Privacy policy

Who we are

LUMEN — Aesthetics by Marie RN is run by Marie Murphy, a Registered Nurse, at 26 Beeches Walk, Sutton Coldfield, B73 6HN. Marie is the data controller for the personal information described in this policy. You can contact her about anything in this policy on 07942 484 834 or at hello@lumenbymarie.co.uk.

The information we collect

We only collect what we need to look after you:

• Contact details, such as your name, phone number and email address, when you get in touch or book.
• The content of your messages, calls and emails.
• Health information you share at your consultation and treatment, such as your medical history, medicines, allergies and previous treatments.
• Treatment records and consent forms.
• Clinical photographs, only with your consent, as part of your treatment record.

Our website

This website does not use analytics, advertising or tracking cookies, and we do not use it to collect personal information. Like all websites, our hosting provider automatically processes technical information such as your IP address, browser type and the pages requested, so that the site can be delivered and protected from misuse. See our cookie policy for more.

How we use your information, and our lawful basis

• To reply to your enquiry and arrange appointments: to take steps at your request before providing a service, and to provide it (UK GDPR Article 6(1)(b)).
• To assess whether a treatment is suitable, provide safe care and keep clinical records: to provide our service (Article 6(1)(b)) and to meet our legal and professional obligations (Article 6(1)(c)). Health information is used for the provision of health care by a registered health professional who owes you a duty of confidentiality (Article 9(2)(h) and the Data Protection Act 2018).
• To deal with questions, complaints or legal claims: our legitimate interests (Article 6(1)(f)), and for health information, the establishment or defence of legal claims (Article 9(2)(f)).
• To keep our website secure: our legitimate interests (Article 6(1)(f)).

We will never use your information for marketing without your consent, and we never sell it.

Photographs

Clinical photographs are taken only with your consent, kept securely as part of your treatment record and used to plan and review your care. They will never be shared or used for promotion unless you give separate, written permission, which you can withdraw at any time.

Who we share it with

Your information is confidential. We only share it when it is necessary, and only what is needed:

• With your GP or another healthcare professional, if you agree, or if it is needed to protect your health or safety.
• With a qualified prescriber, where a prescription-only medicine is being considered.
• With our insurers, professional advisers or regulators, or where we are required to by law.
• With trusted service providers who help us run the clinic, such as IT, secure storage and website hosting, who may only use it on our instructions.

Facebook and other services

If you contact us through Facebook, your messages are also processed by Meta under its own privacy policy. Please don’t send detailed medical information through social media; we will discuss your health with you in person.

International transfers

Some of our service providers, such as our website host, may process information outside the UK. Where they do, we make sure the safeguards required by UK data protection law are in place, such as an adequacy decision or approved contract terms.

How long we keep it

• Enquiries that do not lead to an appointment: deleted when no longer needed, normally within 12 months.
• Clinical records, consent forms and photographs: kept in line with professional guidance for health records, generally for at least 8 years after your last treatment.
• Website server logs: kept by our hosting provider for a short period, for security.

Keeping it safe

We keep paper and electronic records secure, limit access to those who need it, and take care when sending information. If a data breach were to put your rights at risk, we would tell you and, where required, the Information Commissioner’s Office.

Your rights

Under UK data protection law you have the right to:

• Ask for a copy of the information we hold about you.
• Ask us to correct anything that is wrong or incomplete.
• Ask us to delete your information. We may need to keep clinical records for the period above.
• Ask us to restrict or stop using your information in some circumstances.
• Object to us using your information on the basis of our legitimate interests.
• Ask for your information to be transferred to someone else, where this applies.
• Withdraw your consent at any time, where we rely on consent, such as for photographs.

To use any of these rights, contact Marie on 07942 484 834 or at hello@lumenbymarie.co.uk. There is normally no charge, and we will respond within one month.

Complaints

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed.