Privacy Policy

Last updated: September 2026

Dr. Rita is the trading name of MacInnes Medical Ltd (“Dr. Rita”, “we”, “us” or “our”). We respect your privacy and take particular care with the health information and photographs you may share with us when considering or receiving an aesthetic treatment.

This policy explains how we collect and use personal information when you visit our website, contact us, book an appointment or receive our services.

1. Who is responsible for your information?

MacInnes Medical Ltd is the data controller for the information described in this policy.

Contact: contact@macinnesmedical.com
Company number: SC898732

Please contact us using the details above if you have a question about this policy or wish to exercise your data protection rights.

2. What information do we collect?

Depending on how you interact with us, we may collect:

  • Contact and booking details: your name, date of birth, address, email address, telephone number, appointment history and messages.

  • Clinical information: relevant medical history, medicines, allergies, treatment goals, consultation notes, consent forms, treatments provided, products used, aftercare and follow-up information.

  • Photographs: images taken to assess, plan, document or review treatment. We will seek separate permission before using identifiable photographs for marketing or social media.

  • Payment information: transaction and billing details. If you pay by card, the payment provider may process your card details directly; we do not need to store the full card number.

  • Website information: information you submit through forms and technical information such as your IP address, browser and cookie preferences.

We normally receive this information from you. Where appropriate, we may also receive relevant information from a professional involved in your care, with a suitable legal basis for doing so.

3. How do we use your information?

PurposeLegal basis under UK GDPRResponding to an enquiry, arranging an appointment and administering a bookingSteps before entering into, or performing, a contract; or our legitimate interests in responding to enquiriesAssessing suitability, providing treatment, recording consent, managing aftercare and maintaining clinical recordsPerformance of a contract, legal obligation or legitimate interests, as appropriate; plus a separate condition for health information, normally its use for healthcare or treatment by a professional subject to confidentialityTaking payment and maintaining accounting recordsPerformance of a contract and legal obligationHandling a complaint, safeguarding patients and establishing or defending legal claimsLegal obligation or legitimate interests, as appropriate; with an applicable additional condition where health information is involvedSending optional promotional emails or messagesYour consent, where required. You can withdraw it at any timeUsing identifiable photographs in promotional materialYour separate, specific permission for that useOperating and protecting our website, and understanding its useLegitimate interests for necessary operation and security; consent where required for optional cookies or similar technologies

Consent to a treatment is a clinical decision and is distinct from consent to marketing or to the use of photographs in publicity. Where we rely on your consent to use information, you may withdraw it by contacting us. Withdrawal does not affect use that was lawful before you withdrew it, or records we must retain for another valid reason.

We will not use your clinical information to target you with marketing based on a condition or treatment without the appropriate separate permission.

4. Who do we share information with?

We share information only where needed and appropriate. Recipients may include:

  • clinicians and authorised staff involved in your treatment;

  • providers of our booking, clinical-record, email, website, payment and accounting systems;

  • laboratories, pharmacies, other healthcare professionals or your GP where relevant to your care and appropriate in the circumstances;

  • insurers, professional advisers or regulators where necessary; and

  • emergency services or public authorities where required by law or necessary to protect someone’s safety.

Our service providers must handle information securely and under appropriate contractual terms. We do not sell patient information.

5. Where is information stored?

We use appropriate technical and organisational measures to protect personal information, including access controls and secure systems. Some providers may process information outside the UK. Where a restricted international transfer takes place, we will use an applicable UK transfer mechanism or other lawful safeguard.

Systems used for bookings, records, payments and website enquiries.

6. How long do we keep information?

We keep information only for as long as necessary for its purpose, taking account of clinical, legal, insurance and accounting requirements. Clinical records, including relevant treatment photographs, may need to be kept after your last appointment. We review retention periods and securely delete or anonymise information when it is no longer needed.

7. Marketing and photographs

You can choose whether to receive promotional communications. Every marketing email will give you a way to unsubscribe, and you can also contact us directly.

We will not publish an identifiable treatment photograph, testimonial or case study for promotion without asking you separately. Declining promotional use will not affect your care. We will explain the proposed use before you agree, including where an image could appear online and may be difficult to remove fully once shared by others.

8. Cookies

Our website may use necessary cookies or similar technologies to function and protect the site. If we use optional analytics, advertising or other non-essential technologies, we will explain them and provide the required choice before using them.

9. Your rights

Depending on the circumstances, you may have the right to request access to your information, correction of inaccurate information, erasure, restriction of use, portability, or to object to certain uses. You may also withdraw consent where consent is the basis for a particular use.

These rights are not absolute. For example, we may need to retain clinical or financial records despite a request to erase them. Contact us at [email address] to make a request. We may need to verify your identity before responding.

You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk. We would appreciate the opportunity to address your concern first.

10. Changes to this policy

We may update this policy when our services, systems or legal obligations change. The latest version will be available on our website with its updated date.