Privacy Policy

This Privacy Policy explains how Azim Aesthetics (“we”, “us”, “our”) collects, uses, stores and protects your personal data when you use theazimclinic.co.uk or contact us about the clinic. We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Data controller: Dr Niru Azim, trading as Azim Aesthetics
Address: Sunset Lodge, Woodchurch Road, Appledore, Kent TN26 2BJ
Email: hello@theazimclinic.co.uk
Phone: 07413 812 129
ICO Registration: Pending registration. We will update this page once the ICO reference number is issued.

2. What data we collect

When you contact us via the website form, WhatsApp, phone or email, we may collect:

• Name
• Email address
• Phone number
• Town or partial postcode
• Treatment of interest
• Preferred appointment timing and contact method
• Confirmation that you are aged 18 or over
• How you heard about the clinic and non-identifying campaign attribution
• Anything you choose to write in your message

Campaign attribution is limited to sanitised source, medium, campaign, content and term labels, the landing-page path, and the external referrer hostname. Query strings and unrecognised parameters are not stored as the landing page. With analytics consent, these labels may be retained in sessionStorage for the current browser tab so they survive navigation or a reload. Submitted requests include a plain-language source label; this does not establish that a request is genuine, suitable or a confirmed appointment. When a Google advertising source is detected, WhatsApp and email links add an editable source note to the message you choose whether to send.

If you join our mailing list, we collect your email address, confirmation that you are aged 18 or over, your marketing-consent choice, the date of signup and the same limited non-identifying campaign attribution described above. A clinic-updates signup is kept separate from a consultation or appointment request.

The website consultation form is an enquiry route, not a clinical record. Please do not send detailed medical history, photographs or urgent clinical information through the form, email or WhatsApp. Any clinical-record, booking or payment data is handled under separate patient privacy information provided before that data is collected.

3. Why we collect it (lawful basis)

• To respond to your enquiry — lawful basis: consent (Article 6(1)(a) UK GDPR).
• To manage, secure and improve the enquiry service — lawful basis: our legitimate interests, balanced against your rights.
• For website analytics and Google Ads conversion measurement(only if you accept optional measurement cookies) — lawful basis: consent.
• To send clinic updates and occasional clinic news (only if you join our mailing list) — lawful basis: consent. You can unsubscribe at any time.

4. Who we share it with

We share data only with the following processors, and only as needed to deliver the service:

• Formspree — processes contact form and mailing-list submissions and forwards them to our inbox.
• Google Workspace / Gmail — used to receive and reply to enquiries.
• ImprovMX — email forwarding for our domain.
• Vercel — hosts our website.
• Ahrefs Web Analytics — privacy-focused analytics used for page views and non-identifying conversion events such as consultation-form, WhatsApp and phone clicks; only loaded if you accept analytics cookies. Selected treatment, preferred timing, town/postcode, contact details and free-text messages are excluded by a code-level event allowlist. The contact page also removes its complete query string before optional analytics loads.
• Google Analytics 4 — consented measurement of visits to broad page groups and actions such as WhatsApp clicks and successful appointment requests. Google receives a pseudonymous browser identifier and ordinary technical connection information. Our integration excludes form answers, contact details, detailed treatment/concern page names, query strings and full referrers. Google Signals, ad personalisation and automatic enhanced measurement are disabled. A WhatsApp click is not treated as a confirmed enquiry or booking.
• Google Ads— limited conversion measurement used to establish whether a paid-search click results in a successful appointment request. The Google tag loads only after optional measurement consent. Ad personalisation, remarketing use and enhanced conversions are disabled, and form answers, contact details, town/postcode, preferred timing and treatment interest are not included in the conversion event. Recognised Google click identifiers are kept separate from enquiry contents and sent only to Google Ads after measurement consent, using the homepage address without treatment paths or other query parameters. A consented copy lasts up to 30 minutes in the current tab to preserve attribution during the enquiry journey; Google's measurement cookies can last up to 30 days. Raw click identifiers are not included in enquiry emails or WhatsApp messages.
• HMRC, our insurer, the GDC, law-enforcement bodies or the courts — where disclosure is required or permitted by law.

We do not sell your data or provide enquiry details to advertising platforms. Google Ads receives only consented ad-click and conversion-measurement data; it is not used by us for remarketing or audience profiling.

Some service providers may process data outside the UK. Where UK data-transfer rules apply, the controller must use an appropriate transfer mechanism and safeguards. Their current privacy information is available from each provider.

5. How long we keep it

• Enquiries that don't become a treatment: 12 months from last contact, then deleted.
• Mailing-list details: until you unsubscribe or ask us to delete them.
• Consent and suppression records: for as long as needed to demonstrate your preference and avoid contacting you after an opt-out.

Patient clinical and financial retention periods are set out in the patient privacy information provided when those records are created. No patient clinical record is created by sending a consultation request.

6. How we keep it secure

The website uses HTTPS and access to enquiry services is restricted to authorised accounts. We use proportionate technical and organisational controls, but no online service is completely risk-free. This is why the website consultation form should not be used for detailed medical or urgent information.

7. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you (right of access)
• Have inaccurate data corrected (right to rectification)
• Have your data deleted in certain circumstances (right to erasure)
• Restrict or object to our processing
• Receive a copy of your data in a portable format (right to portability)
• Withdraw consent at any time (where consent is the lawful basis)

To exercise any of these rights, email hello@theazimclinic.co.uk. We will respond within one calendar month.

8. Cookies

We use a small number of cookies. See our Cookie Policy for full details and buttons to change your measurement choice at any time.

9. Complaints to the ICO

If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve it. You also have the right to complain to the Information Commissioner's Office (ICO):

ICO· Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
ico.org.uk/make-a-complaint · 0303 123 1113

10. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top will reflect any changes. For substantive changes affecting how we use your data, we will post a prominent notice on the site.