Privacy policy

At a glance

Baudelaire Aesthetics Ltd ("Baudelaire", "we") is the data controller for the personal and health information processed through this website, the patient portal (“Le Cabinet”), and the clinic at Room 2, Goodlight Wellness Center, Victoria Bridge Road, Bath BA2 3GG, United Kingdom. We are registered with the Information Commissioner’s Office under reference 00014086030.

Much of what you share, including your skin and aesthetic concerns, your medical history, and the photographs and videos you upload, is Special Category (health) Data under Article 9 of the UK GDPR. We process it under Article 9(2)(h), medical purposes under professional secrecy, with a GPhC-registered Independent Prescriber (Dr Dana Beiki) responsible for each clinical record. We also rely on your explicit consent, and on contract, for parts of the service such as booking and payment.

The short version: we collect only what your care needs, your photographs are never sent to any AI provider, no computer decides anything about your treatment, and we never sell your data.

What we collect

Your name, email address, telephone number, date of birth, and postal address when required. This is the minimum we need to identify you as a patient and reach you.

The skin and aesthetic assessment you complete: the concerns you flag, your answers to the clinical questions, and the words you write about what you would like and why; your medical history and consent forms; the photographs and short videos you choose to upload; consultation notes, the treatment plan Dr Beiki prepares, and any prescription issued. This is the clinical record proper and is treated accordingly.

Your appointments, the treatments and programmes you book, and a record of payments (the £75 consultation deposit and any treatment balance). Card payments are handled by our payment provider. We never see or store your full card number.

Your messages with the clinic, the decisions you make on your treatment plan, and the photographs and comparisons you keep in your Skin Diary. We use these to deliver your care and to keep the portal working.

Which categories of processing you have agreed to. You can change these, or ask us to, at any time.

What we do with it

• Assess your skin and features and prepare your treatment plan.
• Provide, sequence and record your treatment, including prescribing.
• Take the consultation deposit and any treatment balance, and manage your bookings.
• Communicate with you about your care and your appointments.
• Maintain the clinical record required of us by professional regulators.
• Keep our systems secure and prevent fraud and misuse.
• Comply with our legal and regulatory obligations.

We do not sell your data. We do not share it with advertisers. We do not use your personal or health data to train AI models, and our AI provider is contractually prohibited from doing so (see “How we use AI”).

Who we share it with

Only where it is necessary to deliver your care or provide a service you have asked for. Each is bound by a Data Processing Agreement. Our processors are:

• Supabase (EU region, Frankfurt): the database and secure file storage behind the patient portal (your account, assessment, photos and videos).
• Cliniko: our clinic management system, holding your appointment and clinical record, hosted in its EU/UK region.
• Stripe (United States, EU): our payment provider for the consultation deposit and treatment balances, including Klarna and PayPal pay-in-3. Stripe handles your card details directly; we do not see or store them. Bound by SCCs.
• Anthropic (United States): the AI model that drafts your skin reading for Dr Beiki to review (see below). It receives only measurements and your written answers, never your photographs or videos, and never your name or identifiers. Bound by a Data Processing Agreement including the UK Addendum to the EU Standard Contractual Clauses, with a no-training commitment.
• Resend (United States): transactional email (booking confirmations, sign-in links, payment links, reminders). Bound by SCCs.
• Vercel: our website and portal hosting.
• Plausible (EU region): privacy-respecting, cookieless website analytics. It measures visits only and collects no personal data.

When Dr Beiki issues a prescription, we share the minimum necessary information with a registered dispensing pharmacy so your medication can be prepared and sent to you.

Data stays in the UK or EU except where stated. Transfers to the United States (Stripe, Anthropic, Resend) are protected by UK Standard Contractual Clauses and supplementary safeguards: encryption in transit and at rest, and no-training agreements.

How we use AI

Dr Dana Beiki reviews and decides everything about your care himself. Nothing about your assessment, your plan, or your treatment is decided by a computer. He uses software only to help him prepare a first draft more quickly, and your photographs are never seen by any AI.

When you add photographs or short videos to your assessment, the measurements Dr Beiki reads (proportions, symmetry, and skin-tone and redness readings) are worked out from the image on your own device. Only those numbers are kept alongside your record. The photographs and videos themselves are stored securely for Dr Beiki to review, and are never sent to any AI provider.

To save time in clinic, an AI tool provided by Anthropic writes a first draft of your skin reading, working only from those measurements and the words you wrote. It is a draft, and nothing more:

• Dr Beiki reviews every word himself. He is a registered Independent Prescriber, and he reads, edits and approves every reading and plan before you ever see it and before anything is booked. Where he disagrees with the draft, he changes it.
• The AI decides nothing.It does not choose your treatment, it does not prescribe, and it makes no clinical judgement. Those are Dr Beiki’s, and his alone.
• The AI never sees your photographs or videos, and never your name, date of birth, email, phone, postcode or patient ID. It works from measurements and your written answers only.
• It reasons from your own informationand from established anatomy and skin science, never toward a cultural “ideal”, and it may not promise outcomes.
• You can ask us not to use it. Email us and Dr Beiki will prepare your assessment without the AI step, and we will delete any draft held about you.
• Anthropic does not train on your data. Our agreement forbids using it for training, fine-tuning, or any other purpose.

A Data Protection Impact Assessment (DPIA) for this processing is on file. Email support@baudelaireclinics.co.uk to request a copy.

Marketing and updates

Most of our emails are about your own care: booking confirmations, sign-in and payment links, and appointment reminders. If you ask to receive updates from the clinic, such as the newsletter, we use your email to send them and you can stop them at any time, using the unsubscribe link in the email or by writing to us. We never share your email with anyone for their own marketing, and we never sell it.

How long we keep it

Clinical records, including your assessment, photographs, videos and treatment plan, are retained for a minimum of eight years from your last interaction, in line with GPhC guidance. Booking and payment records are kept as long as we are required to for accounting and tax. Other portal activity is kept while your account is active. When you close your account we delete what we are not required to retain; anything held under our professional duty is kept for the regulated period and anonymised where possible.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request erasure (subject to our professional duty to retain clinical records for the period required by regulators).
• Restrict how we process your data.
• Object to processing.
• Receive your data in a portable format.
• Withdraw consent for any processing based on consent.
• Complain to the ICO (ico.org.uk).

Exercise any of these by emailing support@baudelaireclinics.co.uk, or from within the patient portal at Settings → My data. We will respond within 30 days.

Security

Data is encrypted in transit (TLS 1.3) and at rest (AES-256). Access is role-based and audited. The patient portal enforces row-level security: your records are visible only to you and to clinicians directly involved in your care. Photographs, videos and prescription PDFs are served through short-lived signed links that expire quickly.

Cookies

We use only strictly necessary cookies, and only in the patient portal: the sign-in and session cookies that keep you logged in. Without them the portal could not remember you from one page to the next. The public pages set no cookies, and our analytics (Plausible) is cookieless, so we run no tracking, advertising or third-party cookies and there is nothing to consent to. Our cookie notice has the detail.

This service is for adults

Baudelaire Aesthetics treats adults only. The website and portal are not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us their information, contact us and we will delete it.

Changes to this policy

We update this policy when the way we handle your data changes. The date at the top shows the current version. Where a change is significant, we will tell you through the portal or by email before it takes effect.

Contact

Questions or concerns about how we handle your data:
Baudelaire Aesthetics Ltd,
Room 2, Goodlight Wellness Center,
Victoria Bridge Road, Bath BA2 3GG, United Kingdom.
support@baudelaireclinics.co.uk
+44 1225 688088