Last updated: 21/09/2026

Feylix Clinic respects your privacy and treats your personal information with care. This policy explains what information we collect, why we use it, how we protect it and the choices available to you when you visit our website, contact us or receive treatment.

1 Who is responsible for your information

Feylix Clinic is operated by Cundall Medical Services Ltd, which is the data controller responsible for the personal information described in this policy.

For privacy enquiries or to exercise your data protection rights, contact:

Privacy contact: Jeremy Cundall

Email: [email protected]

Postal address: Hightown Cottage, Chop Gate, Middlesbrough, TS9 7HZ

Website: www.thefeylixclinic.co.uk

2 Information we collect

Depending on your relationship with us, we may collect:

• Contact and identity information: your name, date of birth, address, email address and telephone number, together with identity documents where necessary.
• Appointment information: enquiries, bookings, attendance, treatment preferences and correspondence.
• Clinical information: relevant medical history, allergies, medication, consultation notes, treatment records, consent forms and aftercare information.
• Clinical photographs: images taken where appropriate to assess treatment, document progress or maintain your clinical record.
• Payment information: transaction references, amounts paid, invoices and refund records.
• Communication preferences: your marketing choices and records of consent or withdrawal.
• Website information: IP address, browser and device details, website activity and cookie preferences, where collected.
• Feedback: reviews, survey responses and complaints you provide.

Health information is “special category data” and receives additional protection under data protection law. Clinical photographs may also reveal health information.

3 Where your information comes from

We usually collect information directly from you when you make an enquiry, complete a form, book an appointment, attend a consultation or communicate with us.

Where relevant to your care and lawfully permitted, we may also receive information from a referring practitioner, another healthcare provider or someone authorised to act on your behalf.

Our website may collect technical information automatically through cookies and similar technologies, as explained below.

4 Why we use your information

We use your information to:

• Answer enquiries and arrange appointments.
• Assess whether a treatment is suitable and provide treatment and aftercare.
• Maintain accurate clinical records and support patient safety.
• Send appointment confirmations, reminders and necessary care instructions.
• Process payments and refunds.
• Investigate concerns, manage complaints and handle legal claims.
• Meet applicable legal and regulatory requirements.
• Protect our systems and prevent fraud.
• Understand and improve our services.
• Send marketing communications in accordance with your choices.

If information is needed to arrange or safely provide treatment, we will explain this when we request it. Without essential contact or clinical information, we may be unable to proceed.

5 Our lawful bases

We use personal information only where an appropriate lawful basis applies:

Purpose	Lawful basis
Arranging and delivering services you request, including payments	Performance of a contract, or taking steps at your request before entering a contract
Keeping records or making disclosures required by law	Compliance with a legal obligation
Managing enquiries outside a prospective contract, complaints, system security and service administration	Legitimate interests in operating a safe, effective clinic, where those interests are not overridden by your rights
Sending consent-based marketing	Consent
Publishing identifiable patient photographs or testimonials	Separate, specific consent, including explicit consent where health information is disclosed

 

Where we rely on legitimate interests, we consider the necessity of the processing and its effect on you.

Health information requires an additional legal condition. Where applicable, we rely on the condition for providing healthcare or treatment, subject to the required professional confidentiality safeguards. In other circumstances, explicit consent or another applicable condition may be needed, such as establishing, exercising or defending legal claims.

Consent to treatment is separate from consent to process personal information.

6 Marketing and patient photographs

We will send promotional emails or text messages only where you have opted in to the relevant channel. Choosing not to receive marketing will not affect your care.

You can unsubscribe using the option in our messages or by contacting us. We may retain a minimal record of your opt-out to ensure we respect it.

Appointment confirmations, payment messages and necessary aftercare communications may continue because they relate to services you receive.

We will not publish identifiable photographs, treatment stories or testimonials without separate permission covering the intended use. Refusing permission will not affect your treatment. You can withdraw that permission by contacting us; withdrawal does not make earlier lawful use unlawful.

7 Who we share information with

Where necessary and lawful, recipients may include:

• Practitioners involved in your treatment and aftercare.
• Providers of booking, patient-record, secure storage and IT support services.
• Payment processors and financial service providers.
• Communication providers used for appointment messages and permitted marketing.
• Accountants, legal advisers and insurers.
• Regulators, public authorities or emergency services where disclosure is required or otherwise legally justified.

We limit sharing to what is necessary. Suppliers handling information on our behalf must be subject to appropriate contractual obligations. Some recipients, such as independent clinicians, may be responsible for their own processing and provide their own privacy notices.

We do not sell your personal information.

8 Information processed outside the UK

Where a restricted international transfer takes place, we use an applicable lawful transfer mechanism, such as UK adequacy regulations or approved contractual safeguards supported by the necessary assessment.

No Suppliers outside the UK store or have access to personal information.

You can contact us for information about the safeguards applying to your data and how to obtain a copy.

9 How we protect information

We use appropriate organisational and technical measures to protect personal information against unauthorised access, alteration, loss or disclosure.

Access is limited to people who need information for their work, and those handling patient information are required to respect its confidentiality.

10 How long we keep information

We retain information for periods appropriate to its purpose, taking account of clinical needs, applicable legal requirements, professional guidance and the handling of complaints or claims.

Our retention periods are:

Record type	Retention period
Clinical records, consent forms and clinical photographs	8 years
Enquiries that do not lead to treatment	12 months
Financial and transaction records	6 years
Complaints and claims	10 years
Marketing consent and suppression records	No set period
Website and cookie information	No set period

 

We securely delete or anonymise information when it is no longer needed. Where a specific record must be kept longer, we restrict its use to the reason for retaining it.

11 Cookies and website tracking

Our website may use cookies and similar technologies to provide essential functions and, where enabled, understand website use.

Where consent is required, we will ask before using the technology. You can refuse optional cookies or change your choices.

Our cookie policy explains the technologies used, their purposes, providers and duration.

[Confirm the website’s actual cookies, analytics, advertising tools and any email tracking before publication.]

12 Your rights

Depending on the circumstances, you may have the right to:

• Obtain a copy of your personal information.
• Have inaccurate information corrected.
• Request deletion or restriction of use.
• Receive certain information in a portable format.
• Withdraw consent where processing relies on it.

You can object at any time to the use of your information for direct marketing. You may also object to processing based on legitimate interests for reasons relating to your circumstances.

Some rights have exceptions. For example, we may need to retain clinical information despite a deletion request. We will explain any applicable limitation.

Contact us using the details above to make a request. We may need to verify your identity. We normally respond within one month, subject to any lawful extension or pause, which we will explain where applicable.

13 Automated decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects

14 Children and young people

Children or young people under the age of 18 are not treated at Feylix clinic.

15 Questions and complaints

Please contact [email protected] if you have a question or concern about your information.

You also have the right to complain to the UK Information Commissioner’s Office. Information about raising a concern is available on the ICO complaints website.

16 Changes to this policy

We review this policy and update it when our practices or relevant requirements change. The latest version will be available on our website with its revision date. Where necessary, we will bring significant changes to your attention directly.