Privacy, with care.

01. Who is responsible for your information?

Soprano is the trading name of Soprano Ice Edinburgh & Bruntsfield Aesthetics Ltd, company number SC806132. Our registered office and clinic are at 109-111 Bruntsfield Place, Edinburgh EH10 4EQ. We are the controller of the personal information we collect for our clinic services and website.

This notice covers patients, prospective patients, people making enquiries, referring professionals and visitors to soprano.clinic. It explains our use of information under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, as amended, and relevant electronic communications rules.

For privacy enquiries, contact the clinic directors at info@soprano.clinic, call 0131 229 6688, or write to our clinic address, marked “Privacy enquiry”.

02. What we collect, and where it comes from

The information needed depends on your enquiry or care. It can include:

• Contact and booking details: your name, contact details, date of birth where relevant, appointments, preferences and correspondence.
• Care information: relevant medical history, medication, allergies, treatment suitability, consultation and consent records, treatment notes, clinical photographs, skin scans and follow-up information.
• Payment records: charges, deposits, purchases, refunds and payment status. Payment providers process card details through their own systems; please do not send card details through an enquiry form or email.
• Website information: IP address, browser and device information, pages viewed and interactions collected through website logs, analytics or embedded services.
• Reception CCTV: images captured in the reception area for premises security and safety.
• Preferences and feedback: marketing choices, permissions for photographs, reviews, complaints and privacy requests.

We collect information from you when you contact us, book, attend or complete a consultation. Relevant information may also come from a referring professional, another care provider, or a representative acting on your behalf. We use only the information needed for the purpose involved.

If you cannot provide information necessary to arrange an appointment or assess treatment safely, we may be unable to offer that appointment or treatment. Marketing choices are optional. CCTV is used only in reception. Clinic telephone calls are not recorded.

03. Why we use information

We use information to answer enquiries; arrange and manage appointments; assess suitability; plan, provide and review care; communicate about treatment and aftercare; process payments; manage referrals, feedback and complaints; maintain appropriate records; and operate and protect the website, and maintain reception security through CCTV.

We may also contact you about Soprano services in line with your marketing choices and the rules described below. An appointment reminder or a message about your care is different from a marketing message.

04. Our lawful bases

Different activities have different legal grounds. We rely on:

• Steps towards a contract and performance of a contract: dealing with an appointment you request, providing agreed services, taking payment and sending necessary booking communications (Article 6(1)(b)).
• Legitimate interests: responding to general enquiries, administering and improving the clinic, maintaining service records, preventing misuse, protecting systems and premises (including reception CCTV), and dealing with complaints or legal claims, where these interests are not overridden by your rights (Article 6(1)(f)).
• Legal obligations: keeping records or making disclosures required by applicable tax, regulatory or other law (Article 6(1)(c)).
• Consent: optional uses where consent is required, such as particular marketing communications and publishing identifiable treatment photographs (Article 6(1)(a)).

Health information needs an additional legal condition. For necessary medical assessment, treatment and healthcare provided by, or under the responsibility of, an appropriate professional bound by confidentiality, this is the healthcare condition in Article 9(2)(h), together with the relevant Data Protection Act 2018 condition. Where that condition does not apply to health information needed for a service, we seek explicit consent under Article 9(2)(a). Information necessary for establishing, exercising or defending legal claims may be handled under Article 9(2)(f).

Consent to a treatment and consent to a particular use of personal information are separate matters. Where a use relies on consent, you can withdraw it by contacting us. Withdrawal does not undo lawful use before withdrawal. We will explain if necessary care records must be retained on another applicable legal ground.

05. Photographs, skin scans and referrals

Clinical photographs and skin scans can help document your starting point, assess concerns, plan care and review progress. When linked to your care, they are treated as part of your clinical information. Skin scans and online treatment explorers support information and discussion; treatment suitability is assessed by a practitioner.

We seek separate, specific permission before using identifiable photographs or case details for public before-and-after features, advertising, social media or teaching. Agreeing to treatment does not give that permission. You can refuse or withdraw optional publication permission without losing access to care; we will discuss the practical limits where material has already been printed or shared by others.

For a professional referral, we use relevant information to assess the request, plan care and communicate appropriately with the referring professional. Please contact the clinic to agree a suitable route before sending detailed health records or photographs. Public website enquiry forms are intended for initial contact, not full clinical records.

06. Marketing choices

You can object to direct marketing at any time. Use the unsubscribe or opt-out option in a message, or contact info@soprano.clinic. We will honour your choice.

We use separate consent for marketing emails and text messages. That choice is separate from agreeing to care, appointment communications or the use of photographs. You can choose not to receive marketing and withdraw your consent at any time without affecting your care.

We keep a limited record of an opt-out where needed to avoid contacting you again. An enquiry, a treatment consent form or publication of a review is not, by itself, permission to send marketing.

07. Who receives information

Information is shared only as relevant to its purpose. Recipients can include:

• The clinic team and care professionals involved in administration, your assessment, treatment, referral or follow-up.
• Phorest, which supports online booking and clinic management, including appointment communications and payment-related services. The booking provider and its payment partners also explain their own processing in the notices shown during booking.
• Website, email and IT providers, including SiteGround for hosting, Google Workspace for clinic email and administrative files, and authorised technical support providers. Website enquiries are sent to our clinic mailbox.
• Professional advisers and relevant authorities, such as insurers, accountants, legal advisers, regulators or public bodies, where necessary and lawful.
• Website feature providers described in the next section, where their content or services are used.

We require providers handling information on our behalf to protect it and act within their agreed role. Some organisations, such as payment providers, regulators and independent care providers, may act as controllers for their own purposes. Their privacy information explains that role.

Using Soprano does not automatically give Facial Aesthetic Courses or another associated business permission to use your details for its own marketing.

08. Website features and cookies

The website uses WordPress forms and technical services for enquiries, security and operation. It also includes Google Analytics through MonsterInsights, Google Maps, YouTube and Cloudflare-hosted video, Trustindex review displays, and links or embeds for Phorest bookings and gift vouchers.

When a provider’s content loads, the provider may receive technical information such as your IP address, browser details and the page involved. Cookies or similar technologies may store identifiers or preferences. Provider privacy notices apply to their own processing, alongside this notice for our use of information.

Essential technologies support services such as security, booking and remembering choices. Optional analytics or advertising technologies require consent where the electronic communications rules apply; continuing to browse is not consent. You can use your browser’s privacy controls to restrict or delete cookies, although this can affect embedded features and booking. The Google Analytics opt-out tool provides an additional browser-level option.

For provider information, see Google’s privacy policy, Google Analytics opt-out, Phorest’s privacy notice, Cloudflare’s privacy policy and Trustindex’s privacy information. Contact us if you need help accessing a service without an embedded feature.

09. Information handled outside the UK

Cloud services and their support providers may store or access information outside the UK, including in the European Economic Area or the United States. The location depends on the service and its providers.

Where we make a restricted transfer, it must be covered by UK adequacy regulations, appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum to approved contractual clauses, or a permitted legal exception. You can ask us for details of the arrangements relevant to your information and how to obtain a copy of applicable safeguards.

10. How long information is kept

Current patient-record practice: patient records and treatment photographs are retained indefinitely in our cloud-based patient management system; there is currently no fixed deletion date. This describes our current practice, rather than a requirement to retain every record forever. You can ask us to review whether particular information remains necessary and exercise the rights below.

Retention decisions need to take account of the purpose, relevant professional, legal, regulatory and insurance requirements, including:

• Clinical records, consent forms, photographs and scans: the need for ongoing care and continuity, the nature of treatment, the patient’s age, relevant professional guidance, insurance requirements, and the period in which a complaint or claim may arise.
• Enquiries and correspondence: the time needed to resolve the enquiry and any reasonable follow-up. Relevant correspondence may become part of a clinical or complaint record.
• Booking, payment and financial records: appointment administration, accounting and tax obligations, refunds, disputes and applicable legal requirements.
• Marketing and permissions: the duration of the relevant permission or permitted use, evidence of that permission, and a minimal suppression record where needed to respect an opt-out.
• Reception CCTV: the need to protect the premises and investigate incidents. Relevant footage may need to be preserved for a complaint or legal claim; contact us for current recording-cycle details.
• Website and security information: the purpose of the log or identifier, security needs and the relevant provider’s retention settings.

Information may need to be retained for longer where there is an ongoing complaint, legal claim, safeguarding concern or other legal obligation. When it is no longer required, it should be securely deleted or anonymised. Contact us for the retention period or criteria relevant to a particular record.

11. Keeping information safe

We use access controls and organisational measures appropriate to the information involved, and restrict access to those who need it for their role. No website or email service can guarantee absolute security.

For an initial enquiry, provide only the details needed for us to respond. Do not include payment-card details, identity documents or detailed medical photographs in a general enquiry. Ask the team how to provide sensitive information appropriately.

12. Your rights and choices

Depending on the circumstances and lawful basis, you can ask to access your information, correct inaccurate information, erase information, restrict its use, or receive certain information in a portable form. You can withdraw consent for a use that relies on consent.

Your right to object: you can object to use based on legitimate interests because of your particular situation. You have an unconditional right to object to use for direct marketing.

Some rights have limits. For example, a deletion request does not always override the need to keep necessary clinical records or information required by law or for legal claims. We will explain our response and any applicable exception.

Contact info@soprano.clinic to exercise your rights; you do not need to use legal wording or a particular form. We may need proportionate information to verify your identity or authority to act for someone else. Requests are normally free and answered within one month, subject to the permitted identity-check, clarification and extension rules. We will tell you if a lawful extension or other exception applies.

13. Questions, complaints and updates

Please raise a concern with the clinic directors at info@soprano.clinic, by phone on 0131 229 6688, or in writing to 109-111 Bruntsfield Place, Edinburgh EH10 4EQ.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. You do not have to use our complaints process before contacting the ICO.

We update this notice when our services or information practices change. The current version is available at soprano.clinic/privacy-policy. Ask the team for a printed copy or another accessible format.