1. Who We Are (Data Controller)

YourHealthFirst Clinic (“we”, “us”, “our”) operates the medical and aesthetic clinic located at:

YourHealthFirst Clinic

1st Floor, 2 Wimpole Street, London W1G 0EB, United Kingdom

Lead Practitioner & Data Controller: Dr. Sofia Bouzian

Telephone: 0207 225 3582 / 078 1847 4041

For the purposes of the UK Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), we are the Data Controller responsible for your personal information.

2. Information We Collect About You

In order to provide safe, regulated aesthetic and medical treatments (including anti-wrinkle injections, dermal fillers, phlebotomy, PRP therapy, and body contouring), we collect:

Identification & Contact Data: Full name, date of birth, postal address, email address, telephone numbers, and emergency contact details.
Medical & Health Data (Special Category Data): Relevant medical history, current medications, known allergies, previous aesthetic treatments, blood test requisitions, and clinical notes compiled during consultations.
Clinical Photography: Standardised clinical photographs taken before and after procedures to document anatomical baseline and clinical progression. Photographs are never published or shared without your explicit, separate written consent.
Financial & Payment Data: Transaction history and booking deposit records. All electronic payment transactions are encrypted and processed through certified PCI-DSS compliant payment gateways.
Digital & Communication Data: Records of enquiries submitted via our website form, WhatsApp consultations, and cookie/browsing preferences.

3. Our Lawful Bases for Processing

Under UK GDPR Article 6 and Article 9, we process your data under the following legal grounds:

Contract Performance

Necessary to schedule consultations, administer agreed treatments, and fulfill our contractual obligations to you.

Legal & Clinical Obligation

Fulfilling mandatory medical record-keeping, insurance compliance, and public health obligations under UK medical legislation.

Health & Social Care (Art. 9(2)(h))

Special category health data processing for the provision of healthcare, clinical diagnosis, and aesthetic treatment under professional confidentiality.

Explicit Consent

Where you opt-in to marketing newsletters, promotional educational updates, or grant permission for anonymised clinical gallery usage.

4. Data Sharing & Confidentiality

We do not sell, rent, or trade your personal information to third parties. Your data is strictly disclosed only to:

Accredited UK diagnostic pathology laboratories for blood sample processing and analysis.
Secure clinical practice management and electronic health records providers bound by strict confidentiality and UK GDPR data processor agreements.
Statutory regulatory authorities or legal advisors where strictly required by law or judicial request.

5. How Long We Keep Your Records

In accordance with UK clinical governance and medical indemnity guidelines, patient clinical consultation records and consent forms are retained for a minimum period of 7 to 8 years from the date of your last appointment. Following expiration of the statutory retention period, digital records are permanently expunged and physical documents securely shredded.

6. Your Rights Under UK GDPR

As a patient and data subject, you hold statutory rights under UK data protection law:

Right of Access (SAR): Request a copy of the personal and medical records we hold concerning you.
Right to Rectification: Request correction of inaccurate or incomplete clinical data.
Right to Erasure: Request deletion of your personal data where statutory clinical retention obligations do not apply.
Right to Restriction of Processing: Request suspension of data processing under specific conditions.
Right to Data Portability: Obtain your digital records in an accessible, machine-readable format.
Right to Withdraw Consent: Withdraw marketing or photography consent at any time without impacting your clinical care.