Privacy Policy

1. Introduction

At Maison Lumiere Aesthetics By Dr.Lydia, we respect your privacy and are committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store, protect and share personal data when you visit our website, book an appointment, attend a consultation, receive treatment or contact our clinic.

We process personal data in accordance with applicable data protection legislation, including the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, where applicable.

As an aesthetic clinic, we may process sensitive information about your health and treatment history. We take appropriate steps to ensure that this information is handled confidentially and securely.

2. Who We Are

For the purposes of applicable data protection law, the data controller responsible for your personal information is:

The data controller determines how and why your personal information is processed.

For privacy-related questions or requests, please contact us using the details above.

3. Personal Information We Collect

Depending on your interactions with the clinic, we may collect the following categories of personal data.

3.1. Identification and contact information

• Full name and date of birth, where required.
• Email address and telephone number.
• Address, where necessary.
• Appointment and booking details.

3.2. Health and clinical information

Where necessary for consultation and treatment, we may collect:

• Medical history and relevant health conditions.
• Allergies and medication information.
• Previous aesthetic treatments and procedures.
• Skin condition and treatment suitability information.
• Consultation notes, treatment records and aftercare information.
• Information about adverse reactions or complications.
• Clinical photographs, where appropriate and properly managed.

Health information is treated as specially protected personal data under the GDPR.

3.3. Payment and transaction information

Where you purchase a service, we may process information relating to the transaction, such as the service purchased, payment status, invoice details and relevant transaction references.

Payments may be processed by a third-party payment provider. We do not intentionally collect or retain full payment card details where these are handled directly by that provider.

3.4. Website and technical information

When you visit our website, we may collect technical information such as your IP address, browser type, device information, website usage data and cookie preferences, depending on the website functions and technologies used.

Non-essential cookies and similar tracking technologies will be used in accordance with applicable consent requirements.

3.5. Communications and enquiries

We may retain information you provide when contacting us by email, telephone, online forms or other communication channels, including enquiries, feedback and complaints.

4. How We Collect Your Information

We may collect personal data:

• Directly from you when you book an appointment or complete a form.
• During your in-person consultation or treatment.
• Through communications with our clinic.
• Through our online booking, payment or practice-management systems.
• From healthcare professionals or other sources where appropriate, lawful and necessary for your care.

Where personal information is obtained from another source, we will provide the information required by applicable data protection law.

5. Why We Use Your Personal Information

We process personal information for the following purposes:

5.1. Appointment management

To arrange, confirm, amend and manage appointments, send service-related reminders and respond to booking enquiries.

5.2. Consultation and treatment

To assess treatment suitability, review relevant medical information, provide appropriate aesthetic services, maintain clinical records and support safe follow-up care.

5.3. Payments and administration

To process payments, issue invoices, maintain business records and manage accounting obligations.

5.4. Communication and customer service

To respond to questions, handle complaints, provide relevant appointment information and communicate about services you have requested.

5.5. Legal and professional obligations

To comply with applicable legal, regulatory, professional, record-keeping and insurance requirements and, where necessary, establish, exercise or defend legal claims.

5.6. Website operation and security

To maintain the security and functionality of our website, prevent misuse and understand website performance using appropriate tools and permissions.

5.7. Marketing

Where permitted by law, we may use contact details to send information about clinic services, offers or updates if the necessary conditions for marketing communications have been met.

You may opt out of marketing communications at any time. Appointment-related messages will remain separate from marketing messages.

6. Our Legal Bases for Processing

We process personal data only where an appropriate legal basis applies.

Depending on the circumstances, these may include:

• Contract: where processing is necessary to arrange or provide a service you have requested.
• Legal obligation: where we must process information to comply with applicable law.
• Legitimate interests: where necessary for legitimate business purposes, provided these interests are not overridden by your rights and freedoms.
• Consent: where we rely on your consent for a specific purpose, such as certain optional marketing activities or optional uses of photographs.
• Vital interests: where processing is necessary to protect someone's vital interests in circumstances permitted by law.

Where we process health information or other special-category data, an additional condition under Article 9 GDPR must also apply. Depending on the circumstances and our professional arrangements, this may include processing necessary for medical care or treatment under applicable law, or explicit consent where appropriate.

We assess the applicable legal basis for each processing activity rather than relying on a single basis for all information.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before the withdrawal, and it does not require us to erase records that we must lawfully retain.

7. Clinical Photographs and Before-and-After Images

Clinical photographs may be taken where appropriate for assessment, treatment planning, progress monitoring or clinical record-keeping.

We will explain the relevant purpose and handle clinical photographs in accordance with applicable data protection requirements.

Clinical use and marketing use are separate. If we wish to use an identifiable photograph or treatment result for our website, social media, advertising or promotional materials, we will obtain any required permission and establish an appropriate legal basis before doing so.

Agreeing to treatment does not automatically mean agreeing to promotional use of your photographs.

Where promotional use relies on consent, refusing or withdrawing that consent will not affect your access to treatment. Withdrawal will not make past lawful use unlawful, but we will address future use in accordance with applicable law and the terms of the consent.

8. Who We Share Your Information With

We do not sell your personal data.

Where necessary and lawful, we may share relevant information with:

• Online booking and practice-management providers.
• Payment processors and accounting service providers.
• Website hosting, IT support and security providers.
• Healthcare professionals or other providers involved in your care, where appropriate.
• Insurers, legal advisers, auditors or professional advisers where necessary.
• Regulators, public authorities or law enforcement agencies where disclosure is legally required or otherwise lawful.

We seek to ensure that third-party service providers process personal data under appropriate contractual and security arrangements.

We disclose only information that is reasonably necessary for the relevant purpose, subject to applicable legal and professional confidentiality obligations.

9. International Data Transfers

Some of our website, booking or technology providers may store or process personal data outside the European Economic Area (EEA).

Where personal data is transferred internationally, we will ensure that the transfer complies with applicable data protection law. Depending on the circumstances, this may involve an adequacy decision, appropriate safeguards such as standard contractual clauses, or another lawful transfer mechanism.

You may contact us for further information about relevant safeguards, subject to applicable law.

10. How Long We Keep Your Information

We retain personal data only for as long as necessary for the purposes for which it was collected, taking account of applicable legal, professional, regulatory, insurance and record-keeping requirements.

Retention periods may differ depending on the type of information:

• Booking and appointment records: for the period needed to manage appointments and maintain relevant business records.
• Clinical records and medical information: for the period required by applicable legal and professional obligations, taking account of the type of treatment and any relevant limitation periods.
• Financial and accounting records: for the period required by applicable tax and accounting law.
• Marketing records: until you withdraw consent, object where applicable, or the information is no longer required, subject to limited records needed to respect your preferences.
• Website and technical records: for the period reasonably necessary for security, functionality, analytics and applicable legal requirements.

When information is no longer required, we will securely delete it, anonymise it or otherwise dispose of it appropriately, subject to any lawful retention obligations.

11. How We Protect Your Information

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, alteration, disclosure or destruction.

Depending on the information and systems involved, these measures may include access restrictions, secure systems, staff confidentiality obligations, appropriate security procedures and secure disposal practices.

However, no electronic transmission or storage system can be guaranteed to be completely secure.

If a personal data breach occurs, we will assess and respond to it in accordance with applicable legal requirements, including any relevant notification obligations.

12. Your Data Protection Rights

Subject to applicable law and any relevant exceptions, you may have the right to:

• Access: request a copy of your personal data and information about how it is processed.
• Rectification: request correction of inaccurate or incomplete information.
• Erasure: request deletion of personal data in certain circumstances.
• Restriction: request that processing be restricted in certain circumstances.
• Data portability: receive certain information in a structured, commonly used, machine-readable format and, where applicable, transmit it to another controller.
• Object: object to processing based on legitimate interests and object at any time to direct marketing.
• Withdraw consent: where processing is based on consent, withdraw it at any time.
• Complain: lodge a complaint with the relevant supervisory authority.

These rights are not absolute in every situation. For example, we may need to retain certain clinical or financial records to comply with legal obligations or establish, exercise or defend legal claims.

To exercise your rights, contact us at care@maisonlumiereaesthetics.com. We may need to verify your identity before responding.

We will respond within the timeframe required by applicable law, ordinarily within one month of receiving a valid request, subject to lawful extensions where applicable.

13. Complaints to the Data Protection Commission

If you have concerns about how we handle your personal data, please contact us first so that we can try to address them.

You also have the right to lodge a complaint with the Irish Data Protection Commission (DPC).

Website: https://www.dataprotection.ie/

The DPC is Ireland's supervisory authority for data protection matters.

14. Cookies and Website Technologies

Our website may use cookies and similar technologies to support essential functions, remember preferences, understand website performance or provide other features.

Where required, we will seek your consent before using non-essential cookies or similar technologies.

You can manage your cookie preferences through our website's cookie settings, where available. You may also be able to manage certain cookies through your browser settings.

For more information about the cookies used on our website, their purposes, providers and retention periods, please see our cookie settings.

15. Third-Party Websites

Our website may contain links to third-party websites or services.

We are not responsible for the privacy practices of external websites that we do not operate. We recommend reviewing their privacy policies before submitting personal information.

16. Marketing Preferences

We may send appointment-related messages necessary to manage your booking or provide a service.

Promotional emails, texts or other marketing communications will be handled in accordance with applicable data protection and electronic marketing laws.

Where required, we will obtain your consent before sending marketing communications. You may unsubscribe using the instructions in the communication or contact us directly.

We will not make marketing consent a condition of receiving treatment where it is not necessary for the service.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, data processing practices or legal obligations.

The latest version will be published on our website with the updated date.

Where required by law, we will provide additional information about material changes affecting the processing of your personal data.

18. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact: