Last reviewed: 20 October 2026. This privacy notice explains how Renovo collects, uses and protects personal information when you contact us, visit our website, book an appointment or receive a treatment.

1. Who we are

The data controller is The Renovo Clinic Ltd, trading as Renovo. We provide mobile skin and aesthetic treatments across South Wales.

Email: hello@therenovoclinic.co.uk
Telephone: 07983 126101
Website: therenovoclinic.co.uk

2. Information we collect

Depending on your interaction with us, this may include:

  • Your name, contact details, age or date of birth, treatment address and access instructions.
  • Appointment details, booking fees, payments and transaction records. Full card details are processed by the relevant payment provider rather than kept as part of your treatment notes.
  • Medical history, medication, allergies, previous treatment, pregnancy or breastfeeding information, consultation responses, consent, treatment records and aftercare communications.
  • Clinical photographs taken to assess, document and review treatment or manage a clinical concern.
  • Messages you send through our website, email or booking system.
  • Technical data associated with visiting our website, such as device or browser information and information collected through necessary cookies or any consented analytics.

3. Why we use information and our lawful bases

We use personal information to respond to enquiries, administer bookings, provide assessments and treatment, contact you about appointments and aftercare, maintain clinical records, process payments and meet applicable professional, tax, insurance and legal obligations.

  • Contract: to manage and deliver services you request, including bookings and treatment arrangements.
  • Legal obligation: where records or information must be kept or disclosed by law.
  • Legitimate interests: to manage enquiries, keep appointments and our systems secure, administer the business and address complaints and legal claims, where those interests are not overridden by your rights.
  • Consent: where required, such as optional promotional use of photographs or certain marketing and website technologies. You can withdraw consent for these optional uses at any time.

Health information is special category personal data under the UK GDPR. Where necessary to assess suitability, provide clinical treatment and maintain confidential treatment records, we rely on Article 9(2)(h) of the UK GDPR, together with Schedule 1 paragraph 2 of the Data Protection Act 2018, for the provision of healthcare or treatment by a healthcare professional subject to a duty of confidentiality. Where relevant, information may also be processed for the establishment, exercise or defence of legal claims under Article 9(2)(f). Separate explicit consent is obtained where needed for optional use of identifiable clinical information or photographs in marketing.

4. Clinical photographs

Clinical photographs may form part of your confidential treatment record and be used for assessment, progress review, aftercare, complications and appropriate clinical or insurance review. Clinical record photographs are separate from optional marketing permission. We will not publish identifiable treatment photographs for advertising, website or social media use without separate permission.

5. Who receives your information

We use service providers to support appointment booking and clinical records (including Aesthetic Nurse Software), payment processing (including SumUp), website hosting, website enquiries and relevant business communications. Access is limited to what is reasonably needed for the relevant service.

Where necessary and appropriate, information may also be shared confidentially with a prescriber or healthcare professional involved in your care, relevant specialist advisers, insurers, legal advisers, regulators, or authorities where legally required. We do not sell your clinical records to advertisers.

Some service providers may process or access personal information outside the United Kingdom. Where applicable, we take steps to ensure that restricted international transfers are covered by recognised UK GDPR safeguards, such as adequacy regulations or appropriate contractual protections. Contact us if you would like further information about the providers we use or how international transfers are protected.

6. Keeping information secure and how long we retain it

We restrict access to personal information and use appropriate administrative and technical safeguards. Records are retained for no longer than needed, taking account of clinical and professional duties, insurer requirements, legal claims, financial recordkeeping and the age of the client. Different categories of data may have different retention periods.

Our standard retention periods are:

  • Adult treatment records, including assessment, consent, treatment notes, aftercare and clinical photographs: normally eight years from the last treatment or clinical contact.
  • Records relating to complications, complaints, safeguarding issues or legal and insurance claims: the normal period may be extended where necessary and justified. The reason and review date will be documented.
  • Invoices, payments and accounting records: normally six years from the end of the financial year concerned, or longer where required by tax law.
  • General enquiries that do not result in an appointment: normally twelve months from the last contact unless an ongoing enquiry or other lawful reason requires longer.
  • Optional marketing consents and associated publication records: retained only while needed to evidence and manage permitted use, with periodic review. A limited suppression record may be kept to respect an opt-out.

Adult clinical records and clinical photographs are normally retained for eight years after your last treatment or clinical contact, with longer retention only where a specific lawful obligation or ongoing matter justifies it. At the end of the applicable period, records are reviewed and securely deleted or anonymised unless there is a lawful reason to retain them.

7. Cookies, analytics and other websites

Our website may use cookies necessary to operate and, if enabled, optional measurement or marketing technology. Embedded content and links to third-party websites (including the external booking portal) may operate under the third party’s privacy policy.

Necessary cookies help the website function. Depending on which optional features are enabled, cookies or similar technologies may also be used by third-party services. Where consent is required for optional cookies or tracking, we seek it before their use. You can manage cookies through your browser, and contact us for further details about the technologies used on our website.

8. Your data protection rights

Depending on the circumstances and lawful basis used, you may have rights to be informed, access your personal information, correct inaccurate information, request erasure, restrict processing, object to certain processing and request data portability. Some information, including necessary clinical records, may need to be retained despite an erasure request where there is a lawful reason to do so.

Your right to object: You can object to processing based on legitimate interests. You also have an absolute right to object to the use of your information for direct marketing.

To exercise your rights or ask a question about privacy, please email hello@therenovoclinic.co.uk.

You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint/.

9. Changes to this notice

We may update this notice as our services or data-handling arrangements change. The updated version will be published here with the review date.