ZLC AESTHETICS / DRAFT POLICY
Privacy notice — draft
DRAFT FOR OWNER CONFIRMATION — prepared 9 October 2026. This notice covers the ZLC information website. It is not a complete clinical-record privacy notice and has not received legal approval. Owner confirmation is required before publication.
Who is responsible
ZLC Aesthetics is the public-facing business name. OWNER TO COMPLETE: the legal data-controller name and a direct privacy contact. The clinic address already provided is 33A High Street, Belper, Derbyshire DE56 1GF. No company number, legal entity type or data-protection officer is asserted in this draft.
Information and purposes
The website presents clinic and professional training information. There is no on-site enquiry form, patient login or checkout in this build. Hosting and security services may process IP addresses, device/browser information, requested pages and technical logs to deliver and protect the site. If you contact ZLC through a linked service, the information you choose to provide may be used to respond to your request.
Lawful bases — proposed for confirmation
The proposed basis for necessary hosting and security is legitimate interests in operating a reliable, secure website. Responding to requested pre-booking information may involve steps towards a contract, or legitimate interests in answering general enquiries. The owner must confirm the actual processing, lawful bases and provider arrangements. Where processing depends on consent, that consent must be freely given and may be withdrawn.
External booking, enquiries and health information
Appointment booking opens Aesthetic Nurse Software. Professional training enquiries open Aesthetic Training Hub; Instagram links open Instagram. Data entered on those services is handled under the relevant notices and ZLC’s applicable processing arrangements. Medical history, consent and treatment records are not collected through a form on this website. The owner must provide appropriate separate clinical privacy information, including any applicable special-category processing conditions, before collecting health information.
Service providers, transfers and retention
Framer provides website hosting and delivery. The owner must confirm the provider contracts, other processors, any international transfers and the safeguards actually used. Website and enquiry information should be retained only for as long as needed for the stated purpose, security, applicable obligations or legal claims. The owner must confirm the retention criteria and any specific periods used; no unverified retention period is asserted here.
Your rights and right to object
Depending on the circumstances, you may have rights of access, correction, erasure, restriction and portability. You may object to processing based on legitimate interests, including objecting to direct marketing. Where consent is the basis, you may withdraw it without affecting earlier lawful processing. OWNER TO COMPLETE: the direct method for making a privacy request. No automated eligibility decision or profiling function has been implemented in this website build.
Complaints and updates
You can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. This draft must be updated when the website’s functionality, providers or processing changes. For cookies and similar technologies, see the separate draft cookie notice.