AesthetIQ
Legal

Privacy Policy

Last updated: September 2026

This Privacy Policy explains how AesthetIQ Systems collects, uses, stores, shares, and protects personal data when you access our website, request a demo, use our booking, lead-generation, and client-retention software, or otherwise interact with us.

1. Who We Are

This website and the AesthetIQ platform are operated by AesthetIQ Systems, an AI booking & show-rate system for aesthetic clinics, with its registered office at 89 Townsend Road, Manchester, M27 6ED.

In this policy, "AesthetIQ", "we", "us", and "our" mean AesthetIQ Systems.

Our two roles.

For data protection law (the UK GDPR, the Data Protection Act 2018, and, where applicable, the EU GDPR):

  • We act as a data controller for personal data we collect about clinic owners, staff, and website visitors; for example when you enquire, book a demo, or become a customer.
  • We act as a data processor on behalf of our clinic clients for any patient or end-client personal data processed through the AesthetIQ platform (such as booking, lead, or appointment data). In those cases the clinic is the controller, and our processing is governed by a separate Data Processing Agreement (DPA).

2. Contacting Us About Privacy

For any privacy question or to exercise your rights, contact us at:

Email: contact@aesthetiqsystems.io
Postal address: 89 Townsend Road, Manchester, M27 6ED

3. Scope

This policy applies to personal data processed when you visit our website, submit a form or enquiry, request or attend a demo, use our revenue/no-show calculator, subscribe to communications, or use the AesthetIQ platform as a customer. It does not cover third-party websites, your clinic's own booking platforms, or other services we don't control.

4. Personal Data We Collect

Website visitors and enquirers

  • Name, business email, telephone number
  • Clinic/business name, role, and location
  • IP address, device and browser type, pages viewed, referring URLs
  • Cookie identifiers and analytics/usage data
  • Information you enter into forms, the calculator, or demo requests

Customers (clinic accounts)

  • Account and login details
  • Billing contact details, business address, VAT/company registration
  • Subscription, renewal, and payment status
  • Communications with us and support history

Platform data (processed on behalf of clinics)

Where a clinic uses AesthetIQ, the platform may process personal data about that clinic's patients/clients — such as name, contact details, appointment and booking information, and lead enquiry details. This data is processed only on the clinic's instructions under our DPA. We do not use it for our own purposes.

Payment data

We do not store full card details. Payments are processed by Stripe, who provide us only limited information such as card type, expiry, last four digits, and transaction references.

5. How We Use Personal Data

We use personal data to:

  • Respond to enquiries, demo requests, and support queries
  • Provide, operate, secure, and improve the platform
  • Create and manage customer accounts
  • Process payments, invoices, renewals, and billing
  • Send service, account, billing, and security messages
  • Send marketing communications where permitted by law
  • Measure website performance and improve user experience
  • Comply with legal, tax, accounting, and regulatory obligations
  • Establish, exercise, or defend legal claims

6. Lawful Bases for Processing

We rely on one or more of the following:

  • Contract — to provide the platform and services you or your clinic have signed up for, manage your account, and process payments.
  • Legitimate interests — to run and improve our business, secure our platform, prevent fraud and misuse, and carry out B2B marketing to professional contacts, where not overridden by your rights.
  • Consent — for non-essential cookies and certain marketing. You can withdraw consent at any time.
  • Legal obligation — for tax, accounting, record-keeping, and lawful requests from authorities.

For patient/end-client data processed through the platform, the clinic is responsible for establishing the lawful basis as controller; we process it under their instructions.

7. Special Category Data

Health-related information can be special category data under data protection law. We do not request special category data through our website or marketing.

Where the platform processes health-related patient data on a clinic's behalf, the clinic (as controller) is responsible for ensuring an appropriate lawful basis and condition for processing special category data exists. We process it only as a processor under our DPA, with appropriate safeguards.

8. Marketing Communications

We may send B2B marketing to professional contacts where permitted by law, relying on consent or legitimate interests depending on context. You can opt out at any time using the unsubscribe link in our emails or by contacting us. Even if you opt out, we may still send service, account, billing, and security messages.

This is consistent with our obligations under the Privacy and Electronic Communications Regulations (PECR).

9. Cookies

We use cookies and similar technologies to operate the site, remember preferences, maintain security, and analyse traffic. Strictly necessary cookies are always active; analytics, advertising, and other non-essential cookies require your consent. You can manage cookies via your browser and our cookie consent tool. Disabling some cookies may affect site functionality.

10. Who We Share Personal Data With

We may share personal data, where necessary and lawful, with:

  • Hosting, infrastructure, security, and cloud storage providers
  • Email, CRM, analytics, and communication providers
  • Payment processors (e.g. Stripe)
  • Booking-platform integrations a clinic chooses to connect (e.g. Pabau, Fresha, Phorest, Timely)
  • Professional advisers (lawyers, accountants, auditors)
  • Regulators, authorities, or courts where required by law
  • A buyer or successor in the event of a sale, merger, or restructuring

We do not sell personal data. All processors act under written contracts requiring appropriate safeguards.

11. International Transfers

Where personal data is transferred outside the UK or EEA (for example, by a hosting or software provider), we ensure appropriate safeguards are in place, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or EU Standard Contractual Clauses.

12. Data Retention

We keep personal data only as long as reasonably necessary:

  • Enquiry and marketing data — until you unsubscribe or object, plus a suppression record to honour opt-outs
  • Customer account data — for the life of the account and a reasonable period afterwards
  • Billing, invoice, and tax records — typically up to 7 years, as required by law
  • Platform/patient data — per the retention terms in our DPA and the clinic's instructions

When no longer needed, we delete, anonymise, or securely restrict the data.

13. Security

We use appropriate technical and organisational measures including access controls, authentication, role-based restrictions, encryption where appropriate, secure hosting, monitoring, and incident response procedures. No platform can guarantee absolute security; you are responsible for keeping login credentials secure and notifying us of any suspected unauthorised access.

14. Your Data Protection Rights

Depending on your location and applicable law, you may have the right to:

  • Access your personal data
  • Correct inaccurate or incomplete data
  • Request deletion
  • Restrict or object to processing
  • Object to direct marketing
  • Request data portability
  • Withdraw consent where processing relies on it
  • Complain to a data protection authority

To exercise these rights, contact contact@aesthetiqsystems.io. We may verify your identity first. These rights are not absolute and may be subject to legal exemptions.

If you are a clinic's patient, your rights are generally exercised through the clinic as controller; we will assist the clinic in responding.

15. Complaints

You can complain to the UK Information Commissioner's Office at ico.org.uk. We'd encourage you to contact us first so we can try to resolve your concern.

16. Children

Our website and platform are intended for business and professional use and are not directed at children. You must be at least 18 to enquire, request a demo, or hold an account.

17. Changes to This Policy

We may update this policy from time to time. Where changes are material, we'll take reasonable steps to notify you. The updated policy applies from the date stated at the top.