Privacy Policy

Pantaleo Aesthetic Clinic is a trading name of Medical and Dental Limited, a Care Quality Commission registered provider (Provider ID 1-20629579981). We operate clinics at 20 Old Brompton Road, London SW7 3DL and 5 Ave Maria Lane, London EC4M 7AQ. For the purposes of data protection law we are the data controller of the personal data you provide to us.

You can contact our Data Protection Lead at hello@pantaleo.co.uk or on 020 3137 2932.

Depending on how you interact with us, we may collect:

• Identity & contact data — name, date of birth, address, email, telephone number.
• Health data (special category) — medical history, medications, allergies, previous aesthetic treatments, consultation notes, treatment records, clinical photographs and consent forms.
• Booking data — appointment preferences, clinic location, the treatment(s) you enquire about and messages you send us.
• Payment data — amounts paid and payment reference. Card details are processed by our payment provider and are never stored on our systems.
• Technical data — IP address, browser, device, pages viewed and referral source, collected via cookies and analytics tools (see our Cookie Policy).
• Marketing preferences — whether you have opted in to receive offers and news from us.

We use your data under the following lawful bases:

• Provision of healthcare (UK GDPR Art. 6(1)(b) and Art. 9(2)(h)) — to assess suitability, plan and deliver treatment, maintain clinical records, and provide aftercare.
• Legal obligation (Art. 6(1)(c)) — to meet our duties under CQC regulations, GDC / GMC professional standards, prescribing law and accounting rules.
• Contract (Art. 6(1)(b)) — to manage bookings, deposits, payments and cancellations.
• Legitimate interests (Art. 6(1)(f)) — to respond to enquiries, send appointment reminders, prevent fraud, improve our website and services, and defend legal claims.
• Consent (Art. 6(1)(a) / Art. 9(2)(a)) — for marketing communications, non-essential cookies, and the use of clinical photographs for anything other than your own records. You may withdraw consent at any time.

We never sell your data. We share it only where necessary with:

• Our clinicians and clinic staff, all of whom are bound by professional and contractual duties of confidentiality.
• Booking and practice-management software providers used to schedule your appointments at each clinic.
• Our email delivery provider, used to send booking notifications and confirmations.
• Payment processors, to take deposits and payments.
• Website hosting, analytics and advertising platforms (Google, Meta) — in pseudonymised form and only where you have accepted the relevant cookies.
• Your GP or another healthcare professional, where clinically necessary and with your agreement, or where we are required to do so by law.
• Regulators, insurers, courts or law-enforcement bodies where legally required.

Some providers process data outside the UK. Where this happens we rely on UK adequacy regulations or the International Data Transfer Agreement / Addendum to ensure your data receives equivalent protection.

• Clinical records — a minimum of 10 years from the date of your last treatment, or (for patients under 18) until your 25th birthday, in line with NHS Records Management Code of Practice and our indemnity requirements.
• Clinical photographs — retained with your clinical record for the same period.
• Enquiries that do not lead to treatment — up to 24 months.
• Financial records — 7 years, as required by HMRC.
• Marketing data — until you unsubscribe or 3 years after your last interaction with us.

Records are held in encrypted, access-controlled clinical systems. Paper records, where used, are stored in locked cabinets within the clinic. Access is limited to staff who need it to care for you. Our website is served over HTTPS and booking data is transmitted securely.

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you (a Subject Access Request). We respond within one month.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data, where we do not have a legal or professional duty to keep it (clinical records are generally exempt).
• Restriction and objection — ask us to limit how we use your data, or object to processing based on legitimate interests or for direct marketing.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — at any time, where consent is the basis for processing.

To exercise any right, email hello@pantaleo.co.uk. We may need to verify your identity first. If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

We will only send you marketing emails or messages if you have opted in. Every message contains an unsubscribe link, or you can email us to opt out at any time. Appointment reminders and clinically necessary aftercare messages are not marketing and will still be sent.

We do not provide aesthetic injectable treatments to anyone under 18 and do not knowingly collect data from children. In England it is a criminal offence to administer botulinum toxin or dermal filler to a person under 18 for cosmetic purposes.

We review this policy regularly. The date at the top shows when it was last updated. Significant changes will be highlighted on this page.