Privacy Policy
Privacy Policy
Last updated: September 2026
1. Who We Are
COSTÍ CLINIC is a nursing associate-led aesthetics clinic providing aesthetic consultations, treatments and aftercare.
For the purposes of UK data protection law, the data controller is:
Viviana Costigliola trading as COSTÍ CLINIC
COSTÍ CLINIC
106 Beresford Avenue, Wembley, London HA0 1QJ, United Kingdom
Email: info@costiclinic.co.uk
Telephone: +44 7593362110
In this Privacy Policy, “COSTÍ CLINIC”, “we”, “us” and “our” refer to the person or business responsible for deciding how your personal information is collected and used.
We are committed to protecting your privacy, confidentiality and personal information in accordance with the UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018 and other applicable UK data protection legislation.
2. About This Privacy Policy
This Privacy Policy explains how COSTÍ CLINIC collects, uses, stores, shares and protects your personal information when you visit our website, make an enquiry, book an appointment, attend a consultation, receive treatment or otherwise communicate with us.
It applies to website visitors, prospective clients and patients receiving services from COSTÍ CLINIC.
3. Information We May Collect About You
Depending on how you interact with us, we may collect:
Personal and contact information, including your name, date of birth, address, telephone number, email address and, where appropriate, emergency contact information.
Booking and transaction information, including appointments, treatment history, invoices, deposits, payments, cancellations, refunds and correspondence relating to your booking.
Medical and clinical information, including your medical history, existing health conditions, allergies, medication, previous procedures, previous aesthetic treatments, relevant surgical history, pregnancy or breastfeeding status where clinically relevant, contraindications and previous treatment reactions or complications.
We may also record consultation findings, assessments, treatment plans, consent, products administered, treatment sites, quantities used, batch or lot numbers, aftercare provided, follow-up information and any adverse event or complication.
Medical and health information is classified as special category personal data under UK data protection law and receives additional protection.
We may also collect communications you send to us through email, telephone, booking platforms, website forms or social media.
When you use our website, technical information may also be collected, such as your IP address, browser, device, operating system, pages visited, referral source and information collected through cookies or similar technology.
4. Why We Collect and Use Your Information
We use personal information where necessary to operate COSTÍ CLINIC and provide safe and appropriate services.
This includes responding to enquiries, arranging appointments, conducting consultations, assessing treatment suitability, identifying contraindications and risks, obtaining informed consent, providing treatment, maintaining clinical records, providing aftercare and managing follow-up care.
We may also use information to arrange prescriptions where appropriate, communicate with prescribers or pharmacies, process payments and refunds, manage cancellations, deal with complaints or adverse events, maintain appropriate professional and insurance records and meet legal, regulatory, tax and professional obligations.
We may use limited information to operate and improve our website and services, maintain security and prevent fraud.
Where permitted by law, we may also use contact details to send information about COSTÍ CLINIC services, availability or promotions. You can opt out of marketing at any time.
5. Our Lawful Bases for Using Your Information
UK GDPR requires us to have a lawful reason for processing your information.
Depending on the purpose, COSTÍ CLINIC may rely on:
Contract – where processing is necessary to take steps at your request or provide a consultation, appointment or treatment you have requested.
Legal obligation – where we need to process or retain information to meet applicable legal, regulatory, tax or professional requirements.
Legitimate interests – where processing is reasonably necessary to operate and protect COSTÍ CLINIC, maintain appropriate business records, improve our services, prevent fraud or establish, exercise or defend legal claims, provided your rights do not override those interests.
Consent – where we specifically ask for your permission, such as for certain marketing activities or use of identifiable photographs or videos for promotional purposes.
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that lawfully occurred before consent was withdrawn.
The ICO requires privacy notices to explain purposes, lawful bases, recipients, retention and other key information about processing.
6. Health and Special Category Information
Because we provide aesthetic treatments, it may be necessary to collect and process information concerning your health.
Where applicable, COSTÍ CLINIC processes health information where it is necessary for the provision of health or treatment services by, or under the responsibility of, an appropriately regulated healthcare professional who is subject to professional confidentiality obligations.
We will only collect health information that is reasonably necessary for assessing treatment suitability, providing treatment safely, maintaining appropriate clinical records and managing your aftercare.
Where another legal condition applies to the processing of special category information, we will ensure that an appropriate condition under UK data protection legislation has been identified.
7. Providing Accurate Medical Information
It is important that information you provide during your consultation is complete and accurate.
Certain medical information is necessary for us to determine whether a treatment is suitable and safe for you.
If you choose not to provide information that is reasonably required for a clinical assessment, we may be unable to provide the requested treatment.
You should tell COSTÍ CLINIC if relevant information changes, including changes to your health, medication, allergies or pregnancy status, before receiving treatment.
8. Clinical Photographs
We may take photographs before, during or after treatment where appropriate for clinical assessment, treatment planning, monitoring progress, documenting treatment outcomes, providing aftercare or maintaining an appropriate clinical record.
Clinical photographs may form part of your confidential treatment record and will be handled accordingly.
Marketing and Social Media
Clinical consent and marketing consent are separate.
We will not use identifiable clinical photographs or videos for our website, social media, advertising or other promotional purposes simply because you have agreed to clinical photography.
Where we would like to use identifiable photographs or videos for marketing, we will ask for separate permission.
You are free to refuse marketing photography. Refusing will not affect your ability to receive treatment.
Where marketing use is based on consent, you can withdraw your consent for future use by contacting us. Withdrawal cannot necessarily reverse use or publication that occurred lawfully before your request was received.
9. Prescribers, Pharmacies and Healthcare Professionals
Certain treatments may require involvement from an appropriately qualified prescriber or another healthcare professional.
Where necessary for your care, relevant information may be securely shared with an independent prescriber, pharmacy or other healthcare professional.
This may include information relating to your health, medication, allergies, clinical assessment, proposed treatment and previous treatment history.
Only information reasonably required for safe assessment, prescribing, treatment or aftercare will be shared.
Independent prescribers and pharmacies may act as separate data controllers and may provide their own privacy information.
Where an NMC-registered nurse or midwife independent prescriber prescribes medicines for elective non-surgical cosmetic procedures, the NMC currently requires a consultation and documented clinical assessment before prescribing, including subsequent prescribing consultations.
10. Booking, Payment and Technology Providers
We may use trusted third-party services to operate the clinic and website, including providers of booking systems, payment processing, clinical-record software, website hosting, email, communications, IT services and analytics.
Personal information in order to provide their services.
Payment-card information is generally processed securely by our payment provider. COSTÍ CLINIC does not normally store your complete debit or credit card details.
11. Who We May Share Information With
We do not sell your personal information.
Where there is a lawful and appropriate reason, information may be shared with healthcare professionals involved in your care, prescribers, pharmacies, booking and payment providers, clinical-record providers, IT and website providers, accountants, legal advisers, professional indemnity insurers, regulators, public authorities or law-enforcement bodies where disclosure is required or permitted by law.
Where another organisation processes personal information on our behalf, we take appropriate steps to ensure that suitable data-protection arrangements are in place.
12. Information Received From Other Sources
In some circumstances, we may receive information about you from another organisation or healthcare professional, such as a prescriber, pharmacy, booking provider or clinician involved in your care.
Where applicable, we will use this information only for appropriate purposes relating to your treatment, care, booking, legal obligations or the operation of COSTÍ CLINIC.
13. International Data Transfers
Some of the technology providers used by COSTÍ CLINIC may process or store information outside the United Kingdom.
Where personal information is transferred internationally, we will ensure that an appropriate mechanism permitted under UK data protection law is used.
This may include a country covered by UK adequacy regulations or appropriate contractual and other safeguards.
Where applicable, further information about the safeguards used can be requested by contacting us.
14. Marketing Communications
We may send information about COSTÍ CLINIC services, availability, treatments, news or promotions where permitted by law.
Where consent is required, you will be asked to take a clear positive action to opt in.
Marketing consent is not a condition of receiving treatment.
You can withdraw consent or unsubscribe from marketing at any time by following the unsubscribe instructions in a communication or contacting COSTÍ CLINIC.
Your request will not affect essential communications relating to an existing booking, treatment, aftercare or other service.
15. Cookies
Our website may use cookies and similar technologies for security, essential website functionality, appointment booking, remembering preferences, analytics and understanding how visitors use our website.
Where consent is legally required for non-essential cookies, they will not be used until the appropriate consent has been obtained.
16. How Long We Keep Your Information
We retain personal information only for as long as it is reasonably required for the purpose for which it was collected and to meet applicable legal, professional, regulatory, insurance and accounting requirements.
Clinical records may need to be retained for an extended period because they relate to treatment and may be relevant to continuity of care, professional responsibilities, insurance requirements or potential legal claims.
Different retention periods may apply to different types of information.
We periodically review the information we hold and securely delete or destroy information when there is no longer a lawful reason to retain it.
The ICO requires organisations to state retention periods or explain the criteria used to determine them.
17. Data Security and Confidentiality
We take appropriate technical and organisational measures to protect personal information from accidental loss, unauthorised access, misuse, alteration, disclosure or destruction.
Measures may include secure password-protected systems, access controls, secure clinical-record systems, device security, secure payment processing, appropriate backups and limiting access to people who have a legitimate professional or operational reason to access the information.
Clinical information is treated confidentially.
Healthcare professionals working with COSTÍ CLINIC are also subject to their relevant professional obligations concerning confidentiality, record keeping and information governance.
18. Your Data Protection Rights
Depending on the circumstances and the legal basis relied upon, you may have rights including access to your personal information, correction of inaccurate information, erasure in certain circumstances, restriction of processing, objection to certain processing, data portability and withdrawal of consent.
These rights are not absolute.
For example, COSTÍ CLINIC may be required to retain certain clinical, financial, insurance or legal records even if you request their deletion.
We may need to verify your identity before responding to a request.
Your Right to Object
You have the right to object to certain processing carried out on the basis of legitimate interests.
You have an absolute right to object to your personal information being used for direct marketing.
The ICO specifically requires the right to object to be brought clearly and separately to people's attention.
19. Automated Decision-Making
COSTÍ CLINIC does not currently use solely automated decision-making or profiling that produces legal or similarly significant effects concerning clients.
Treatment decisions are made following appropriate assessment and professional judgement.
20. Age Restrictions
COSTÍ CLINIC does not provide or arrange cosmetic botulinum toxin or cosmetic filler injections to anyone under the age of 18 in England, except where a specific lawful medical exception applies.
Proof of age may be requested before an appointment is accepted and/or before treatment.
In England, it is an offence to administer these treatments for cosmetic purposes to a person under 18 or to make arrangements for such treatment, even with parental permission, subject to the statutory medical exception.
21. Complaints About Your Personal Information
If you have concerns about how COSTÍ CLINIC has collected or used your personal information, please contact us so that we can investigate the matter.
22. Links to Other Websites
Our website may contain links to third-party websites.
COSTÍ CLINIC is not responsible for the privacy practices of independent third-party websites.
We recommend reviewing their privacy information before providing personal data.
23. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes to our services, suppliers, business practices, professional requirements or applicable law.
The latest version will be published on this website and the 14.09.2026 date will be amended accordingly.
24. Contact Us
If you have questions about this Privacy Policy, wish to exercise your data-protection rights or have concerns regarding your personal information, please contact:
COSTÍ CLINIC
Viviana Costigliola trading as COSTÍ CLINIC
106 Beresford Avenue, Wembley, London HA0 1QJ, United Kingdom.
Email: info@costiclinic.co.uk
Telephone: +44 7593362110