Our Website Privacy Statement

Privacy Statement

Updated Jan 2026

Privacy

This privacy notice explains how DR Medical Clinic Ltd, trading as Premier Laser & Skin and Derma Revive, uses your personal data when we are providing a service to you or you are visiting one of our websites and your legal rights in respect of our use of your data. It applies to our clients and prospective clients.

We handle personal data under applicable UK data protection legislation, including the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended.

It is important that you read this privacy notice together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully informed of how and why we are using your data.

1. Important Information and who we are
2. The Data we collect about you
3. How is your personal data collected
4. How we use your personal data and our legal basis for doing so
5. Disclosures of your personal data
6. Data Security
7. Data Retention
8. Your Legal Rights
9. Klarna Privacy Policy
10. Glossary

Important Information and who we are

Premier Laser & Skin and Derma Revive both operate under DR Medical Clinic Ltd.

Data Controller

DR Medical Clinic Ltd is the data controller, trading as Premier Laser & Skin and Derma Revive.

Privacy enquiries: hello@premierlaserskinclinic.co.uk

Telephone: 020 3871 8218

Postal address: 14-15 Lower Grosvenor Place, London, England, SW1W 0EX.

Changes to the Privacy Notice and your duty to inform us of changes

This version was last updated on 20 January 2026 and historic versions can be obtained by contacting us.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Third-Party Links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

This does not remove our responsibility for information we collect or disclose through integrations on our own websites.

The Data We Collect About You

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use and retain different categories of personal data about you which we have grouped together as follows:

• Identity Data includes first name, last name, former names, username or similar identifier, social media identifiers, marital status, title, date of birth and gender.
• Contact Data includes billing address, delivery address, home address, email address and telephone numbers. We may also ask you for an emergency contact number.
• Financial Data includes bank account, payment card details. When applying for credit this may also include salary, outgoings, ability to pay and credit references.
• Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
• Usage Data includes information about how you use our website, products and services.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences and preferred treatment categories.
• Treatment Data includes information about the treatment you wish to (or have) received from us. This information could include ‘health data’ which is a special category of personal data and therefore requires us to take extra steps to ensure it is adequately protected. Depending on your treatment this may also include photographs which form an important part of your treatment record.

We also collect and use aggregated (anonymous) data such as statistical or demographic data for any purpose. Aggregated data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your website usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.

We only use special category information where relevant to a lawful purpose and where an appropriate additional legal condition applies. This includes health information and any other sensitive information needed for the relevant service.

If You Fail To Provide Personal Data

Where we need to collect personal data by law or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

How Is Your Personal Data Collected?

We use a number of different channels to collect your personal data. These include:

Direct interactions with you. You may give us your Identity, Contact and Financial Data by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:

• order or make an enquiry regarding any of our products or services, either online, over the phone or in one of our clinics;
• provide information for a consultation or treatment;
• subscribe to our service or publications;
• request marketing to be sent to you;
• enter a competition, promotion or complete a survey;
• give us some feedback or post on one of our social media accounts;

We may also receive relevant information from a referring healthcare practitioner, a parent or representative, or providers supporting your booking or payment, where permitted by law.

How We Use Your Personal Data

We will only use your personal data when the law allows us to and in accordance with this privacy notice. Most commonly, we will use your personal data in the following circumstances:

• where we need to perform the contract we are about to enter into or have entered into with you for the provision of a product or service;
• to respond to your enquiry and provide you with the information you have asked for, and follow up that enquiry;
• where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests;
• where we need to comply with a legal or regulatory obligation; and
• to respond to any complaint and help us to establish, exercise or defend legal claims.

Where we rely on consent, including for marketing or promotional photographs, you can withdraw it at any time. Treatment consent is separate from consent to use personal data.

Using Your Health Data

Where necessary to provide healthcare or treatment, we rely on Article 9(2)(h), together with the relevant requirements of the Data Protection Act 2018, only where those requirements are met. This includes processing by, or under the responsibility of, an appropriate professional subject to professional secrecy, or a person owing an applicable legal duty of confidentiality.

We may also use relevant health information where necessary to establish, exercise or defend legal claims under Article 9(2)(f). Any other use, including a legally permitted safeguarding disclosure, requires an appropriate lawful basis and special category condition for the particular circumstances.

Consent to a treatment is separate from consent as a data protection basis. We explain when we are asking for either. Sending information to us does not, by itself, mean you have given explicit consent to every possible use of it.

Where we rely on consent, you may withdraw it at any time using the contact details in the Data Controller section. Withdrawal does not affect the lawfulness of earlier use. We stop the use that depends on that consent. We may retain information for a separate, previously identified purpose with its own valid legal grounds, such as required recordkeeping or legal claims, and will explain this where relevant.

Information About Children and Representatives

This section applies if we receive information about someone under 18. It does not mean that every treatment is available to children; treatment eligibility and clinical consent are assessed separately.

Children have their own privacy rights. We consider their age, understanding, capacity and best interests when communicating with them, receiving information from others or deciding who may act on their behalf. We explain privacy information in a way they can understand.

Where a parent or carer contacts us, we may need to verify their identity, relationship, parental responsibility or other authority. We consider whether the child can make the relevant decision themselves and whether their authorisation is needed. We do not assume that every parent or carer is entitled to access all of a child’s information.

An adult patient’s information is also confidential. If a parent or another person contacts us about an adult patient, we establish the appropriate authority or other lawful justification before discussing that patient’s confidential information with them.

Receiving information from someone does not automatically authorise us to disclose information back to that person. Where disclosure is necessary and lawful to protect someone or meet a legal duty, we share only what is relevant and record the reasons.

Sharing Sensitive Information Safely. 

Clinical Photographs and Promotional Use

We explain why clinical photographs are needed and how they form part of the consultation or treatment record. These photographs are subject to the same access restrictions and confidentiality protections as other clinical information.

Our practitioners ask whether you are happy for photographs to be shared. Permission to take or retain a clinical photograph is separate from permission to publish it. Before promotional use, permission must clearly cover which photographs may be used, the purpose and the publication channels. Where a photograph reveals health information, the permission must meet the explicit-consent requirements.

You can refuse promotional use without affecting your care. To withdraw photo-sharing permission, you can email hello@premierlaserskinclinic.co.uk. You can also tell your practitioner or contact the clinic if you prefer another way to withdraw; withdrawal must be as easy as giving consent. We explain the effect on future use and the steps available for material already published. Withdrawing promotional consent does not automatically require deletion of a clinical record retained on separate legal grounds.

Purposes for Which We May Use Your Personal Data and Our Legal Basis

We use personal data for the following purposes, where the relevant legal basis applies:

• To respond to enquiries and arrange requested services: steps before entering a contract with you, or our legitimate interest in responding to general enquiries.
• To manage bookings, provide services and process payments: performance of a contract with you, where applicable.
• To meet applicable legal recordkeeping or reporting duties: compliance with a legal obligation.
• To investigate complaints, protect our services and manage legal claims: our legitimate interests, or a specific legal obligation where one applies.
• To send opted-in marketing and use optional tracking: consent.
• To use identifiable photographs for promotion: separate permission, including explicit consent where health information is revealed.

Health information requires an additional legal condition, explained under Using Your Health Data. A contract with a parent does not automatically provide a basis for using a child’s information. Please contact us for details of the legal grounds applicable to a particular use.

Responding to your enquiries

We will respond to your enquiries using the contact information you have provided us with. This may include email, telephone, post and SMS. If we are unable to contact you or don’t receive a response we may contact you again to ensure you have all of the information you need.

Feedback Emails

To send you client satisfaction surveys and feedback requests by email to help improve our services. These messages will not include any promotional content and we will only send them where we have a legitimate interest to do so.

Marketing

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. You can choose the channel by which you will receive marketing and change your preferences at any time.

We use Mailchimp to send newsletters to people who opt in. Making an enquiry, booking a consultation or providing health information does not automatically subscribe you to marketing. Any text-message marketing requires the applicable permission for that channel.

Promotional Offers from Us

We use clients’ preferred treatment categories to help make marketing relevant to their interests. This involves selecting communications according to those preferences. You can ask us to update your preferences or stop this use by contacting us, and you can unsubscribe from marketing at any time.

Some treatment preferences may reveal or be used to infer information about health. For those categories, a newsletter opt-in alone does not establish permission to use health information for targeted marketing; a separate, valid special category condition is required, normally explicit consent for the described marketing use. Clinical information collected to provide care is not automatically available for marketing.

Third-Party Marketing

We will never sell or disclose your data to another organisation for its own independent marketing. We may promote third party products or services on behalf of another organisation, but will only do so where we have your explicit consent.

Opting Out

You can ask us to stop sending you marketing messages at any time following the opt-out links on any marketing message sent to you.

Where you opt out from receiving marketing messages, this will not apply to other communications, for example appointment reminders.

You can also contact hello@premierlaserskinclinic.co.uk to update your marketing preferences or stop receiving marketing.

Cookies & Web Tracking

This section explains our use of cookies and similar website technologies.

What Are Cookies?

Our website uses cookies and similar technologies. Strictly necessary technologies support functions such as security, remembering a basket or delivering a service you request.

Cookies can remember preferences or an authenticated session; this does not mean that we store your account password in a cookie. You may also manage cookies through your browser, although blocking necessary cookies may affect requested functions.

Cookie Update

Premier Laser & Skin and Derma Revive use necessary cookies to make the website easier for you to use and to ensure you get the best experience.

We will only read or write cookies for the preference level set, cookies set prior to you changing your settings will still be on your computer and you can remove them using your browser settings.

We use a cookie to remember your cookie preferences which means:

If you delete all your cookies you will have to update your preferences with us again.

If you use a different device, computer profile or browser you will have to tell us your preferences again.

Advertiser Cookies

Where enabled with the necessary permission, analytics tools help us understand website use and advertising tools may measure campaigns or support personalised advertising. We explain the relevant providers and choices in the cookie information. Advertising partners’ use of information may also be covered by their own privacy notices.

How We Use Cookies on Our Websites

Cookies and similar technologies can support the following purposes:

• Essential website functions, such as security and online purchases.
• Remembering preferences, including cookie choices.
• Understanding website use through optional analytics.
• Measuring advertising and supporting personalised advertising where you have agreed to the relevant tracking.

The technologies used depend on the website features and choices enabled. You can contact us for more information about their use.

Information This Website Gathers/Tracks

Under our cookie policy, optional analytics, advertising and similar tracking technologies are used only after you agree to them. You can accept or reject optional categories and change your choices through the cookie settings. Rejecting optional technologies does not prevent access to the basic website service.

Change Of Purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please Contact us.

If we need to use your personal data for an unrelated purpose, we will notify you before we do this and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Disclosures Of Your Personal Data

Access is limited to authorised people who need information for a relevant purpose and are subject to appropriate confidentiality obligations. Depending on the service and circumstances, recipients may include:

• our practitioners and relevant clinic team members involved in assessment, treatment, aftercare or administration;
• Pabau, where clinical information is saved;
• Mailchimp, which we use for newsletter marketing to people who opt in;
• other providers of booking systems, communications, IT hosting, technical support and data storage, where applicable;
• payment providers and, where you choose a finance option, the relevant finance provider;
• marketing or feedback providers receiving the limited information needed for those activities, where the use is permitted;
• professional advisers, insurers and auditors where relevant to their work; and
• healthcare providers, regulators, courts, public authorities or emergency services where a disclosure is necessary and lawful.

Not every recipient receives every category of information. We limit what is shared to what is necessary for the relevant purpose. We do not sell personal information.

Providers acting as our processors must follow our instructions and contractual requirements for protecting information. Some recipients, such as independent healthcare professionals, payment or finance providers, insurers and regulators, may be controllers for their own activities and provide their own privacy notices.

Data Security

Clinical information is saved in Pabau and used by our practitioners and clinic team. Access should be appropriate to each person’s role and the work they need to carry out.

We use technical and organisational measures appropriate to the sensitivity of the information and the risks involved. These include controlling access to records, protecting systems and communications, imposing confidentiality requirements and providing appropriate staff guidance and training.

We assess suspected personal data breaches and notify the ICO and affected people where the legal notification requirements are met.

Please contact us promptly if you believe information has been sent to the wrong person or accessed without permission.

How Long Do We Keep Your Personal Data For?

Clients

How long we retain your personal data depends on whether you have entered into a contract, the type of treatment you have received and the level of recent substantial contact with you.

For clinical and enquiry records, substantial contact means meaningful communication relevant to the treatment, consultation or enquiry. Marketing email opens or clicks do not, by themselves, restart the retention period for clinical records. Clinical, financial and marketing records are considered separately.

Attended treatments or goods purchased

In the event of a contract for procedure(s) existing we will delete your personal data from our systems if the last transaction date (appointment, payment or treatment) in relation to the contract is over 10 years old for surgical procedures or 8 years for non-surgical treatment procedures and we have not had substantial contact with you for a period of one year.

Attended Consultation Only

In the event of you having only attended for a consultation(s) in relation to the services we provide we will delete your personal data from our systems if the last consultation date is over 2 years old and we have not had substantial contact with you for a period of one year.

Expression of Interest Only

In the event of you having only expressed an interest in our services and not attended any appointments in relation to the services we provide we will delete your personal data from our systems if the last substantial contact is not within a period of one year.

We will delete your personal data from our systems unless we believe in good faith that the law or other regulation requires us to preserve it (for example, because of our obligations to tax authorities or in connection with any anticipated litigation). After this period, it is likely your data will no longer be relevant for the purposes for which it was collected.

Children’s records

Children’s records may require a different retention period, taking account of age, clinical needs and applicable legal requirements. The general periods above are not automatically applied to children’s records. Please contact us for information about the period applicable to a particular record.

Your Legal Rights

One of the Data Protection Acts main objectives is to protect and clarify the rights of individuals with regards to data privacy.

This means that you retain various rights in respect of your data, even once you have given it to us. We will seek to deal with your request without undue delay, and in any event within one calendar month (subject to any extensions to which we are lawfully entitled).

Please note that we may keep a record of your communications to help us resolve any issues which you raise.

Under certain circumstances, you have rights under data protection laws in relation to your personal data. These include the following:

Right to Object

If we are using your data because we deem it necessary for our legitimate interests to do so, and you do not agree, you have the right to object. We will respond to your request within one calendar month (although we may be allowed to extend this period in certain cases).

Generally, we will only disagree with you if certain limited conditions apply.

This right enables you to object to us processing your personal data where we do so for one of the following four reasons: (i) our legitimate interests; (ii) to enable us to perform a task in the public interest or exercise official authority; (iii) to send you direct marketing materials; and (iv) for scientific, historical, research, or statistical purposes.

The “legitimate interests” and “direct marketing” categories above are the ones most likely to apply to our Website Users and Clients. If your objection relates to us processing your personal data because we deem it necessary for our legitimate interests, we must act on your objection by ceasing the activity in question unless:

• We can show that we have compelling legitimate grounds for processing which overrides your interests; or
• We are processing your data for the establishment, exercise or defence of a legal claim.

If your objection relates to direct marketing, we must act on your objection by ceasing this activity.

Right to Withdraw Consent

Where we rely on consent, you may withdraw it at any time using the contact details in the Data Controller section. Withdrawal does not affect the lawfulness of earlier use. We stop the use that depends on that consent. We may retain information for a separate, previously identified purpose with its own valid legal grounds, such as required recordkeeping or legal claims, and will explain this where relevant.

Data Access Requests

You may ask us to confirm what information we hold about you at any time, and request us to modify, update or delete such information. We may ask you to verify your identity and for more information about your request. If we provide you with access to the information we hold about you, we will not charge you for this unless your request is “manifestly unfounded or excessive”. If you request further copies of this information from us, we may charge you a reasonable administrative cost where legally permissible. Where we are legally permitted to do so, we may refuse your request. If we refuse your request we will always tell you the reasons for doing so.

Right to Remove

In certain circumstances you can ask us to delete your personal data. We respond without undue delay and normally within one calendar month, subject to legally permitted timing rules and extensions. Deletion is not an absolute right: some information may need to be retained on valid legal grounds. We explain any refusal and how to complain. Where needed to honour a marketing opt-out, we may retain a minimal suppression record for that separate purpose.

Normally, the information must meet one of the following criteria:

• the data is no longer necessary for the purpose for which we originally collected and/or processed them;
• where previously given, you have withdrawn your consent to us processing your data, and there is no other valid reason for us to continue processing;
• the data has been processed unlawfully (i.e. in a manner which does not comply with the GDPR);
• it is necessary for the data to be deleted in order for us to comply with our legal obligations as a data controller; or
• if we process the data because we believe it necessary to do so for our legitimate interests, you object to the processing and we are unable to demonstrate overriding legitimate grounds for our continued processing.

We would only be entitled to refuse to comply with your request for one of the following reasons:

• to exercise the right of freedom of expression and information;
• to comply with legal obligations or for the performance of a public interest task or exercise of official authority;
• for public health reasons in the public interest;
• for archival, research or statistical purposes; or
• to exercise or defend a legal claim.

When complying with a valid request for the removal of data we will take all reasonably practicable steps to delete the relevant data. If we have shared your personal data with third parties, we will notify them about the request for the removal of data unless this is impossible or involves disproportionate effort.

Right to Restrict Processing

You have the right to request that we restrict our processing of your personal data in certain circumstances. This means that we can only continue to store your data and will not be able to carry out any further processing activities with it until either: (i) one of the circumstances listed below is resolved; (ii) you consent; or (iii) further processing is necessary for either the establishment, exercise or defence of legal claims, the protection of the rights of another individual, or reasons of important public interest recognised by applicable law.

The circumstances in which you are entitled to request that we restrict the processing of your personal data are:

• where you dispute the accuracy of the personal data that we are processing about you. In this case, our processing of your personal data will be restricted for the period during which the accuracy of the data is verified;
• where you object to our processing of your personal data for our legitimate interests. Here, you can request that the data be restricted while we verify our grounds for processing your personal data;
• where our processing of your data is unlawful, but you would prefer us to restrict our processing of it rather than erasing it; and
• where we have no further need to process your personal data but you require the data to establish, exercise, or defend legal claims.

If we have shared your personal data with third parties, we will notify them about the restricted processing unless this is impossible or involves disproportionate effort. We will, of course, notify you before lifting any restriction on processing your personal data.

Right to Rectification

You also have the right to request that we rectify any inaccurate or incomplete personal data that we hold about you. If we have shared this personal data with third parties, we will notify them about the rectification unless this is impossible or involves disproportionate effort. Where appropriate, we will also tell you which third parties we have disclosed the inaccurate or incomplete personal data to. Where we think that it is reasonable for us not to comply with your request, we will explain our reasons for this decision.

Data Portability Rights

You have the right to request the transfer of your personal data to another organisation or directly to yourself in a structured, commonly used, and machine-readable format. Where technically feasible, we will securely transmit your data to the third party of your choice upon request. This right applies to personal data you have provided to us, where processing is based on your consent or a contract, and is carried out by automated means. To make a data portability request, please contact us using the details provided in this policy.

Questions and Complaints

If you have concerns about our use of personal information, you can complain using the email, telephone or postal details in the Data Controller section. Please explain the concern and the outcome you are seeking. You do not need to use legal terminology.

We acknowledge a data protection complaint within 30 days of receiving it, investigate and take appropriate steps without undue delay, keep you informed and explain the outcome without undue delay. This complaint process is separate from the usual one-calendar-month deadline for a request to exercise a data protection right.

You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator. Its website explains how to raise a concern and what information to provide:

Information Commissioner’s Office complaints information

Klarna Privacy Policy

In order to offer you Klarna’s payment methods, we might in the checkout pass your personal data in the form of contact and order details to Klarna, in order for Klarna to assess whether you qualify for their payment methods and to tailor those payment methods for you. Your personal data transferred is processed in line with Klarna’s own privacy notice.

Glossary

Lawful Basis

Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

Complying with a legal or regulatory obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.

Necessary for us to provide health care or treatment means processing your special categories of personal data (i.e. health data) where it is necessary for the purposes of preventive or occupational medicine, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of applicable UK law or pursuant to contract with a health professional (subject to required conditions and safeguards).