Privacy policy

1. Who we are

Ruby J Robertson provides skin and laser services in Bury St Edmunds, Suffolk. For the purposes of UK data protection law, Ruby J Robertson is the controller of the personal information used to provide these services.

You can contact the clinic through the details on the contact page. Please do not send health information in a public social-media comment.

2. Information we may collect

• Identity and contact details, such as your name, date of birth, telephone number and email address.
• Appointment, payment and communication records.
• Health, medication, allergy, pregnancy, skin and treatment information needed to assess suitability and provide safe care.
• Consultation forms, consent records, patch-test results, treatment settings, progress notes and photographs where appropriate.
• Website technical information, where essential to security and operation.

3. Why we use it

Information is used to respond to enquiries, manage appointments, assess suitability, provide treatment, maintain clinical and financial records, deal with complaints, meet legal duties and protect the rights and safety of clients and the clinic.

4. Lawful bases

Depending on the activity, processing may be necessary to take steps at your request or perform a contract, comply with a legal obligation, or pursue legitimate interests such as operating and safeguarding the clinic. Health information is handled only where an additional condition for special-category data applies, including health or care purposes, legal claims, or explicit consent where appropriate.

5. Photographs and marketing

Clinical photographs may be recommended to plan and review treatment. They are kept with your confidential record. Identifiable images are not used for social media, advertising or other promotional purposes without separate, specific permission. You can withdraw marketing-image consent for future use by contacting the clinic, although this does not make earlier lawful use invalid.

6. Sharing information

Information may be shared only where necessary with trusted service providers supporting bookings, payments, secure records, IT or professional advice; with insurers or regulators; with healthcare professionals where appropriate and lawful; or where required by law. Providers are expected to protect information and use it only for the agreed purpose.

7. International transfers

Some technology providers may process information outside the UK. Where this occurs, appropriate safeguards are used as required by data protection law.

8. How long information is kept

Records are retained only for as long as needed for treatment, safety, legal, insurance, tax and professional purposes. Retention periods vary by record type and may be extended where a complaint, claim or legal obligation requires it. Information is securely deleted or anonymised when no longer needed.

9. Your rights

Depending on the circumstances, you may have rights to access, correct, erase or restrict your information; object to certain processing; receive portable information; and withdraw consent. These rights are not absolute, particularly where clinical or legal records must be retained. Identity may need to be verified before a request is completed.

10. Concerns and complaints

Please contact the clinic first so any concern can be addressed. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk.

11. Changes

This policy may be updated to reflect changes in services, systems or law. The current version will be published on this page with its revision date.