Privacy Notice
Last reviewed: 1 November 2026. We review this notice at least annually; the next scheduled review is November 2027.
This privacy notice explains how Flawless Feet Ltd ("we", "us") collects, uses, shares and protects your personal information — including special category health data — when you visit our website, contact us, book an appointment or receive treatment at our clinic. It is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Contents
1. Who we are
Flawless Feet Ltd is the data controller for your personal information.
Company number: 08368655 (registered in England & Wales)
Registered office & clinic: 30 Sydenham Road, Sydenham, London SE26 5QF
Website: flawlessfeet.com
Email: hello@flawlessfeet.com
ICO registration number: ZA230474
Data protection contact: Hiren Patel, Data Protection Lead — hello@flawlessfeet.com
2. What we collect and why (lawful bases)
The table below sets out what we collect, why we use it, and the lawful basis we rely on. Where we process information about your health (for example, medical history, medications, allergies and treatment notes), this is special category data under UK GDPR Article 9 — we process it for the provision of health care by regulated health professionals (Article 9(2)(h)), and we will usually also ask for your explicit consent before sharing it with anyone else (for example, your GP or insurer).
| Information | Why we use it | Lawful basis |
|---|---|---|
| Identity and contact details (name, date of birth, address, phone number, email) | Booking and managing appointments, contacting you about your care | Contract (Art 6(1)(b)); Legal obligation (Art 6(1)(c)) |
| Health and clinical information (medical history, medications, allergies, assessment and treatment notes, photographs of the treated area) | Providing safe, appropriate podiatric treatment and keeping clinical records | Special category data — health care (Art 9(2)(h)), with Art 6(1)(b)/(c); explicit consent where required (Art 9(2)(a)) |
| Payment and transaction details | Taking payment, invoicing insurers, accounting | Contract (Art 6(1)(b)); Legal obligation (Art 6(1)(c)) |
| Website usage data (cookies, IP address, pages viewed) via Google Analytics and Google Tag Manager | Understanding how the site is used and improving it — Google tags only measure you after you accept them in our cookie banner (see section 4) | Consent for non-essential cookies; Legitimate interests (Art 6(1)(f)) for essential/security cookies |
| Marketing preferences and engagement (newsletter, WhatsApp list) | Sending news, offers and clinic updates | Consent (Art 6(1)(a)) / soft opt-in for existing patients under PECR |
| Call recordings and transcripts (AI receptionist) | Answering enquiries, booking appointments, quality and training | Legitimate interests (Art 6(1)(f)); explicit consent where a call reveals health information |
| Reviews and testimonials | Publishing patient feedback on our website and review platforms | Consent (Art 6(1)(a)) |
You are free to decline cookies (see section 4), marketing or a recorded call, but we may be unable to provide certain services (such as an appointment) without the core information listed above.
3. Who we share your information with
We never sell your information. We share it only with trusted suppliers ("processors") who act on our instructions under a data processing agreement (UK GDPR Art 28), and with others where you have consented or where the law requires it:
- Cliniko — our practice management system for appointments, reminders and clinical records. Cliniko's data is hosted in Australia (Amazon Web Services, Sydney region) — see section 5.
- Our AI receptionist provider — handles calls when the clinic is busy or closed; calls may be recorded and transcribed.
- Our payment provider — processes card payments; card numbers are not stored on our own systems.
- Google Analytics and Google Tag Manager — website analytics and advertising measurement. Tags are set to "denied" by default via Google Consent Mode v2 and only fire once you accept them in our cookie banner (see section 4).
- Our review widget provider — collects and displays patient reviews.
- WhatsApp (Meta) — appointment and clinic messages, where you have given us a WhatsApp number and consented to hearing from us that way.
- Our email newsletter tool — sends marketing emails; you can unsubscribe at any time.
- Your insurer (e.g. Bupa, Aviva, Vitality, WPA, Healix, Health Shield) — we share relevant treatment information to settle your claim, with your consent.
- Others with your consent — for example, writing to your GP about your treatment.
- Where the law requires — regulators (such as the HCPC), auditors, accountants, or to establish or defend legal claims.
4. Cookies and tracking
Our website uses a cookie banner to obtain your consent before we set any non-essential cookies. Google tags (Google Analytics and Google Ads, loaded through Google Tag Manager) are set to "denied" by default using Google Consent Mode v2 — they do not measure you or advertise to you until you choose to accept them. You can review or change your choices at any time using the cookie settings link in the banner; strictly necessary cookies (which the site needs to function) are always on.
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
| ff_cookie_consent | Strictly necessary | Remembers your cookie choices so we do not have to ask again | 12 months |
| _ga, _gid, _ga_* | Analytics (Google Analytics 4) — set only with consent | Distinguishes visitors and helps us understand how the site is used | Up to 2 years / 24 hours |
| _gcl_au, IDE | Marketing (Google Ads / DoubleClick) — set only with consent | Measures the performance of our advertising | Up to 13 months |
Withdrawing consent stops future analytics and marketing measurement, but does not retroactively delete data already collected while consent was granted — contact us (section 1) if you would like us to arrange deletion where technically possible.
5. International transfers
Some of our processors store or access your information outside the UK:
Cliniko region: Cliniko hosts its data in Australia (Amazon Web Services, Sydney region). As there is no UK "adequacy"
decision for Australia, transfers are protected by the safeguards in Cliniko's data processing agreement, which incorporates the UK
International Data Transfer Agreement (IDTA) / the UK Addendum to the EU Standard Contractual Clauses.
Offshore admin access: some suppliers (including administrative support for our systems) may access data from outside the
UK. This access is limited by role, protected by encryption in transit (TLS) and strong authentication, and covered by the same IDTA / UK
Addendum safeguards.
You may ask us for a copy of the relevant transfer safeguards using the contact details in section 1.
6. How long we keep your information
- Clinical records: we keep adult clinical records for 8 years after your last appointment, in line with HCPC record-keeping guidance. For children and young people, records are kept until the patient's 25th birthday, or their 26th birthday if they were 17 or older when treatment ended.
- Call recordings and transcripts: up to 12 months, then deleted.
- Marketing data: until you unsubscribe or withdraw consent, or after 2 years of no engagement, whichever comes first.
- Financial and transaction records: 6 years, to meet HMRC requirements.
- Website analytics: in line with your cookie settings and the analytics provider's standard retention period.
7. Your rights and how to complain
Under UK GDPR you have the right to:
- Access a copy of the information we hold about you (a "subject access request");
- Correct inaccurate or incomplete information;
- Erase your information in certain circumstances — note that we cannot erase clinical records we are required to keep (section 6), but we will erase marketing data and other non-essential records on request;
- Restrict or object to our processing — including an absolute right to object to direct marketing;
- Port information you gave us, in a structured, machine-readable format, where processing is based on consent or contract;
- Withdraw consent at any time, without affecting the lawfulness of processing already carried out.
To exercise any right, email hello@flawlessfeet.com or write to us at the clinic address in section 1. We will respond within one month. You can also raise a concern with us first — but you have the right to complain directly to the Information Commissioner's Office (ICO), the UK's data protection regulator: visit ico.org.uk/make-a-complaint or call 0303 123 1113.
8. Date reviewed and changes
This notice was last reviewed on 1 November 2026 and is reviewed at least annually (next scheduled review: November 2027). We may update it sooner if our systems, suppliers or the law change; the latest version will always be published on this page.
Customer Testimonials
