Privacy Policy
EIRA CLINICS
Last updated: September 2026
At EIRA Clinics, we take your privacy and the confidentiality of your personal and health information seriously.
This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, who we may share it with, and the rights you have in relation to your personal information.
EIRA Clinics is operated by Kate Bell Ltd, trading as EIRA Clinics. For the purposes of UK data protection law, Kate Bell Ltd is the data controller for the personal information described in this policy, except where another organisation acts as a separate data controller.
01 — INFORMATION WE COLLECT
Depending on how you interact with EIRA Clinics, we may collect:
Personal information
Your name, date of birth, address, telephone number, email address and other contact information.
Health and medical information
Your medical history, symptoms, diagnoses, medications, allergies, treatment history, reproductive or hormonal health information, lifestyle information and other information relevant to your care.
Clinical information
Consultation notes, examination findings, treatment plans, consent records, prescriptions, clinical photographs, correspondence, treatment records and aftercare information.
Diagnostic information
Blood test requests, laboratory results and other diagnostic or screening information.
Booking and payment information
Appointments, deposits, purchases, invoices, payment status and transaction information. Payment-card information may be processed securely by our payment provider rather than stored directly by EIRA Clinics.
Enquiry information
Information you provide when contacting us through our website, online forms, telephone, email, social media or other communication channels.
Website information
This may include your IP address, browser and device information and information about how you interact with our website.
Marketing preferences
Information about whether you have chosen to receive news, educational content, clinic updates or marketing communications from EIRA Clinics.
02 — HEALTH INFORMATION
Information concerning your health is considered special category personal data under UK data protection legislation and receives additional protection.
We collect and use health information only where there is an appropriate lawful basis and where it is necessary for providing or managing your care or another legitimate and lawful purpose.
This may include information required to:
assess your health and suitability for treatment;
provide consultations, treatment and follow-up care;
prescribe and manage medicines;
request, receive and interpret diagnostic investigations;
maintain appropriate clinical records;
communicate with other healthcare professionals involved in your care where appropriate;
manage patient safety, safeguarding and clinical governance; and
meet our professional, regulatory and legal obligations.
03 — HOW WE COLLECT YOUR INFORMATION
We may receive information directly from you when you:
make an enquiry;
complete an online or patient form;
create or manage a booking;
attend a consultation or treatment;
purchase a service or product; or
communicate with us by telephone, email, website, social media or another method.
We may also receive information from other organisations involved in your care, such as pharmacies, laboratories and other healthcare professionals, where there is an appropriate lawful basis for doing so.
Information may also be collected through our practice-management system, website and associated technologies.
04 — WHY WE USE YOUR INFORMATION
We may use your personal information to:
provide and manage your healthcare, aesthetic and skin services;
assess your suitability for treatment;
maintain accurate clinical records;
manage appointments, enquiries and waiting lists;
communicate with you about your appointments and care;
provide appropriate aftercare and follow-up;
arrange prescriptions and dispensing;
request and manage diagnostic testing;
make appropriate referrals;
process payments and administer purchases;
respond to complaints, concerns or requests;
maintain patient safety and clinical governance;
meet regulatory, professional, insurance, accounting and legal requirements;
operate, secure and improve our website and services; and
provide marketing communications where we are legally permitted to do so.
05 — OUR LAWFUL BASIS FOR PROCESSING
The lawful basis we rely upon will depend upon why we are processing your information.
These may include:
Contract — where processing is necessary to provide a service you have requested or to take steps before entering into a contract.
Legal obligation — where we need to process information to comply with our legal obligations.
Legitimate interests — where we have a legitimate interest in processing information and your interests, rights and freedoms do not override those interests.
Consent — where you have provided specific consent and consent is the appropriate lawful basis for the processing concerned.
When we process special category information, including health information, we also identify an appropriate condition under Article 9 of the UK GDPR.
This may include processing necessary for the provision or management of health or social care by, or under the responsibility of, an appropriately qualified healthcare professional who is subject to professional confidentiality obligations.
06 — WHO WE SHARE YOUR INFORMATION WITH
To provide and manage our services, EIRA Clinics works with healthcare, laboratory, pharmacy and technology providers.
We only share personal information where there is an appropriate reason to do so and limit the information shared to what is reasonably necessary for that purpose.
Depending on the services you receive, providers we use may include:
Pabau — our clinic management system, used for patient records, appointments, forms, clinical documentation, communications, data management and aspects of our reception and administrative services.
SignatureRx — used for electronic prescribing, including prescriptions issued as part of our women's health services.
Acre Pharmacy, Wigmore Medical, MedFx and Healthxchange — pharmacy, prescribing, dispensing and medical supply services used where appropriate in connection with aesthetic treatments and other clinical services.
Clinilabs — used for blood testing and laboratory analysis.
Stripe — used to process payments securely.
Squarespace — used to host and operate our website.
Google — including Google Workspace for business communications and Google Analytics for understanding how visitors use our website, subject to applicable cookie and consent requirements.
We may also share information where appropriate with:
other healthcare professionals involved in your care;
referral services;
professional advisers;
insurers and auditors;
regulators and professional bodies; and
statutory or public authorities where disclosure is required or permitted by law.
Some organisations process personal information on our behalf as data processors. Others may determine independently how certain information is processed and therefore act as separate data controllers.
Where another organisation acts as a separate controller, its own privacy information will explain how it uses your personal information.
07 — PABAU, ONLINE FORMS & AI-ASSISTED SERVICES
EIRA Clinics uses Pabau as its electronic clinic and patient-management system.
Information submitted through our online enquiry forms, booking process and patient forms may be transferred directly into Pabau.
This may include your contact information and, where relevant, information about your health, symptoms, treatment interests or reason for contacting the clinic.
We use Pabau to manage appointments, patient records, clinical documentation, consent forms, communications and administrative processes.
We may also use AI-assisted functionality within Pabau, including virtual reception and administrative tools, to help manage enquiries and patient communications.
AI-assisted systems are used to support our administrative and clinical workflows. They do not replace the professional judgement of an appropriately qualified healthcare practitioner.
Decisions concerning diagnosis, prescribing, treatment suitability or your clinical care are not delegated solely to an AI system.
Where AI-assisted functionality processes personal information, we take account of the nature and sensitivity of the information involved and our obligations under applicable data-protection legislation.
08 — PRESCRIBING & PHARMACIES
Where medication is prescribed, we may share information necessary to create, dispense and manage your prescription with an appropriate prescribing service, pharmacy or dispensing provider.
For women's health prescribing, EIRA Clinics uses SignatureRx to facilitate electronic prescriptions.
Information shared may include details required to identify you safely and dispense your prescription, together with information about the medication prescribed.
For aesthetic treatments and associated medicines or products, we may use Acre Pharmacy, Wigmore Medical, MedFx and Healthxchange, depending upon the treatment and circumstances.
Pharmacies, prescribing services and medical suppliers may have their own professional and legal obligations concerning information they receive and may act as independent data controllers for certain processing activities.
09 — BLOOD TESTING & LABORATORY SERVICES
EIRA Clinics uses Clinilabs for blood testing and laboratory analysis.
Where you undergo blood testing, we may share information necessary for the laboratory to process your sample safely and accurately.
This may include identifying information, relevant clinical information and details of the tests requested.
Results are returned to EIRA Clinics for appropriate clinical interpretation, communication and follow-up.
Laboratories may have their own legal and professional obligations relating to the information and samples they receive.
10 — CLINICAL PHOTOGRAPHY
Clinical photographs may be taken where appropriate for assessment, treatment planning, monitoring progress or maintaining your clinical record.
Clinical photographs forming part of your patient record are treated as confidential clinical information and stored and processed accordingly.
We will not use identifiable clinical photographs for marketing, advertising, our website or social media without obtaining separate appropriate permission from you.
Declining permission for marketing photography will not affect your ability to receive care or treatment from EIRA Clinics.
11 — PAYMENTS
EIRA Clinics uses Stripe to process payments.
When you make a payment, relevant payment and transaction information may be processed by Stripe.
We do not ordinarily need to retain your full payment-card details within your clinical record.
Stripe processes personal information in accordance with its own privacy and security arrangements.
12 — MARKETING COMMUNICATIONS
We may send you clinic news, educational information, service updates or offers where we have an appropriate lawful basis to do so.
Where consent is required, marketing consent will be requested separately and will not be a condition of receiving clinical care.
You can unsubscribe from marketing communications at any time by using the unsubscribe option provided in the communication or by contacting us.
Administrative or clinical communications relating to appointments, treatment, patient safety or your care are separate from marketing communications and may still be sent where necessary.
13 — WEBSITE, ANALYTICS & COOKIES
Our website is hosted using Squarespace.
We may use cookies and similar technologies to enable website functionality, remember preferences, understand how visitors use our website and, where applicable, support marketing activities.
We use Google Analytics to help us understand how visitors interact with our website.
Where consent is legally required for analytics or other non-essential technologies, these technologies will be used in accordance with your cookie choices.
You can find further information and manage applicable preferences through our Cookie Policy and cookie settings.
14 — HOW LONG WE KEEP YOUR INFORMATION
We retain personal information only for as long as necessary for the purposes for which it was collected and to comply with applicable clinical, professional, regulatory, insurance and legal requirements.
Different categories of information may therefore be retained for different periods.
Clinical records may need to be retained for a significant period after your treatment or care has ended.
Where information is no longer required, it will be securely deleted, destroyed or anonymised where appropriate.
15 — HOW WE PROTECT YOUR INFORMATION
We take appropriate technical and organisational measures to protect personal information from unauthorised access, accidental loss, misuse, alteration or disclosure.
Measures may include secure electronic systems, access controls, password protection, appropriate confidentiality arrangements and secure methods of storing and transmitting information.
Access to patient information is limited to those who require it for an appropriate purpose.
16 — INTERNATIONAL DATA TRANSFERS
Some technology providers used by EIRA Clinics operate internationally. This means that certain personal information may, in some circumstances, be processed outside the United Kingdom.
Where personal information is transferred outside the UK, we take steps to ensure that an appropriate lawful transfer mechanism or safeguard is in place where required under UK data-protection legislation.
This may include transfers to countries recognised as providing adequate protection or the use of approved contractual or other safeguards.
17 — YOUR DATA-PROTECTION RIGHTS
Depending upon the circumstances, you may have the right to:
request access to personal information we hold about you;
ask us to correct inaccurate or incomplete information;
request deletion of your information in certain circumstances;
request restriction of certain processing;
object to certain types of processing;
request transfer of certain information;
withdraw consent where processing relies upon your consent; and
raise a concern about how your information has been handled.
These rights are not absolute. For example, we may be required to retain clinical records even where you ask us to delete your information.
18 — ACCESSING YOUR CLINICAL RECORDS
You have the right to request access to personal information we hold about you, subject to applicable legal provisions.
If you would like a copy of your personal information or clinical records, please contact EIRA Clinics.
We may need to verify your identity before releasing information.
Requests will be handled in accordance with applicable data-protection legislation.
19 — CHILDREN & YOUNG PEOPLE
Where EIRA Clinics provides an appropriate service to a child or young person, particular care will be taken when collecting, using and sharing their personal information.
Information will be processed in accordance with applicable requirements relating to consent, confidentiality, safeguarding and data protection.
20 — DISCLOSURE FOR SAFETY OR LEGAL REASONS
There may be circumstances where we are required or permitted to disclose personal information without your consent.
This may include circumstances involving safeguarding concerns, serious risks to an individual's safety, prevention or detection of crime, legal proceedings or where disclosure is required by law or an appropriate regulatory or statutory authority.
Any such disclosure will be considered carefully and limited to information that is necessary and appropriate in the circumstances.
21 — CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy periodically to reflect changes to our services, systems, providers or legal obligations.
The current version will be published on our website together with the date it was last updated.
22 — CONTACT US
If you have questions about this Privacy Policy, would like to exercise your data-protection rights or have concerns about how we have handled your information, please contact:
EIRA Clinics
Operated by Kate Bell Ltd
70 New Church Road
Hove
East Sussex
BN3 4FL
Email: hello@eiraclinics.co.uk
Telephone: 01273 442230
Company number: 14719551
23 — INFORMATION COMMISSIONER'S OFFICE
If you are unhappy with how we have handled your personal information, we would appreciate the opportunity to address your concerns directly.
You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's independent regulator for data protection.