Patient Privacy Notice
DR.JONNY
Epicdermis Medical Ltd, trading as Dr Jonny Aesthetics
Patient Privacy Notice
Last reviewed: 16 July 2026 Next review due: 16 July 2027
This notice explains what personal information Dr Jonny Aesthetics collects about you, why, how we look after it, and what rights you have. Please read it alongside your treatment consent form, which covers the clinical risks and details of your specific treatment separately from this notice.
Who we are
Dr Jonny Aesthetics is the trading name of Epicdermis Medical Ltd, a CQC-registered medical aesthetics clinic. For the purposes of data protection law, we are the “data controller” of your personal information — meaning we decide how and why it’s used, and we’re responsible for looking after it properly.
What information we collect
- Your name, date of birth, address, phone number, and email address
- Your medical history, including relevant conditions, medications, and allergies
- Details of your consultations, treatments, and the products used
- Photographs taken as part of your clinical record
- Your signed consent forms
- Any correspondence between us, such as emails or messages about your care
Why we collect it, and on what basis
We collect and hold this information because it’s necessary to provide you with safe, appropriate medical aesthetic treatment. Health information is treated as a special, more sensitive category of data under UK law. In most cases, we don’t need to ask for your separate agreement to hold your clinical records — the law recognises that a clinician needs to keep accurate records to treat you safely, and we’re bound by professional confidentiality obligations as your healthcare provider. This is a different, and in some ways stronger, protection than a simple tick-box agreement, because it doesn’t depend on remembering to opt in.
The one part of your visit that genuinely is a separate agreement, freely given, is your consent to the treatment itself — the form you sign confirming you understand the procedure, its risks, and that you’re choosing to go ahead. That consent is about the treatment; this notice is about how we handle the information that treatment creates.
Photographs
We take clinical photographs as a standard, necessary part of your treatment record, in the same way any clinic documents a procedure. These are stored securely and only ever used for your care.
If we ever wanted to use your photographs for any other purpose — for example, on our website or social media — we would ask you separately and explicitly, and you would be entirely free to say no without it affecting your treatment in any way. You can also withdraw that permission at any time, even if you’d previously agreed.
Marketing
We will only send you marketing communications, such as offers or newsletters, if you’ve separately and clearly agreed to receive them. Appointment reminders, aftercare information, and messages directly related to your treatment are not marketing, and are sent as a normal part of your care.
Who we share your information with
We use a small number of trusted, reputable services to help run the clinic securely. They only ever process your information on our instructions, and are never permitted to use it for their own purposes.
| Who | What they do | Where your data is held |
| Supabase | Securely stores your records, photographs, and signed consent documents | Ireland (EU) |
| Netlify | Hosts the clinic’s booking and records application | EU/US infrastructure |
| Calendly | Manages appointment bookings | As per Calendly’s own privacy policy |
| Hamilton Fraser | Our medical indemnity insurer — only contacted if a claim or complaint arises | UK |
How long we keep your information
We keep clinical records, including photographs and consent forms, for 10 years after your last treatment with us, in line with standard practice for private UK medical and aesthetic clinics. If you were under 18 at your last treatment, we keep your records until your 25th birthday. Full detail is available in our Data Retention Policy, available on request.
Keeping your information safe
- Your records are stored in an encrypted, private system — not a shared drive or generic file storage
- Only clinic staff involved in your care can access your record
- We keep a log of who has accessed clinical records, and when
- We take regular, secure backups so your records aren’t lost
Your rights
| Right | What it means |
| Access | You can ask for a copy of the information we hold about you. |
| Correction | You can ask us to correct anything that’s inaccurate or incomplete. |
| Erasure | You can ask us to delete your data, though we may need to keep clinical records for the period set out above, for legal and professional reasons. |
| Objection | You can object to certain uses of your data, such as marketing. |
| Withdrawing consent | Where we rely on your consent (for example, marketing emails or using your photos publicly), you can withdraw it at any time. |
How to make a request or raise a concern
If you’d like to exercise any of the rights above, or have any questions about how we handle your information, please contact us at hello@drjonny.co.uk or +44 (0) 203 100 46 99. We’ll respond within one month.
If you’re not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk or by calling 0303 123 1113.
Changes to this notice
We may update this notice from time to time, for example if we start using a new service or our practices change. The current version will always be available from the clinic.