Data Protection
Privacy Policy
How Akter Clinic collects, uses, shares and protects personal information.
Last updated: 5 August 2026
1. Who we are
Akter Clinic is the trading name used on this website. For data protection purposes, the controller responsible for deciding how and why personal information is used is:
- Legal controller
- Zeeshan Akhtar
- Trading name
- Akter Clinic
- Clinic address
- 210A Preston Road, Wembley, HA9 8PB
- akter.clinic@outlook.com
- Telephone
- +44 7788 119059
- ICO registration number
- GDC No. 334000
2. Scope of this policy
This policy explains how Akter Clinic handles personal information collected through this website, the embedded consultation form, email, telephone, social media contact and other pre-consultation communications.
A separate clinical privacy notice may apply after you become a patient or client and the clinic begins maintaining treatment, consent, aftercare or medical records.
3. Information we may collect
- Identity and contact information: name, email address, telephone number and contact preferences.
- Enquiry information: treatment interest, preferred appointment date or time and the message submitted through the consultation form.
- Health information: information about hair loss, skin concerns, medical history or treatment suitability if you voluntarily provide it. Health information is special category data and receives additional legal protection.
- Appointment and communication records: correspondence, call notes and information needed to arrange or manage a consultation.
- Images: photographs or before-and-after images only where separately provided and supported by appropriate permissions.
- Technical information: IP address, browser, device, security logs and information generated when the website or third-party embeds are used.
Please do not send detailed medical information, identity documents or photographs through the initial Google consultation form unless the clinic specifically asks you to use an approved secure process.
4. How we use information and our lawful bases
| Purpose | Information | Proposed lawful basis |
|---|---|---|
| Responding to enquiries and taking requested steps before a consultation | Contact and enquiry information | Steps at your request before entering a contract |
| Arranging and administering consultations or services | Contact, appointment and communication records | Performance of a contract or steps requested before a contract |
| Meeting legal, regulatory, insurance and professional obligations | Relevant enquiry, appointment and clinical records | Legal obligation |
| Operating, protecting and improving the website and preventing misuse | Technical and security information | Legitimate interests in secure and effective website operation |
| Sending optional electronic marketing | Email and marketing preferences | Consent, where required |
Health and other special category information
If Akter Clinic processes health information, it must identify both an Article 6 lawful basis and a separate Article 9 condition. The final condition must be confirmed before this policy is published. Depending on the clinic's professional arrangements, this may be:
- Article 9(2)(h), where processing is necessary for health care and is carried out by or under the responsibility of a professional subject to confidentiality obligations; or
- explicit consent under Article 9(2)(a), where this is the appropriate and valid condition.
5. Where information comes from
We normally collect information directly from you. We may also receive information from a person authorised to act for you, from a referring professional or from technical service providers that support the website and communications.
6. Who we may share information with
We may share personal information only where necessary and proportionate with:
- authorised clinic practitioners and administrative staff;
- Google, where Google Forms, Google Sheets or Google Maps are used;
- Microsoft, where Outlook email is used;
- Cloudflare and website hosting, security or technical support providers;
- professional advisers, insurers, auditors and payment providers, where applicable;
- regulators, courts, law-enforcement bodies or other authorities where disclosure is required or permitted by law; and
- another healthcare professional where appropriate, authorised and necessary for care.
Akter Clinic should maintain appropriate contracts and access controls for processors handling personal information on its behalf.
7. International transfers
Some suppliers may process information outside the United Kingdom. Where a restricted transfer occurs, Akter Clinic will use an applicable UK adequacy regulation, approved contractual safeguards or another lawful transfer mechanism, and will assess the relevant protections where required.
8. How long we keep information
Akter Clinic will keep information only for as long as necessary for the purpose for which it was collected and to meet applicable legal, professional, insurance and dispute-management requirements.
| Record | Draft retention position |
|---|---|
| Enquiries that do not become consultations or treatments | Proposed: up to 12 months after the last meaningful contact |
| Google Form or Sheet enquiry responses | Proposed: up to 12 months unless transferred into an appropriate clinic record |
| Clinical, consent, treatment and aftercare records | Retained for a minimum of 8 years following the date of the last consultation or treatment, in accordance with UK clinical record-keeping standards and insurance requirements. |
| Complaints, claims and legal correspondence | For the period needed to investigate, resolve and defend applicable claims |
9. Security
We use reasonable organisational and technical measures designed to protect personal information. These should include restricted access, strong passwords, multi-factor authentication, device security, secure deletion, staff confidentiality and regular reviews of who can access form responses and spreadsheets.
No internet or email system is completely secure. Please avoid sending unnecessary sensitive information through ordinary email or the initial enquiry form.
10. Your data protection rights
Depending on the circumstances, you may have rights to:
- receive information about how your data is used;
- request access to your personal information;
- ask for inaccurate information to be corrected;
- request deletion in applicable circumstances;
- request restriction of processing;
- object to certain processing;
- receive or transfer certain information in a portable format;
- withdraw consent where processing relies on consent; and
- receive safeguards relating to applicable automated decisions.
These rights are not absolute. Akter Clinic may need to verify your identity and may retain information where the law permits or requires it.
11. Data protection complaints
To raise a concern about how Akter Clinic uses personal information, email:
akter.clinic@outlook.com
Subject: Data Protection Complaint
Akter Clinic will acknowledge a data protection complaint within 30 days of receiving it, take appropriate steps to investigate without undue delay, keep the complainant informed where needed and communicate the outcome without undue delay.
You may also complain to the Information Commissioner's Office if you are dissatisfied with the handling of your information.
12. Children
The clinic's online consultation request is intended for people aged 18 or over. Akter Clinic does not knowingly invite children to submit consultation requests through this form.
13. Changes to this policy
We may update this policy to reflect changes in services, suppliers or law. The latest version will be published on this page with a revised date.