Last updated: 9 October 2026
Who we are
Skin by Dr Serena respects your privacy. This policy explains how we handle your personal information when you visit our website, contact us, book appointments, receive treatment or purchase products.
Dr Serena Patel, trading as Skin by Dr Serena, is responsible for your personal information and is the data controller.
For privacy enquiries or to exercise your rights, contact:
- Email: info@doctor-serena.com
- Telephone: 07466 499282
Information we collect
Depending on the services you use, we may collect:
- Personal and contact details, including your name, date of birth, address, email address, telephone number and account details.
- Booking and correspondence information, including appointments, enquiries and communications with us.
- Medical and treatment information, including medical history, medications, allergies, skin concerns, questionnaire answers, consultation notes, treatment records and consent records.
- GP and next-of-kin details, where provided in connection with your care.
- Photographs and videos, where taken for clinical purposes or with your permission for promotional use.
- Order and payment information, including purchases, billing and delivery details, transaction references and refunds.
- Technical information, such as your IP address, browser information and website activity, where collected through our website and its services.
We usually receive this information directly from you. We may also receive relevant information from payment providers or healthcare professionals involved in your care.
If you provide someone else’s details, such as your next of kin, please make them aware and direct them to this policy.
How and why we use your information
We use your information to:
- Respond to enquiries and communicate with you.
- Manage appointments, confirmations, reminders and aftercare.
- Assess treatment suitability, provide care and maintain clinical records.
- Record treatment consent and your choices about promotional use.
- Contact your GP, other healthcare professionals or next of kin where necessary and lawfully permitted.
- Process orders, payments, refunds and deliveries.
- Manage accounts, complaints and legal claims.
- Protect our website and meet applicable legal and professional obligations.
If information is necessary to provide a service or assess treatment safety, we will explain this. Without it, we may be unable to proceed.
Our legal grounds
We rely on the following legal grounds, depending on the purpose:
- Contract: arranging and providing services you request, managing bookings and fulfilling orders.
- Legal obligation: meeting applicable legal requirements, including accounting and disclosure obligations.
- Legitimate interests: responding to enquiries, administering and protecting our business, maintaining website security and handling complaints or legal claims, where these interests do not override your rights.
- Consent: optional activities such as promotional use of identifiable photographs or videos and non-essential cookies where consent is required.
For medical information needed to assess and provide your care, we also rely on the healthcare condition under Article 9(2)(h) of the UK GDPR and Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018. This information is processed by, or under the responsibility of, a healthcare professional subject to a duty of confidentiality.
Consent to treatment is separate from consent to optional uses of your personal information. Where we rely on consent, you can withdraw it by contacting us. Withdrawal does not affect processing that was lawful before you withdrew consent.
Photographs and videos
Clinical photographs or videos may form part of your treatment record. Your practitioner will explain their purpose.
We request separate permission before using identifiable photographs or videos for promotional purposes, including on our website, social media or clinic displays. We use material only for the purposes you agree to. Declining promotional use will not affect your care.
You can withdraw promotional permission by emailing info@doctor-serena.com. We will stop further use and remove material from channels we control. We may be unable to retrieve copies shared by others or material already distributed in print.
Withdrawing promotional permission does not automatically require deletion of images lawfully retained as part of your clinical record.
Marketing
Permission to use photographs or videos does not give us permission to send marketing emails or texts.
If we offer optional marketing communications, we will explain your choices and how to unsubscribe. You can ask us to stop direct marketing at any time.
Appointment reminders, aftercare information and order updates are service communications.
Who we share information with
We share information where necessary with providers supporting our services, including:
- Hostinger, for website hosting and backups.
- Providers supporting bookings, online forms and website accounts.
- Stripe, for payments made through Stripe.
- Zoho, for business email hosting.
- SMTP2GO, for delivering emails from our website.
- Delivery providers fulfilling product orders.
- Professional advisers, insurers and healthcare professionals where appropriate.
- Public authorities where disclosure is legally required or otherwise lawfully justified.
We limit the information shared to what is needed. We also limit personal information included in emails and require authorised staff to sign in to view submitted questionnaires and consent forms.
We do not sell personal information.
International processing
Our website is hosted in the United Kingdom, with backups stored in Germany. Transfers to Germany are covered by the UK’s adequacy arrangements.
SMTP2GO delivers emails from our website and may process personal information outside the UK. For relevant international transfers, its Data Processing Agreement provides contractual safeguards, including Standard Contractual Clauses and the UK Addendum. You can contact us for further information about these safeguards.
How long we keep information
We keep personal information for as long as needed for the purposes described in this policy.
For clinical records, this depends on ongoing care, applicable professional guidance, insurer requirements and the need to establish, exercise or defend legal claims.
Booking, order and accounting records are retained according to their purpose and applicable legal requirements. Routine correspondence is retained as needed to resolve enquiries and related follow-up.
We retain records of promotional permissions where needed to demonstrate and respect your choices. Information relating to unresolved complaints, investigations or legal claims may need to be kept for longer.
Cookies and external services
Our website uses cookies and similar technologies. See our Cookie Policy for more information and available preference controls.
Our website links to external services, including affiliate retailers and social media platforms. Their own privacy policies apply when you use those services.
Your rights
Depending on the circumstances, you can ask us to:
- Provide access to your personal information.
- Correct inaccurate or incomplete information.
- Delete information or restrict its use.
- Provide certain information in a transferable format.
You can also object to processing based on legitimate interests, object to direct marketing at any time and withdraw consent where we rely on it.
These rights have conditions and exceptions. For example, we may need to retain clinical records despite a deletion request.
To make a request, email info@doctor-serena.com. We may need to verify your identity.
Complaints
Please contact us if you have concerns about how we handle your information.
You can also complain directly to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. You do not have to contact us first.
Changes to this policy
We may update this policy when our services, practices or legal requirements change. The date above shows when it was last updated.