Aion Labs Medical Group Ltd - Privacy Policy
Last updated 15/8/2026
1. Who we are
Aion Labs Medical Group Ltd (“Aion Labs”, “we”, “us”, “our”) is the data controller for the personal information described in this policy.
• Registered company number: 16172701
• Registered office: 85 Great Portland Street, W1W 7LT
• Clinic address: 10 Harley Street, W1G 9PF
• Website: www.aion-labs.co.uk
• ICO registration number: ZB950887
• Contact for data protection matters: director@aion-labs.com Dr Rob Humphries
Our clinicians are GMC-registered and bound by a duty of confidentiality. Dr Rob Humphries - GMC 7659234
2. What this policy covers
This policy explains how we collect, use, store and share personal information about:
• visitors to our website;
• people who enquire about our services;
• patients and prospective patients;
• people who follow or message us on social media;
• suppliers, contractors and job applicants.
It applies to our website, our clinic, our booking and messaging systems, and our social media channels.
3. Information we collect
3.1 Website visitors
• IP address, device and browser type, operating system
• Pages viewed, links clicked, referring site, date and time of visit
• Information you submit through contact or booking forms
3.2 Enquirers and prospective patients
• Name, email address, telephone number
• The nature of your enquiry, including any information you choose to tell us about your concerns or the treatment you are interested in
• Appointment and consultation records
• Marketing preferences
3.3 Patients
In addition to the above:
• Date of birth and address
• Health information, including your medical history, current medications, allergies, previous cosmetic and surgical procedures, relevant lifestyle information, examination findings, treatment records, batch numbers of products used, consent forms, aftercare instructions and any complications or adverse events. Giving us your medical history is a requirement of treatment and we can’t treat you safely without it.
• Clinical photographs and imaging taken before, during and after treatment
• Correspondence with you, and where relevant with your GP or other treating clinicians
• Payment and transaction records
3.4 Payment information
Payments are processed by Tide Business Banking, PayPal and Pabau/Stripe. We do not store full card numbers on our systems. We retain a record of the amount, date and treatment paid for.
3.5 Where we obtain information
Most information comes directly from you. We may also receive information from your GP or another clinician (with your consent), from a person who refers you to us, and from analytics and advertising tools used on our website.
4. Our lawful bases for using your information
We must have a lawful basis for everything we do with your personal information. Where that information concerns your health, we also need to meet an additional condition. Our bases are set out below.
4.1 Responding to your enquiry
Our lawful basis is our legitimate interest in responding to people who contact us. Where you volunteer information about your health in an enquiry, we rely on Article 9(2)(h) UK GDPR (health or social care purposes), together with paragraph 2 of Part 1 of Schedule 1 to the Data Protection Act 2018.
4.2 Assessing your suitability for treatment, providing treatment, and aftercare
Our lawful basis is the performance of our contract with you, and our legitimate interest in providing safe and effective care. For health information we rely on Article 9(2)(h) and paragraph 2 of Part 1 of Schedule 1 to the Data Protection Act 2018.
4.3 Creating and maintaining your medical records
Our lawful basis is our legal obligation to keep adequate clinical records, and our legitimate interest in doing so. For health information we rely on Article 9(2)(h) and paragraph 2 of Part 1 of Schedule 1 to the Data Protection Act 2018.
4.4 Taking clinical photographs as part of your record
Our lawful basis is the performance of our contract with you, and our legitimate interest in assessing and documenting your treatment. For health information we rely on Article 9(2)(h) and paragraph 2 of Part 1 of Schedule 1 to the Data Protection Act 2018.
4.5 Using photographs for marketing, teaching or publication
Our lawful basis is your consent, and for health information your explicit consent under Article 9(2)(a). This is always sought separately from your consent to treatment.
4.6 Taking payment and keeping financial records
Our lawful basis is the performance of our contract with you, and our legal obligations under tax and accounting law. No health information is used for this purpose.
4.7 Sending you marketing about our services
Our lawful basis is your consent, or our legitimate interest in telling existing patients about similar services. Where a message is targeted using information about your health or your treatment history, we rely on your explicit consent under Article 9(2)(a).
4.8 Reporting adverse events to the MHRA or to a product manufacturer
Our lawful basis is our legal obligation and the public interest in public health. For health information we rely on Article 9(2)(i) (public interest in the area of public health).
4.9 Dealing with a complaint, claim or regulatory investigation
Our lawful basis is our legitimate interest in defending our position and meeting our professional obligations. For health information we rely on Article 9(2)(f) (establishment, exercise or defence of legal claims).
4.10 Website analytics and improving our website
Our lawful basis is your consent, given through our cookie banner. No health information is used for this purpose.
Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect anything done before you withdrew, and it does not remove our obligation to retain your clinical record.
Where we rely on legitimate interests, we have assessed that our interests do not override your rights. You can ask us for a summary of that assessment.
5. Clinical photography
We take photographs as part of your clinical record. This is a normal part of safe practice and allows us to assess change over time.
We will not use your photographs for marketing, social media, teaching, conference presentations or publication without your separate, specific, written consent. That consent is not a condition of treatment, is recorded separately from your consent to treatment, and can be withdrawn at any time by contacting us.
If you withdraw consent we will stop using the image going forward and remove it from material we control. We may not be able to recover images that have already been reshared by third parties or that appear in printed material already distributed.
6. Marketing
We will send you marketing about our services only where you have consented, or where you are an existing patient and the message concerns similar services. Every message contains an unsubscribe link, and you can opt out at any time by contacting us. Opting out of marketing does not stop appointment reminders, aftercare messages or other administrative communications.
We do not sell your personal information, and we do not share it with third parties for their own marketing.
7. Who we share your information with
• Our staff and treating clinicians, on a need-to-know basis
• IT, booking, records and communications providers acting as our processors: Pabau (practice management and clinical records) and Google Workspace (email)
• Meta, where you choose to message us on WhatsApp — see section 7.1 below
• Payment providers: PayPal, Stripe, Tide
• Your GP or another clinician, where you ask us to or where clinically necessary
• Pharmacies and prescribing services, where a prescription is required
• Our insurers, indemnity provider and legal advisers, in connection with a claim or complaint
• Regulators, including the GMC and the MHRA, and product manufacturers where we are required to report an adverse event
• Professional advisers and any purchaser, in the event of a sale or restructuring of the business
• Law enforcement, courts or other authorities, where we are legally required to disclose
• Buyline Ltd and a panel of finance providers, where you apply to pay for treatment using finance — see section 7.2 below
All processors act on our written instructions under a contract that meets Article 28 UK GDPR.
7.1 Contacting us by WhatsApp and email
We publish a WhatsApp number and people message us on it. We use WhatsApp for enquiries and appointment logistics only. WhatsApp is operated by Meta, which processes message metadata under its own privacy policy and outside our control. Where a message contains clinical information, we transfer it into your record in Pabau and delete the message from the device. Please do not send photographs of a medical concern, or details of your health, by WhatsApp — email or telephone us instead. However we do accept photographs of aesthetic or cosmetic concerns by WhatsApp when deciding whether to book an in person consultation.
We use Google Workspace for email. Email is not a secure channel and we do not include clinical detail in subject lines. Anything clinically relevant is recorded in Pabau; the email itself is a copy, not your medical record.
7.2 Paying by finance
If you apply for finance to pay for treatment, we share your personal information with
Buyline Ltd so that your application can be assessed and processed. The information shared is your name, date of
birth, address, contact details, the amount of finance requested and the total cost of
the services being financed. We do not share your medical history, examination findings,
clinical photographs or any other information about your health, and the finance
application describes the services in general terms only.
Our lawful basis is that this processing is necessary to take steps at your request
before entering into a contract, and to perform our contract with you. Buyline Ltd and
the finance providers act as controllers in their own right for the information they
receive and will process it in accordance with their own privacy notices, which they
provide to you as part of the application.
8. International transfer
Our practice management and clinical records system is provided by Pabau (Hambrand Technology Limited), acting as our processor. For UK clinics, patient records, uploaded files and backups are held in data centres in London and are not routinely transferred outside the UK.
A small number of ancillary features do involve international processing. Appointment reminders sent by SMS are handled by Twilio, which routes messages through region-appropriate servers. Where we use AI transcription of consultations, audio may be processed in the United States. Where personal data leaves the UK, the transfer is covered by the UK Addendum to the EU Standard Contractual Clauses, together with encryption in transit and access controls. We have carried out a transfer risk assessment and you can ask us for a copy.
We also use Google Workspace for email, and Meta operates WhatsApp where you contact us that way. Both process data in the United States. These transfers are covered by the UK extension to the EU–US Data Privacy Framework or, where that does not apply, by the UK Addendum to the EU Standard Contractual Clauses.
9. How long we keep your information
9.1 Adult medical records, including clinical photographs
Eight years from the date of your last treatment.
9.2 Records of a patient who was under 18 at the time of treatment
Until their 25th birthday, or until their 26th birthday if they were 17 when treatment concluded.
9.3 Records where a patient has died
Eight years from the date of death.
9.4 Enquiries that do not lead to treatment
24 months from your last contact with us.
9.5 Enquiry correspondence held outside your clinical record Emails and WhatsApp messages that do not lead to treatment are deleted 24 months from your last contact with us. Where correspondence relates to treatment, the clinically relevant content is recorded in Pabau and retained under 9.1.
9.6 Marketing consents and opt-outs
For as long as we send marketing. Where you opt out, we keep a permanent record of your details on a suppression list so that we do not contact you again.
9.7 Financial and transaction records
Six years from the end of the financial year to which they relate.
9.8 CCTV footage
Currently no CCTV is recorded by Aion Labs
9.9 Website analytics
As set out in our Cookie Policy.
Where a complaint, claim or investigation is ongoing or reasonably anticipated, we keep the relevant records until it is concluded, even if the period above has expired. At the end of a retention period, records are securely deleted or destroyed.
9.10 Finance applications
Records relating to a finance application, whether or not it was accepted, are retained
for six years from the date of the application or, where an agreement is entered into,
six years from the end of that agreement. This reflects the period during which a claim
could be brought. After that period the information is securely deleted unless we are
required to keep it for longer.
10. How we protect your information
We use appropriate technical and organisational measures, including access controls, encryption of records at rest and in transit, staff confidentiality obligations and training, secure disposal of paper records, and audit logging of access to clinical records. Clinical photographs are stored on Pabau and are not held on personal devices.
No system is completely secure. If a breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you as well as the ICO.
11. Your rights
You have the right to:
• Access a copy of the personal information we hold about you
• Rectification of information that is inaccurate or incomplete
• Erasure in certain circumstances
• Restriction of our use of your information in certain circumstances
• Object to processing based on legitimate interests, and to direct marketing at any time
• Data portability for information you gave us where we rely on consent or contract
• Withdraw consent at any time where we rely on it
• Not be subject to solely automated decisions with legal or similarly significant effects
To exercise any of these, contact director@aion-labs.com. We may ask you to verify your identity. We will respond within one month, and will tell you if we need to extend that by up to two further months because your request is complex.
There is no charge unless a request is manifestly unfounded or excessive.
Please note: the right to erasure does not generally apply to clinical records we are required to retain for the periods set out above, and we may be unable to delete a record while it is needed for the establishment or defence of a legal claim. We will always explain our reasoning.
12. Automated decision-making
We do not make decisions about your treatment using solely automated means, and we do not carry out profiling that produces legal or similarly significant effects.
13. Cookies
Our website uses cookies and similar technologies. Non-essential cookies are only set with your consent, which you give through the banner when you first visit and can change at any time. Full details of each cookie, its purpose and its duration are in our Cookie Policy.
14. Children
Our services are not offered to anyone under 18.
15. Third-party links
Our website may link to other sites. We are not responsible for their content or privacy practices, and we encourage you to read their policies.
16. Complaints
If you are unhappy with how we have handled your information, please contact us first at director@aion-labs.com so we can try to put it right.
You also have the right to complain to the Information Commissioner’s Office:
• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
17. Changes to this policy
We may update this policy. The date at the top shows when it was last changed. Where a change materially affects how we use your information, we will notify you directly.
