Who we are

This website is operated by Dr ZS Aesthetics Ltd, trading as Glow By Dr. Zahrah (“we”, “us”, “our”), an aesthetic clinic located at 174 Merton High Street, Wimbledon, London SW19 1AY, United Kingdom. We are the data controller for personal data collected through this website.

If you have any questions about this policy or how we handle your data, contact us at info@glowbydrzahrah.co.uk.

What data we collect

Contact form enquiries

When you submit our contact form, we collect your name, email address, phone number (optional), the treatment you are interested in, and your message. This information is sent to us by email so that we can respond to your enquiry.

Booking information

Appointments are booked through a third-party online booking platform linked from this website. Any information you provide during booking is processed by that platform under its own privacy policy, and shared with us so that we can manage your appointment.

Analytics and usage data

With your consent, we use Google Analytics to understand how visitors use our website (pages visited, approximate location, device type). This data is aggregated and does not directly identify you. See our Cookie Policy for details.

Technical data

Our hosting provider automatically logs basic technical information (such as IP address and browser type) for security and to keep the website running reliably.

Clinical records

If you attend the clinic, we will collect medical history and treatment information as part of your consultation. This includes special category (health) data, which we process for the provision of healthcare under Article 9(2)(h) UK GDPR. Clinical records are stored securely, kept confidential, and retained in line with healthcare record-keeping guidance. This website itself does not collect health data.

How we use your data

To respond to your enquiries and manage your appointments
To provide safe, appropriate aesthetic treatments
To improve our website and services (analytics, with consent)
To comply with our legal and regulatory obligations

Our lawful bases for processing are: taking steps at your request before entering a contract (enquiries and bookings), legitimate interests (website security and improvement), consent (analytics cookies), and legal obligation (record keeping).

We do not sell your personal data, and we do not use it for third-party marketing.

Who we share data with

Resend — the email delivery service that transmits contact form submissions to our inbox
Our booking platform — processes appointment bookings made via the links on this site
Google Analytics — usage analytics, only if you accept analytics cookies
Vercel — our website hosting provider

Some of these providers may process data outside the UK. Where they do, transfers are protected by appropriate safeguards such as the UK International Data Transfer Agreement or UK adequacy regulations.

How long we keep your data

Enquiry emails are kept for as long as needed to handle your enquiry and for a reasonable period afterwards. Clinical records are retained in line with healthcare guidance (typically a minimum of 8 years for adults). Analytics data is retained according to Google Analytics settings.

Your rights

Under UK data protection law, you have the right to:

Access the personal data we hold about you
Have inaccurate data corrected
Request erasure of your data (in certain circumstances)
Restrict or object to our processing
Data portability
Withdraw consent at any time (e.g. for analytics cookies)

To exercise any of these rights, email info@glowbydrzahrah.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Changes to this policy

We may update this policy from time to time. The latest version will always be published on this page with the date of the last update shown above.

Privacy policy.