Viata Aesthetics
Last updated: June 2026
This Privacy Policy explains how Viata Aesthetics ("we", "us", "our") collects, uses, stores and protects your personal information, and the rights you have over that information. We are committed to protecting your privacy and handling your data lawfully, fairly and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Because we provide aesthetic and cosmetic treatments, some of the information we hold about you concerns your health. This is treated as "special category" data and is given extra protection, as explained below.
1. Who we are
Viata Aesthetics is the data controller responsible for your personal information.
Business name: Viata Aesthetics
Registered/clinic address: 474 Glossop Road, Sheffield S10 2QA
Contact email: booking@viata-aesthetics.co.uk
Telephone: 44 7720 742016
If you have any questions about this policy or how we handle your data, please contact us using the details above.
2. The information we collect
Depending on your relationship with us, we may collect and process the following categories of personal data:
Identity and contact details — your name, date of birth, postal address, email address and telephone number.
Appointment and account information — booking history, appointment times, the treatments you have enquired about or received, and any correspondence between us.
Health and medical information (special category data) — your medical history, current medications, allergies, relevant medical conditions, skin assessments, consultation notes, treatment records, consent forms, and before-and-after photographs taken for clinical purposes.
Payment information — details necessary to process payments. Card payments are handled by our payment provider; we do not store full card numbers on our systems.
Marketing preferences — whether you have consented to receive marketing communications from us, and your preferences for how we contact you.
Technical and website data — where you interact with our website, information such as your IP address, browser type, and pages visited, collected via cookies and similar technologies (see Section 11).
3. How we collect your information
We collect information:
Directly from you — when you enquire, book an appointment, complete a consultation or medical history form, sign a consent form, attend a treatment, make a payment, or contact us.
During treatment — clinical notes and photographs created by our practitioners.
Automatically — through cookies and analytics when you use our website.
From third parties — for example, our online booking system or, where relevant, a referring practitioner.
4. Why we use your information and our lawful bases
Under the UK GDPR we must have a lawful basis for processing your personal data. Where we process special category (health) data, we also rely on an additional condition under Article 9.
Purpose Lawful basis (Article 6) Additional condition for health data (Article 9) Assessing your suitability for treatment and providing treatment safely Contract; Legitimate interests Provision of health/social care or treatment (Art. 9(2)(h)); or your explicit consent Maintaining clinical records and consent forms Legal obligation; Contract Provision of health/social care (Art. 9(2)(h)) Managing appointments, accounts and payments Contract Not applicable Responding to enquiries and correspondence Legitimate interests Explicit consent (where health details are shared) Sending marketing communications Consent Not applicable Using before-and-after photographs for marketing or training Consent Explicit consent Meeting legal, regulatory and insurance obligations Legal obligation; Legitimate interests As required by law / for legal claims Improving our website and services Legitimate interests; Consent (cookies) Not applicable
Our legitimate interests include running and promoting our business, keeping accurate records, ensuring client safety, and protecting against legal claims. We only rely on legitimate interests where your rights and interests do not override those interests.
You can withdraw consent at any time where we rely on it (for example, for marketing or for the use of your photographs). Withdrawing consent will not affect the lawfulness of any processing carried out beforehand.
5. Before-and-after photographs
We may take clinical photographs to document your treatment and outcomes. These form part of your clinical record and are used to plan and review your care.
We will only use your photographs for marketing, social media, training or any other non-clinical purpose where you have given separate, explicit written consent. You may withhold or withdraw this consent at any time without affecting your treatment, and we will stop using your images for those purposes going forward.
6. Who we share your information with
We do not sell your personal data. We may share it with:
Prescribers and other healthcare professionals involved in your care, where a treatment requires a prescription or referral.
Our service providers (processors) who help us operate, including our booking/practice-management system, payment processor , IT and email providers, and website hosting. These providers act on our instructions under contract and may only use your data as we direct.
Professional advisers and insurers where necessary to manage our business or handle a claim.
Regulators, law enforcement or other authorities where we are required to do so by law.
Where we use processors, we have agreements in place requiring them to protect your data and to act only on our instructions.
7. International transfers
We aim to keep your data within the UK. Where any of our service providers process data outside the UK, we ensure appropriate safeguards are in place — such as UK "adequacy" regulations or the International Data Transfer Agreement (IDTA) / addendum — so that your data receives an equivalent level of protection.
8. How long we keep your information
We keep your personal data only for as long as necessary for the purposes set out in this policy.
Clinical and treatment records, including consent forms, are retained in line with professional and insurance requirements — generally for a minimum of 8 years from your last treatment, and longer where required for treatments involving minors or where there is an ongoing legal reason to retain them.
Financial records are retained for at least 6 years to meet HMRC requirements.
Marketing data is retained until you withdraw consent or ask us to stop contacting you.
Enquiry data for individuals who do not become clients is retained for 12 months and then deleted.
When data is no longer needed, we securely delete or anonymise it.
9. How we keep your information secure
We use appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration or disclosure. These include access controls, secure storage of clinical records, encryption where appropriate, staff confidentiality obligations, and contractual safeguards with our service providers. While no system can be guaranteed completely secure, we review our measures regularly.
10. Your rights
Under data protection law, you have the right to:
Be informed about how your data is used (this policy).
Access the personal data we hold about you.
Rectify inaccurate or incomplete data.
Erase your data in certain circumstances (note that we may be legally required to retain clinical records for a set period).
Restrict processing in certain circumstances.
Object to processing based on legitimate interests, and to direct marketing at any time.
Data portability — to receive certain data in a portable format.
Withdraw consent at any time where we rely on it.
To exercise any of these rights, contact us using the details in Section 1. We will respond within one month. There is normally no charge, though we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive.
11. Cookies
Our website uses cookies and similar technologies to help it function and to understand how visitors use it. Non-essential cookies (such as analytics and marketing cookies) are only set with your consent, which you can manage through our cookie banner or your browser settings. [If you maintain a separate Cookie Policy, link it here: see our Cookie Policy for full details.]
12. Under-18s
Our treatments and services are intended for adults. We do not knowingly provide aesthetic treatments to, or collect data from, individuals under the age of 18 [adjust if you offer specific services to minors with parental consent]. If you believe we hold data about a child without appropriate consent, please contact us and we will address it.
13. Complaints
If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve the matter. You also have the right to complain to the Information Commissioner's Office (ICO):
Website: ico.org.uk
Helpline: 0303 123 1113
14. Changes to this policy
We may update this policy from time to time. The current version will always be available on our website, with the "Last updated" date shown at the top. Significant changes will be communicated where appropriate.
15. Contact us
For any questions about this policy or your personal data:
Viata Aesthetics 474 Glossop Road, Sheffield S10 2QA Email:booking@viata-aesthetics.co.uk Telephone: 44 7720 742016