Privacy Policy
Last updated: 19th of October 2026
Your face, your history and your reasons for coming to us are personal. We treat everything you share with the same care and discretion we bring to surgery. This policy explains what we collect, why, who sees it, how long we keep it, and the rights you have.
Your face, your history and your reasons for coming to us are personal. We treat everything you share with the same care and discretion we bring to surgery. This policy explains what we collect, why, who sees it, how long we keep it, and the rights you have.
1. Who we are
GB Aesthetics Ltd ("GB Aesthetics", "we", "us") is the data controller for the personal information described here. We are the practice of Dr Greg Bran, facial plastic surgeon.
- Registered in England and Wales, company number 10853849. Registered office: 70 Harley Street, London, HA8 5NU.
- Clinic: 70 Harley Street, London, HA8 5NU
- Registered with the Information Commissioner's Office, registration number ZA430902.
- Registered with the Care Quality Commission, provider ID 1-11723399655.
- Privacy contact: Talia Anton ta@gbalondon.com or write to the Privacy Lead at the clinic address above.
2. The information we collect
- Enquiry details: name, email, telephone, country, the procedure you are interested in, how you heard about us, and anything you write in a form, email, WhatsApp or direct message.
- Identity and contact details: title, date of birth, address, next of kin, GP details, and identity documents where required for surgery or payment.
- Health information: medical history, medications, allergies, lifestyle factors such as smoking and alcohol, test results, consultation notes, operation notes, anaesthetic records, and correspondence with other clinicians.
- Clinical photographs and video: images taken before, during and after treatment for your medical record.
- Financial details: invoices, deposits, payments and finance applications. Card details are handled by our payment provider; we do not store full card numbers.
- Website and device information: IP address, browser, pages viewed and how you arrived, collected through cookies (see our Cookie Policy).
- Recordings: CCTV images at the clinic and recordings of telephone or video calls, where we have told you in advance.
Health information and photographs are "special category" data under UK law. We hold them to a higher standard of protection and access.
3. Why we use it, and our legal basis
What we do
Information used
Legal basis
Additional condition for health data
Reply to your enquiry and arrange a consultation
Enquiry details, any health details you volunteer
Steps at your request before a contract
Provision of health care (UK GDPR Art 9(2)(h))
Assess, treat and follow up with you
Identity, health information, clinical photographs
Performance of our contract with you
Provision of health care
Keep accurate medical records and meet professional duties
All clinical records
Legal obligation
Provision of health care; public health
Share information with your hospital, anaesthetist, laboratory, pharmacy or GP
Relevant clinical details
Performance of contract
Provision of health care
Take payments and arrange finance
Identity, contact, financial details
Contract; legal obligation (tax)
Not applicable
Use photographs on our website, social media or in teaching
Selected images
Your explicit consent
Explicit consent (Art 9(2)(a))
Send news and offers by email or text
Name, email, phone
Your consent
Not applicable
Improve our website and measure advertising
Website and device data
Consent for advertising cookies; legitimate interests for basic statistics
Not applicable
Handle complaints, claims and regulatory enquiries
Relevant records
Legitimate interests; legal obligation
Legal claims (Art 9(2)(f))
Keep the clinic safe
CCTV images
Legitimate interests
Not applicable
We never use your medical information to decide which adverts you see.
4. Clinical photographs
Photographs are part of your medical record. They are stored in our secure clinical system, not on personal phones, and seen only by the clinical team caring for you.
We will only show your images publicly, including on our website, Instagram, TikTok, YouTube or at medical conferences, if you sign a separate photography consent. You can choose whether your face is shown, cropped or anonymised. You can withdraw consent at any time; we will remove images from channels we control within 14 days, but cannot recall material already printed or shared by others.
We will only show your images publicly, including on our website, Instagram, TikTok, YouTube or at medical conferences, if you sign a separate photography consent. You can choose whether your face is shown, cropped or anonymised. You can withdraw consent at any time; we will remove images from channels we control within 14 days, but cannot recall material already printed or shared by others.
5. Who we share it with
We share only what is needed, and never sell your information.
- Clinical partners: the hospital where you are treated, anaesthetists, pathology laboratories, pharmacies and imaging providers.
- Your GP or other doctors, with your agreement, unless we have a duty to share for your safety.
- Service providers acting on our instructions: clinic management and electronic records: Clinic Software, secure email and hosting: Intermedia and Outlook, website www.gbalondon.com, forms and automation e.g. Zapier, Brevo, etc, telephony e.g. OnHold, payments: NatWest, finance partners, and advertising and analytics (Google, Meta) for website data only.
- Professional advisers and insurers: lawyers, accountants and our medical indemnity provider.
- Regulators and authorities: the GMC, CQC, HMRC, police or courts, where the law requires or allows.
6. International patients and transfers
Some of our providers store data outside the UK, mainly in the EU and the United States. When they do, we rely on UK adequacy regulations (including the UK–US Data Bridge for certified companies) or the UK International Data Transfer Agreement or Addendum. You can ask us for a copy of the relevant safeguards.
If you are travelling from abroad, we may receive records from your doctors overseas and send summaries back to them. We will agree this with you first.
If you are travelling from abroad, we may receive records from your doctors overseas and send summaries back to them. We will agree this with you first.
7. How long we keep it
Information
How long
Medical records and clinical photographs (adults)
At least 8 years after your last treatment, in line with the NHS Records Management Code of Practice, or longer if our medical indemnity provider advises [confirm period]
Medical records for patients treated under 18
Until their 25th birthday, or 26th if they were 17 at the end of treatment, and at least 8 years after treatment
Enquiries that do not lead to treatment
2 years from last contact
Financial and tax records
6 years after the end of the financial year
Marketing preferences
Until you unsubscribe, then a suppression record so we do not contact you again
CCTV
30 days unless needed for an incident
Call recordings
90 days
8. Keeping it secure
Access to clinical records is limited to staff who need it, protected by individual logins and two-factor authentication, and logged. Our team is bound by professional and contractual confidentiality. Data is encrypted in transit and at rest with our main systems. We have a breach procedure and will tell you and the ICO where the law requires.
Please avoid sending detailed medical information or photographs by social media message. Our secure enquiry form or email is safer.
Please avoid sending detailed medical information or photographs by social media message. Our secure enquiry form or email is safer.
9. Your rights
You can ask us to:
We make no decisions about you using solely automated means.
Requests are free. We will reply within one month, or tell you within that month if we need up to two more months for a complex request. We may ask for proof of identity, and the time limit pauses until we receive it or any clarification we need. We will carry out reasonable and proportionate searches.
- give you a copy of your information (a subject access request);
- correct information that is wrong or incomplete;
- delete information, although we must keep medical records for the periods above, even if you ask us to delete them;
- restrict or object to our use of your information, including any use based on legitimate interests;
- send information you gave us to you or another provider in a portable format;
- withdraw consent at any time, for marketing, photographs or cookies, without affecting earlier use.
We make no decisions about you using solely automated means.
Requests are free. We will reply within one month, or tell you within that month if we need up to two more months for a complex request. We may ask for proof of identity, and the time limit pauses until we receive it or any clarification we need. We will carry out reasonable and proportionate searches.
10. Marketing
We will only send you news or offers by email or text if you opt in. Every message has an unsubscribe link. We do not pass your details to other companies for their marketing.
11. Under 18s
We do not knowingly collect information online from anyone under 18 without a parent or guardian's involvement.
12. Concerns and complaints
If you are unhappy with how we have handled your information, please tell our Privacy Lead (Talia) first by emailing her on ta@gbalondon.com. We will acknowledge your complaint within 30 days and respond fully without undue delay.
If you remain unhappy, you can complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk/make-a-complaint.
If you remain unhappy, you can complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk/make-a-complaint.
13. Changes to this policy
We review this policy at least once a year. The date at the top shows when it last changed. We will tell existing patients about any significant change.
Start your journey
Please complete your enquiry form
5–7 minutes
Estimated completion time
UPLOAD YOUR PHOTOS
Anatomical assessment pre-consultation
PERSONAL REVIEW
Reviewed by our surgical team
Start Consultation Form
