as a patient of the clinic. Our registered address is 6 Julia Drive, Sandwith, Whitehaven, Cumbria, CA28 9US. We are registered with the Information Commissioner's Office (ICO) under registration number ZC183060. Treatments are provided by Rafaela Thomson, Advanced Aesthetic Practitioner.

Website enquiries

When you submit an enquiry through this website, we collect your name, your contact details (email and/or phone), your preferred contact method and your message. We use this information solely to respond to your enquiry and arrange any consultation you request, on the basis of your consent (UK GDPR Article 6(1)(a)), which you give by ticking the consent box and submitting the form. You can withdraw your consent at any time by contacting us. We do not collect health information through this website. Enquiries that do not lead to a booking are kept for no longer than 12 months and then securely deleted.

If you become a patient

As a patient of the clinic, we collect and hold more than website enquiries alone:

• Identity and contact details — your name, date of birth, email address, phone number and address.
• Health information — allergies, relevant medical and surgical history, previous cosmetic treatments, your concerns, consultation and treatment notes, and any incidents. This is "special category" data and receives extra protection.
• Photographs — clinical before/after and assessment photographs of your face or body, treated as special category data.
• Consent records — records of the consents you give, including signatures.
• Payment information — card details are handled securely by our payment provider, Stripe; we do not store your card number.

We use this information to deliver safe care and keep your clinical record (on the basis of our contract with you and the provision of health care, UK GDPR Article 9(2)(h)), to manage appointments and payments (contract), to keep security and audit records (legal obligation and legitimate interests), and — only where you have given explicit consent — to analyse your photographs with AI tools that support your practitioner's assessment, and to send you marketing. Consent can be withdrawn at any time without affecting care you have already received.

Who we share it with

We do not sell your data. We share it only with service providers who help us run the clinic, under contract and only as needed: Supabase (secure database and storage, hosted in the EEA), Resend (email), Stripe (payments), OpenAI and Anthropic (AI analysis you have consented to, United States), Netlify (website and app hosting) and Sentry (error monitoring, configured not to collect personal data). A full list is kept in our internal processor register and can be provided on request.

Where your data is transferred outside the UK, we put in place an approved safeguard (the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses) and assess the risks.

How long we keep it

• Clinical records and clinical photographs — at least 8 years after your last treatment (a recognised clinical standard).
• Payment and financial records — 6 years plus the current year (tax law).
• Website enquiries not leading to a booking — no longer than 12 months.
• Marketing consent — until you withdraw it; we keep a minimal record so we can honour your opt-out.

Your rights

You have the right to access, correct, delete or restrict the processing of your personal data, to data portability, and to object or withdraw consent. Patients can download a copy of their data and manage preferences directly in the patient portal. To exercise any right, contact us at hello@bravitaclinic.com — we will respond within one month. You also have the right to complain to the ICO (ico.org.uk/concerns, 0303 123 1113), though we would welcome the chance to put things right first.

WhatsApp and Instagram

If you choose to contact us via WhatsApp or Instagram, your message is handled on those platforms and is subject to Meta Platforms' own privacy terms. We have no control over data processed by Meta when you use those services.

Contact

For any question about your data, contact our data-protection lead at hello@bravitaclinic.com, or write to us at the address above.

Changes to this notice

We may update this notice from time to time. The current version and its date are shown at the top of this page.