Privacy Policy.

Aesthetics By FKA ("we", "us", "our") is a private medical aesthetics clinic operated by F. Khairunnessa from 73 Trent Road, Luton, Bedfordshire, LU3 1SZ. We are the data controller responsible for any personal information you share with us through this website, in clinic, or via our booking system.

If you have any questions about this policy or your data, you can reach us at firdoskhairunnessa@icloud.com or on 07957 159162.

To provide safe, effective, and personalised treatments, we collect only the information necessary to deliver our service. This may include:

• ✦Identity & contact details: full name, address, phone number, email
• ✦Medical & consultation information: relevant medical history, skin conditions, allergies, medications, consent forms, and treatment notes (collected in clinic during your consultation, not via this website)
• ✦Booking & payment data: appointment history, deposit transactions, and refund records (full card details are handled by our payment provider, not stored by us)
• ✦Photography: before/after images taken with your explicit, separate written consent for clinical records and (only if separately agreed) marketing
• ✦Website data: pages viewed, device type, and approximate location, collected through privacy-friendly analytics

Your information is used strictly for legitimate clinical and business purposes:

• ✦Delivering treatments safely and managing your aftercare
• ✦Confirming, rescheduling, or cancelling appointments and processing deposits
• ✦Maintaining accurate medical records as required by clinical regulators
• ✦Responding to enquiries you send through our contact or booking forms
• ✦Sending appointment reminders and (only with your opt-in consent) occasional updates about treatments and offers
• ✦Meeting our legal, insurance, and tax obligations

Under the UK GDPR, we process your personal data on one of the following Article 6 lawful bases: your explicit consent (for treatments, photography, and marketing communications), the performance of a contract (your booking), our legitimate interests (running a safe and well-managed clinical service), and compliance with legal obligations (clinical record keeping, safeguarding, and tax).

Because we also handle health and medical information, which is special category data under UK GDPR Article 9, we additionally rely on your explicit consent (Article 9(2)(a)) and the provision of health care (Article 9(2)(h)) as the lawful conditions for processing that data.

Where we rely on your consent, you may withdraw it at any time by contacting firdoskhairunnessa@icloud.com. Withdrawing consent will not affect the lawfulness of any processing carried out before you withdrew it.

We do not carry out any automated decision making or profiling that produces legal or similarly significant effects in relation to you. Every clinical decision is made by Firdos Khairunnessa personally.

Aesthetics By FKA treats clients aged 18 and over for clinical aesthetic procedures. A small number of cosmetic services (such as Lash Lifts and Mehndi) may be offered to clients aged 16–17 with the written, in-person consent of a parent or legal guardian, who must remain present throughout the appointment. We do not knowingly collect data from children under 16, and we do not market to under-18s in any form.

Our website and booking platform are hosted by Base44 on cloud infrastructure within the United Kingdom and the European Economic Area. A small number of our service providers (for example our email delivery service) may process data outside the UK or EEA. Where this happens, we rely on the UK's adequacy regulations or the International Data Transfer Addendum (UK IDTA) to ensure your data continues to be protected to UK GDPR standards. If you would like a list of our current sub-processors and the safeguards in place, please email firdoskhairunnessa@icloud.com.

We do not sell your data. We only share it with carefully selected third parties who help us run the clinic, and only to the extent necessary:

• ✦Our regulated payment processor for handling deposits and balance payments securely
• ✦Our booking and CRM platform that powers this website
• ✦Our insurer and (in the unlikely event of a complaint) regulatory bodies such as the JCCP
• ✦HMRC, accountants, or other professional advisers where legally required

Clinical photographs are taken before and after treatment to monitor results and protect both you and the clinic. These remain confidential to your file unless you provide a separate, written consent to use specific images publicly. You may withdraw marketing consent at any time, and we will remove the images from future use.

Clinical records are retained for a minimum of eight years from your last treatment, in line with professional indemnity and medical record keeping standards. Booking and financial records are kept for six years for tax purposes. Marketing data is held only for as long as you remain subscribed.

You have the right to access, correct, or request deletion of your personal data, to restrict or object to processing, and to receive a copy of your data in a portable format. To exercise any of these rights, email firdoskhairunnessa@icloud.com and we will respond within one calendar month. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling their helpline on 0303 123 1113.

Our website uses essential cookies to keep the site functioning (for example to hold your booking state during checkout) and a small number of analytics cookies to help us understand which pages are useful. We do not use cookies for advertising or third-party tracking.

When you first visit the site, we show a cookie banner that lets you accept or decline analytics cookies. Essential cookies are always on because the site cannot function without them. You can change your decision at any time by clearing this site's data in your browser, which will cause the banner to re-appear on your next visit.

We take the protection of your information seriously. Records are stored on encrypted, access-controlled systems. Paper consent forms are kept in a locked location at the clinic. Only F. Khairunnessa and authorised clinical staff can access your file.

We may update this policy from time to time to reflect changes to our services or the law. The "Last updated" date at the top of this page will always show the current version. Material changes will be communicated to active clients by email.