Privacy Policy

Scope of This Policy

This Privacy Policy applies whenever you browse the public pages of this website, request a platform walkthrough, send an enquiry by email or through the contact form, or sign a client agreement with BDS AESTHETICS LTD. It also applies to the treatment programme platforms, clinic booking systems and consultation record tools that this organisation operates for its clinic partners under the BDSAesthetics name, in every case where those tools collect or process personal data as described here.

Where a clinic studio runs one of our platforms under its own agreement with its own clients, that studio is the data controller for the records of its own end clients. BDS AESTHETICS LTD acts as a service provider and processor on behalf of the studio for that data, under a separate data processing schedule. This policy explains the direct relationship BDS AESTHETICS LTD has with the visitors, clinic owners and practitioner users of this website, because those individuals rely on us to describe our own conduct honestly.

You should read this policy together with any other fair processing notice we may provide at the moment we collect your data, because the two documents together describe how we will treat your information. We keep the everyday language plain and the exceptions honest, because terms that hide the truth help nobody.

Data Controller

For the purposes of data protection legislation in force in the United Kingdom and the European Economic Area, the data controller for the direct relationship described on this page is BDS AESTHETICS LTD, a company operating from Cornwall House, 55-57 High Street, SLOUGH - SL1 1DZ, United Kingdom (GB). Where this policy says BDS AESTHETICS LTD, or where it says we or our, it means that entity.

You can reach the privacy team of BDS AESTHETICS LTD by writing to the address above or by sending an email to office@bdsaesthetics.autos. The developer brand BDSAesthetics is not a separate legal entity; it is the studio mark under which our design and engineering work is published, and it is referred to throughout this site where the developer voice speaks. All legal accountability rests with the single registered company named in this section.

Clear Definitions

To keep this policy useful rather than merely long, we define a few key terms exactly as they are used below.

A visitor is anyone who reads any public page of this website. A clinic owner is a person or team that contracts with BDS AESTHETICS LTD for a platform. A practitioner user is a clinical or administrative staff member of a studio who signs into one of our tools. An end client is a person whose treatment is planned and recorded inside a studio platform by that studio, rather than by us directly. Responsive data assets are the files, guides, training videos and configuration documents we prepare for a studio during onboarding.

We use the word processing broadly, meaning any operation performed on personal information, whether that operation is collection, recording, organisation, storage, alteration, retrieval, consultation, use, disclosure, combination, restriction or deletion. Where we use stronger or weaker data protection language, the definitions in the legislation take precedence over the friendly summary here whenever the two disagree.

What This Policy Covers

This policy covers information that identifies a natural person, alone or combined with other data already in our hands. That includes names, email addresses, telephone numbers, billing addresses, device identifiers and the contents of messages you send to us. It also covers the structured clinical notes that a studio records through our platforms, because those notes routinely reveal skin conditions, treatment history and health-related facts that deserve the strongest protection in law.

This policy does not cover the separate practices of any clinic studio that we supply, the practices of an independent practitioner, or the behaviour of any third party website that you reach by following a link on our pages. Before you share information with any of those parties you should read their own privacy statement, because our duty stops at the boundary of our own responsibility.

Information We Collect From You

We collect a small set of information directly when you interact with this website. When you complete the contact form we receive the name you type, the email address you provide, the subject line you choose and the text of your message. When you telephone the number published on this site we may record call notes that you choose to give us, and we keep those notes only for the length of the enquiry thread. When you email the address office@bdsaesthetics.autos we read the message and the address from which it was sent.

When a clinic owner asks for a platform walkthrough or signs a client agreement, we collect company contact details: the trading name, the registered address, the billing contact and the technical contact. We collect VAT registration evidence where relevant for invoicing. When a practitioner user account is created for a studio we record the name, the professional email, the role and the qualifications that the studio confirms the person holds, so that the compliance portal can show an accurate scope of practice.

Finally, when anyone visits the public site we collect a modest amount of technical activity data, described fully in the section on cookies and analytics, that helps us understand which pages help people and which pages merely exist.

Records Held Inside Studio Platforms

Most of the clinical records that flow through platforms we build belong to the studio that owns the client relationship. BDS AESTHETICS LTD does not mine, sell, share or reuse those records for marketing, for model training or for any purpose beyond operating and securing the platform on behalf of the studio. Where our platform acts as the hosted record system, the studio remains the controller of those records and we act strictly to its lawful instructions.

Because these records can reveal health information, we treat them with particular discipline. Access to a hosted record is limited by role, every movement of a record is appended to an audit trail that the studio can inspect, and records are encrypted in transit and at rest. We reserve the right to decline a request from a studio that asks us to handle records in a way that is likely to breach the obligations of that studio to its own end clients, and we will raise the concern before we act.

Nothing in this paragraph shrinks the duty of the studio. The consultation record created at the bench belongs in care, and the studio decides the lawful basis and the retention horizon for it in its own policy with its end client.

Privacy for Children

This website and the clinic management platforms we build are directed at professional adults who operate or work within an aesthetics studio, and at adults who may wish to arrange a professional consultation. They are not directed at children, and BDS AESTHETICS LTD does not knowingly collect personal information directly from anyone under the age of eighteen.

If you believe that a platform has received information from someone under the age of thirteen without proper parental consent, please tell us promptly at office@bdsaesthetics.autos so that we can investigate and, where necessary, remove the data without delay. If you are a parent or guardian who has become aware that a child has shared information with us through an error, we ask you to contact us and we will delete it as quickly as our systems allow.

Any studio that treats a client who is a minor carries its own heightened duties under clinical guidance and under age-appropriate consent rules, and those duties are outside the direct processing relationship we describe in this policy.

How We Use Your Information

We use the information we collect for a bounded set of purposes, and we explain each one plainly. We use your contact details and message to answer enquiries, to arrange and follow up on a platform walkthrough, and to prepare a proposal or a client agreement. We use billing information to issue invoices, to recover payment where agreed, and to keep accurate statutory records. We use practitioner details to open accounts, to keep the compliance portal accurate and to provide secure access to the tools a studio has licensed.

We use technical activity data to keep the site working, to spot faults, to defend the platform against attack and to improve the layout that visitors actually benefit from reading. Where we send a direct message that is confirmatory or transactional, such as a booking confirmation or a security notice, that message is part of the service we provide rather than an offer you must opt out of separately.

We do not sell personal information, we do not trade it for advertising space, and we do not share it in return for benefits in kind. Our obligation to be clear about use is the price of being trusted with a diary full of real people.

Lawful Bases for Processing

Under United Kingdom data protection law, every processing activity needs a lawful reason. For the direct relationship on this website we rely on performance of a contract where we are preparing, signing or delivering a service you have asked us to provide, and on legitimate interests where the activity is modest, expected and unlikely to override your rights, such as keeping our own site secure.

For direct marketing messages that are genuinely promotional we rely on consent, which you can withdraw at any time with a single reply asking us to stop. For the health-related and highly sensitive records processed inside a studio platform, the lawful bases are set by the studio in its own relationship with its end client, and we ask the studio to confirm that those bases are in place before we enable sensitive record fields.

Where we process data to meet a legal, tax or regulatory obligation, that processing is necessary for compliance with the law and is not optional for either of us.

Sharing Within the Studio Bench

Where the platforms deliver care, information is shared deliberately with the people who need it to support that care. A practitioner needs to see the consultation record of a client they are about to treat. A studio manager needs to see the booking diary. An aftercare coordinator needs to see the planned messages. That sharing happens inside the studio, under access controls the studio itself sets, and it never crosses to a party outside the studio unless the studio has chosen that route for a genuine purpose.

BDS AESTHETICS LTD does not appear in the clinical conversation as an invisible actor. We do not read end client records to sell anything, we do not share them up a corporate tree, and we do not make them available to a new business partner without a lawful instruction from the controlling studio and the protections a transfer requires.

Sharing With Service Providers

Like any serious organisation, we rely on a small number of specialist service providers to run our world. This includes infrastructure providers that host our platforms, payment processors that handle billed invoices, an email delivery service for transactional messages, and a support tool that lets our team answer enquiries in one place. Each provider receives only the data that its task genuinely needs, and each provider signs a data processing agreement that binds it to protect that data and to process it only on our documented instructions.

BDS AESTHETICS LTD may also share information where a court, regulator or law requires it, where we need to protect the rights or safety of any person, or in the course of a sale or reorganisation of the business, provided the receiving party remains bound to an equivalent standard of protection. These disclosures are rare, and we record the reason for each one in our internal log.

Cookies and Similar Technologies

A cookie is a small text file placed on your device when you visit a website. This site uses only the cookies that are strictly necessary to make the basic experience work, together with a very small set of audience measurement cookies described in the next section. We do not run advertising networks on this site, and we do not place marketing cookies that follow you across the wider web.

You can set your browser to refuse some or all cookies, or to warn you before a cookie is set. If you disable the strictly necessary cookies, some parts of the site may not perform as smoothly, but the public content will remain readable. Because we keep our cookie use modest, most visitors will never notice a difference regardless of the choices they make.

Analytics and Site Improvement

To learn which pages genuinely help clinic owners and which pages only exist on paper, we look at a slim stream of aggregate activity: the country of the visit at a broad level, the pages opened in a session, the browser type and the length of time spent on a page. This information is collected in a way that does not identify a single visitor in ordinary use, and we do not join it to any name, email address or account to build a profile of any natural person.

We use the insight to rewrite a weak section, to trim a duplicated page or to move a useful link closer to the reader. We do not use it to judge individuals, and we do not share it with any party that would re-identify it. The aim of our analytics is a better bench, not a crowded look at who sits at it.

How We Protect Your Data

Security is a daily practice rather than a single padlock. BDS AESTHETICS LTD uses transport encryption across the public site, encryption at rest for hosted records, role-based access controls inside the platforms, and multi-factor authentication for any account that commands a sensitive function. Our small team receives regular training on handling client data, and we keep access lists short so that the number of people who can read a record stays genuinely low.

We monitor the platforms for unusual activity, we keep software current, and we take backups at a frequency chosen to match the value of the data they hold. No method of transmission or storage is ever fully secure, so while we work hard to protect personal information we cannot promise absolute security. If we ever become aware of a breach that is likely to put your rights at risk, we will tell the affected studio and the relevant regulator without undue delay, in line with our legal duties.

Data Retention Periods

We do not keep information for longer than the purpose for which we collected it still stands. Enquiry and walkthrough correspondence is retained for a period consistent with managing a live or recent commercial relationship, and is deleted once it is clear no further work will follow. Billing and tax records are held for the period required by tax law in the United Kingdom, because there we have no honest choice but to keep them.

Records held inside a studio platform are retained according to the retention schedule that the studio and its own professional guidance require, and configured in the platform, rather than to a clock chosen by us. When an agreement ends we offer the studio an orderly export window and then delete or return residual hosted copies under the data processing schedule. Aggregate technical data is kept only while it still helps us improve the site, and is typically reviewed and thinned each year.

International Transfers

The servers that host our platforms and this website sit within the United Kingdom and the European Economic Area wherever that is operationally practical, and BDS AESTHETICS LTD seeks infrastructure partners that store primary data inside the United Kingdom. Where a task genuinely needs a service provider located outside the United Kingdom or the European Economic Area, we put in place transfer safeguards recognised by law, such as the standard contractual clauses, and we check that the receiving party can maintain an equivalent standard of protection.

Because our own team is based in the United Kingdom and serves studios there and across the European Economic Area, the great majority of data never leaves that settled regulatory home. Where a studio serves end clients in another country, the studio consults its own advisers about the rules that apply to those clients, since the location of the end client, rather than the location of our server, often decides the applicable law.

Your Privacy Rights

Under data protection law you hold a set of rights over the personal information we process in our direct relationship with you. You may ask to see the personal data we hold about you and to understand how we process it. You may ask us to correct data that is wrong or incomplete. You may ask us to delete data where there is no overriding lawful reason to keep it. You may ask us to restrict processing in specific circumstances, and you may ask us to send you a portable copy of data you gave us in a structured format.

You may object to processing based on our legitimate interests where your situation gives you a strong reason, and you may withdraw any consent you have given at any time, without penalty, by contacting us. Some rights are qualified: they depend on the balance of interests and on the lawful basis that supports the processing. We will tell you honestly when a right does not apply and why.

How to Exercise Your Rights

To make any request about your personal data you can email office@bdsaesthetics.autos or write to the registered address of BDS AESTHETICS LTD at Cornwall House, 55-57 High Street, SLOUGH - SL1 1DZ, United Kingdom (GB). So that we can be certain we are speaking to the right person, we may ask you to confirm a small piece of information that only you would know before we fulfil a request.

We aim to respond to a verified request within one month, and we will tell you if a complex request needs more time. Exercising a right is free of charge in the ordinary case, although we may charge a reasonable fee where a request is clearly unfounded or excessive. If you are unhappy with how we handle a request, you may complain to the study data protection supervisory authority in the United Kingdom, which is the Information Commissioner office at its published address, and we will not hold that step against you in any way.

California Additional Rights

Although BDS AESTHETICS LTD is based in the United Kingdom, we acknowledge that some visitors lawfully sit in California under the California Consumer Privacy Act. We do not sell personal information as the law defines selling, and we have not done so in the preceding twelve months. California residents may ask us what categories of personal information we collect, what we use them for and whether we disclosed them for a business purpose in the past year.

California residents may request deletion of their personal information subject to exceptions in the law, and may not be discriminated against for choosing to exercise a privacy right. To make a California request you may use the same contact route described above, and we will apply the safeguards of that law even to a visitor whose identity sits outside our day to day bench.

Links to Other Websites

This site may link onward to the websites of professional bodies, regulators or licensed service providers that are relevant to a decision about clinic software. Once you leave our pages, this policy no longer applies, and the reach of any cookies or trackers on that destination is governed by the privacy statement of that site. We choose links because we believe the resource is useful, but we do not control the destination and we cannot vouch for its every change.

We encourage you to read the destination privacy notice before you share anything there, and to treat a request for an unusual amount of data on a linked page with the same healthy caution you would bring to any unfamiliar corner of the web.

Changes to This Policy

We review this Privacy Policy whenever our practices materially change, and at least once a year as a matter of good discipline. When the change is meaningful to you, we will post an updated version on this page and revise the date at the foot of the document rather than quietly editing a sentence in the middle of a paragraph.

Where a change touches consent we asked you to give, or where the law requires fresh notice, we will contact the affected individuals directly rather than relying on passive notice. The most recent date of this policy is recorded at the end of the page, and earlier versions remain available on request if you wish to compare what has moved.

How to Contact Us

If you have a question about this policy, a concern about data, or a request to exercise a right, the fastest route is an email to office@bdsaesthetics.autos. You may equally write to BDS AESTHETICS LTD at Cornwall House, 55-57 High Street, SLOUGH - SL1 1DZ, United Kingdom (GB), or telephone the published office number at +16674601901 during business hours.

We answer every genuine enquiry, and a member of the studio team who understands our platforms rather than just a reception roster reads each message. The developer of this website is BDSAesthetics, and the responsible organisation named throughout this policy is BDS AESTHETICS LTD.