Privacy

Your clinic is the data controller for patient information. It decides what is recorded about you and why, and it answers your requests about your data.

Face Plan Ltd is the clinic's data processor. We store and protect that information and use it only to run the service for the clinic, on the clinic's instructions and under a written data processing agreement, and, with the clinic's permission, to produce the anonymised statistics described under "Aggregated insight" below. We help clinics answer patients' requests.

Face Plan Ltd is the data controller for practitioner accounts, billing, security records, enquiries sent to us, and visits to this website.

Face Plan Ltd is also the data controller for the anonymised, aggregated statistics described under "Aggregated insight" below.

Name, email address and phone number.

Your plan: the products, treatments, prices and advice your practitioner recommends, and your responses ("I'd like to buy this", "Already have this", "I've booked this").

Your practitioner's private notes, and any allergies, sensitivities, medications or contraindications they record. These are never shown to other clinics.

Progress photos, with the date they were taken and a record of the consent given for each one.

Messages between you and your practitioner.

A record of who changed a plan, and when.

For patient information, the clinic chooses and records its lawful basis. Usually this is to provide the service the patient asked for (Article 6(1)(b)) or the clinic's legitimate interests (Article 6(1)(f)).

For health information, most aesthetics and skincare practitioners rely on the patient's explicit consent (Article 9(2)(a)). A clinic whose care is given by, or under the responsibility of, a regulated health professional with a duty of confidentiality (for example a doctor, nurse, dentist or pharmacist) may instead rely on the provision of health care (Article 9(2)(h) with the Data Protection Act 2018, Schedule 1, paragraph 2). Each clinic records its choice in the service, and where it relies on consent the practitioner confirms it for each patient.

Progress photos are only added with explicit consent, recorded each time.

For the clinic owner who holds the subscription: to provide the service under our contract (Article 6(1)(b)). For other practitioners in the clinic, who are not party to that contract: our and the clinic's legitimate interests in providing the service they use at work (Article 6(1)(f)).

Billing records: legal obligation (Article 6(1)(c)). Security records, enquiries and usage records: legitimate interests in running, securing and improving the service (Article 6(1)(f)).

A photo is added only with consent, given at upload and recorded with the photo.

Location and camera information is removed on upload.

Photos are encrypted in our database in London. They are never stored in a public place, and never sent in an email or a notification.

Only the clinic and the patient can see a photo, and only after the service checks who is asking. Each view, upload and deletion is recorded in an audit log.

The patient's plan link lasts 30 days, and the clinic can withdraw it at any time.

We use photos only to show them to the patient and their clinic. We never use them for AI training, analytics or marketing.

A deleted photo is removed from the service at once, and from our encrypted backups within 14 days.

We do not store the audio; only the plan the practitioner accepts is saved.

Google does not keep Speech-to-Text audio after returning the text (we do not enable its optional data logging).

The providers may keep what they receive for a limited period (Google up to 55 days, Anthropic up to 30 days) solely to detect misuse, and do not use it to train their models.

The practitioner reviews every draft before anything reaches a patient. We never use patient information to train AI models.

While a clinic subscribes, patient information is kept until the clinic deletes it. A practitioner can delete a patient, with everything linked to them, at any time.

When a subscription ends, or a free trial ends without one, the clinic has 30 days to export its data from Settings. A clinic that signs up without a free trial and does not subscribe has 30 days from sign-up. After that, all its patient information (patients, plans, notes, messages and photos) is permanently deleted.

Deleted information leaves our backups within 14 days.

Security and usage records are kept for up to 12 months, email copies for 30 days, enquiries for up to 2 years, and billing records for 6 years, as UK law requires.

Practitioner accounts are deleted on request once the subscription has ended.

You can ask for a copy of your information, and ask for it to be corrected, deleted or restricted, or object to its use.

You can ask for your information in a portable, machine-readable form. Clinics can export everything they hold from Settings to answer such a request.

Where your information is held on your consent, including progress photos and any health information held on explicit consent, you can withdraw that consent at any time: ask your clinic, or delete a photo you added yourself. Withdrawing does not affect what was done before.

No decision about you is made by automated means alone (Article 22): a practitioner reviews every AI draft before it becomes your plan.

As a patient, ask your clinic first: it is responsible for your information, and we will help it.