Privacy Policy

Last updated: 10 September 2026

1. About this Privacy Policy

Estiora Aesthetics respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how SMAY Medical Group Ltd, trading as Estiora Aesthetics, collects, uses, stores and protects your personal information when you visit our website, contact us, book an appointment or receive our services.

We process personal information in accordance with applicable UK data protection legislation, including the UK GDPR and Data Protection Act 2018.

2. Who is responsible for your information?

The organisation responsible for your personal information is:

SMAY Medical Group Ltd
Trading as Estiora Aesthetics
London, United Kingdom

If you have any questions about how we use your information, please contact us through the contact details provided on our website.

3. Information we collect

Depending on how you interact with us, we may collect:

Personal and contact information

  • Name

  • Email address

  • Telephone number

  • Address

  • Appointment details

  • Booking and cancellation information

Treatment and consultation information

Where necessary to provide our services safely, we may collect information such as:

  • Medical history

  • Allergies and sensitivities

  • Current medications

  • Previous treatments

  • Relevant medical conditions

  • Treatment records

  • Consultation notes

  • Before-and-after photographs where applicable

  • Information relevant to treatment suitability and aftercare

Health information can constitute special category personal data, which receives additional protection under UK data protection law.

Payment information

Payments and deposits may be processed through third-party payment providers such as Stripe. We do not normally store your full payment card details ourselves.

Website information

When you use our website, we may collect information such as your IP address, browser/device information and information about how you use our website, subject to your cookie preferences.

Please see our Cookie Policy for further information.

4. How we use your information

We may use your information to:

  • Respond to enquiries and requests

  • Arrange and manage appointments

  • Provide consultations and treatments

  • Assess treatment suitability and safety

  • Maintain accurate treatment records

  • Provide treatment advice and aftercare

  • Process payments and deposits

  • Contact you regarding your appointments

  • Manage cancellations and appointments

  • Improve our services and website

  • Meet our legal and regulatory obligations

  • Protect our business, clients and staff

  • Send marketing communications where you have provided the appropriate consent

We will only use your personal information for purposes that are lawful, fair and transparent.

5. Our lawful basis for processing

Depending on the circumstances, we may process your personal information on the following lawful bases:

  • Contract: where processing is necessary to provide a service you have requested or to manage your appointment.

  • Legal obligation: where we need to keep or disclose information to comply with a legal requirement.

  • Legitimate interests: where processing is necessary for the reasonable operation, administration and improvement of our business, provided your rights do not override those interests.

  • Consent: where we ask for your consent, including for certain marketing activities or where consent is required for particular processing.

Where we process health information or other special category data, we will also rely on an appropriate additional condition under UK data protection law.

6. Photographs

We may take photographs as part of treatment records, where appropriate.

Before using photographs for marketing, social media, our website or other promotional purposes, we will obtain the appropriate consent.

You can withdraw your consent to future marketing use of photographs at any time.

7. Who we share your information with

We may share relevant information with trusted third-party service providers where necessary to operate our business and provide our services.

These may include:

  • Appointment and booking platforms, including Acuity Scheduling

  • Payment providers, including Stripe

  • Website and hosting providers, including Squarespace

  • Email, communication and IT service providers

  • Professional advisers where necessary

  • Regulators, authorities or law enforcement where we are legally required to do so

We only share information that is reasonably necessary for the relevant purpose.

8. International transfers

Some third-party service providers may process information outside the UK.

Where personal information is transferred outside the UK, we will take appropriate steps to ensure that the transfer is carried out in accordance with applicable data protection requirements.

9. How we protect your information

We take reasonable technical and organisational measures to protect your personal information against:

  • Unauthorised access

  • Loss

  • Misuse

  • Alteration

  • Unauthorised disclosure

  • Destruction

However, no internet transmission or electronic storage system can be guaranteed to be completely secure.

10. How long we keep your information

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including where necessary to:

  • Provide and document treatments

  • Maintain appropriate client records

  • Meet legal, regulatory and insurance requirements

  • Resolve disputes

  • Protect our legal interests

Retention periods may vary depending on the type of information and the reason we hold it.

When information is no longer required, we will take reasonable steps to securely delete or dispose of it.

11. Your data protection rights

Depending on the circumstances, you may have rights under UK data protection law, including the right to:

  • Request access to the personal information we hold about you

  • Ask us to correct inaccurate or incomplete information

  • Request deletion of your information where applicable

  • Ask us to restrict processing in certain circumstances

  • Object to certain processing

  • Request transfer of certain information to another organisation

  • Withdraw consent where we rely on consent

These rights are subject to certain legal exceptions and limitations.

To exercise your rights, please contact us using the contact details provided on our website.

12. Marketing communications

We may contact you about our services, offers or updates where we have a lawful basis to do so.

Where marketing requires your consent, we will ask for your consent before sending it.

You can unsubscribe from marketing communications at any time.

13. Cookies

Our website uses cookies and similar technologies.

These may be used to help the website function, remember preferences and, where permitted, understand website usage.

Please see our Cookie Policy for more information about the cookies we use and how you can manage your preferences.

14. Third-party websites

Our website may contain links to websites or services operated by third parties.

We are not responsible for the privacy practices or content of third-party websites. We recommend that you read their privacy policies before providing them with your personal information.

15. Children's information

Our services are intended for adults unless specifically stated otherwise.

We do not knowingly collect personal information from children without appropriate consent and safeguards.

If you believe that a child has provided personal information to us without appropriate consent, please contact us.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology or legal requirements.

The date at the top of this page shows when the policy was last updated.

17. Contact us

If you have any questions about this Privacy Policy or how we handle your personal information, please contact:

SMAY Medical Group Ltd
Trading as Estiora Aesthetics
London, United Kingdom

Email: [Sara@estioraesthetics.com]

You can also contact us through the contact details provided on our website.

18. Complaints

If you are unhappy with how we have handled your personal information, please contact us first so that we can try to resolve your concern.

You also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)

The ICO provides information about data protection rights and how to make a complaint.