Privacy and
Cookies

Website data

Use of this website

The recording of visits and newsletter preferences is subject to user consent and is intended to limit repeated invitations.

Recording user preferences

Session storage remembers the welcome sequence and any language choice available on the page. These short-lived settings are separate from the optional newsletter preferences.

If you choose “Allow preferences”, local storage remembers visits, how often the Notes invitation has appeared, whether you dismissed it and whether a signup request was accepted. A session record prevents the same visit from being counted twice. These preference records contain no name, email address, message or clinical information. They are separate from the mailing-list details you choose to submit.

Until you allow this, the optional Notes records are not read or saved and automatic invitations are not scheduled. “Necessary only” stops automatic invitations and removes existing Notes preference records. You can still subscribe using the form. Without permission to remember preferences, a signup does not save a subscription flag in your browser.

Consent settings can be changed using Website preferences in the footer. The decision, its date and the preference-policy version are recorded to prevent the same request appearing on every page. This choice does not constitute consent to Google Analytics.

Website and form security

This website is hosted and delivered through Cloudflare. To load, protect and operate it, Cloudflare may process your IP address, the page requested, browser or device information, and network or security logs. Cloudflare Turnstile checks forms for automated traffic using browser, device and network signals. Security checks may use cookies or other browser storage.

Website performance analysis

Cloudflare Web Analytics is used to analyse page visits and website performance, identify problems and improve the website. Cloudflare states that this service does not use cookies, local storage or fingerprinting.

Google Analytics 4 is used only after you choose “Allow analytics” in the separate analytics banner. It measures visits, broad page categories and selected actions such as opening appointment or contact links. Google receives technical browser and device information and cookie identifiers; your browser connects to Google, which receives your IP address. Analytics cookies (_ga and _ga_*) are configured to expire after one year. Your analytics choice is stored for up to six months and can be changed or withdrawn using “Analytics settings” in the footer. Declining keeps Google Analytics off. Withdrawal stops future measurement and removes Analytics cookies from this website. Names, contact details, form contents, URL queries and fragments are not included in the custom events; clinical content URLs are grouped into broad categories. Advertising storage, advertising personalisation and Google Signals are disabled. Google may process data outside the UK under its applicable data-protection terms. See Google’s Privacy Policy. This analytics choice is independent of Website preferences.

This website does not use Meta Pixel, remarketing or advertising cookies.

Fonts

Some pages load fonts from Google Fonts. When that happens, your browser connects to Google to request the font files and sends technical information, including your IP address. Other fonts are served with the website files.

Messages and optional updates

Contact, email, WhatsApp and Notes

If you use the website contact form, odNOVA receives the name, contact details, referral source (if you choose to provide it) and message you submit so that Piotr can review and respond to your enquiry. Where you ask odNOVA to take steps before booking or receiving a service, the legal basis is taking steps at your request before a contract. For other enquiries, the basis is odNOVA’s legitimate interest in receiving and responding to genuine messages.

The form is protected by Cloudflare Turnstile, processed through Cloudflare Pages and delivered to odNOVA’s email account by Resend. Resend accepting a message means that it has accepted it for delivery; it does not guarantee final inbox delivery. The website does not keep a separate copy if delivery fails, and the form then shows direct email and telephone alternatives.

The contact form is text only. It does not accept photographs or documents. Please do not include medical records, medicine lists or identity-document information in the message. If sensitive information is included anyway, it will be used only as far as necessary to handle the enquiry and direct you to an appropriate clinical or secure route. It is not treated as a substitute for clinical assessment. If images would be useful, Piotr will explain in his reply how to share them securely.

The contact form is not an emergency service and is not a consultation. It cannot provide a diagnosis or replace an appropriate clinical assessment. Resend is used to deliver the message to odNOVA’s Google Workspace email account. Resend processes the message and delivery data, including in the United States, under its Data Processing Addendum.

If you contact odNOVA directly by email or WhatsApp, odNOVA receives the contact details and message you choose to send. Email is provided through Google Workspace. WhatsApp is a separate service and its own privacy terms apply. Sending an enquiry does not add you to a mailing list.

Notes from odNOVA is an optional newsletter. The legal basis is your consent, and the electronic-marketing rules also require that choice. If you choose to sign up, the first name and email address you provide are sent to Mailchimp in the United States before confirmation. Mailchimp sends a confirmation message before the subscription is completed. You can choose not to confirm, withdraw consent and unsubscribe at any time using the link in an email.

External booking

Appointments and AesthetiDocs

Appointment booking and pre-consultation forms are handled through AesthetiDocs, an external service.

Information entered there may include contact details, appointment information, health information, consent records, photographs, deposits and payment information. It is made available to odNOVA where needed to manage your appointment and care. AesthetiDocs also processes information to operate and secure its platform.

The AesthetiDocs booking service currently uses session and security cookies, a longer-lived browser or device identifier, Mixpanel and Google Analytics. Its privacy, cookie and platform terms apply when you open that service.

You can read the AesthetiDocs privacy information before using the booking service. It describes AesthetiDocs’s own handling of information and does not replace odNOVA’s separate privacy information.

Care records

Clinical information and photographs

The website contact form is text only and does not accept clinical photographs or documents. Where clinical information or photographs are needed, Piotr will explain the appropriate clinical or secure route.

Clinical information may be recorded where it is needed to assess suitability, plan or provide care, document consent, or follow up an appointment. Ordinary appointment and treatment administration relies on taking steps at your request and providing the agreed service. Legal and professional record-keeping duties may also apply. Where health information is necessary for assessment or care, odNOVA relies on the health or social care condition in Article 9(2)(h) UK GDPR and the corresponding condition in Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018. This processing is carried out by Piotr within his professional competence and duty of confidentiality.

Clinical photographs may be taken where appropriate as part of the clinical record. Consent to publish or use an identifiable photograph publicly is separate and optional. It is not a condition of treatment.

Purpose and basis

Why information is used

Depending on how you choose to interact with odNOVA, information is used to:

• deliver and protect this website;
• read and respond to a message you send;
• send the optional Notes newsletter after you confirm your subscription;
• arrange and administer appointments;
• assess suitability, provide care and maintain an appropriate clinical record;
• process deposits and payments;
• investigate and respond to concerns or complaints; and
• meet legal, regulatory and professional responsibilities.

The legal bases depend on the purpose of processing:

• website delivery, security, Turnstile and aggregate performance measurement: legitimate interests in operating, protecting and improving the website;
• Contact enquiries: steps requested before a contract where applicable, otherwise legitimate interests in responding to genuine enquiries;
• Notes: consent, supported by Mailchimp double opt-in;
• appointments and treatment administration: steps requested before a contract and performance of the agreed service;
• clinical records: performance of the service and compliance with legal or professional duties, together with Article 9(2)(h) UK GDPR and Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018 for necessary health information; and
• complaints, regulation, insurance and legal claims: legal obligations or legitimate interests, with the separate special-category condition for legal claims where it is needed.

The main website does not make solely automated decisions about you and does not profile you.

Recipients

Sharing information and overseas processing

odNOVA does not sell personal information.

Information is shared only where needed to operate the website, communications, booking, clinical records and payments, or where disclosure is required by law. Depending on the route you choose, relevant providers may include:

• Cloudflare for website delivery, form processing and security;
• Resend for delivery of website contact enquiries;
• Mailchimp for the optional Notes mailing list and confirmation emails;
• Google for email and, on pages that request them, Google Fonts;
• WhatsApp for messages sent through that service;
• AesthetiDocs and providers used within its booking and payment service; and
• professional advisers, regulators, courts or public authorities where disclosure is necessary or legally required.

Cloudflare, Resend and Mailchimp may process information outside the UK, including in the United States. For restricted transfers, their data-processing terms incorporate the European Commission’s standard contractual clauses as amended by the UK International Data Transfer Addendum. Copies and current details are available in the Cloudflare Data Processing Addendum, Resend Data Processing Addendum and Mailchimp Data Processing Addendum. You may also ask odNOVA for information about the safeguards that apply to your information.

Record keeping

How long information is kept

Session storage normally lasts for the browser session. Your website-preferences choice is remembered for up to 180 days. If persistent storage is unavailable, the site tries session storage instead; if neither is available, the choice lasts only for the current page.

Optional Notes records are removed when you withdraw permission, or when the site next checks an expired or outdated preference choice. You can also clear them through your browser. Clearing or refusing website preferences does not unsubscribe you from Notes.

With permission, the first automatic invitation is considered after five minutes and a second on the third visit if the first was dismissed. After the second invitation, there is a 180-day pause. The preference choice can expire before that pause ends; if you later allow preferences again, the invitation cycle starts again. An accepted signup request suppresses invitations while its permitted preference record remains.

Clinical records, consent records and clinical photographs are kept electronically for eight years after your last appointment with odNOVA. The period is measured from your most recent appointment, not from each individual entry. After that, the information is securely deleted or anonymised unless it needs to be kept for longer because of a legal, regulatory, professional or insurance requirement, or an active complaint or legal claim.

A Contact enquiry that does not become part of a clinical relationship is normally kept for up to 24 months after the last correspondence. It may be kept for longer where it is needed for a complaint, legal claim, insurance matter or legal or regulatory duty. If information becomes part of the clinical record, the clinical-record period above applies instead.

Notes details are kept while you remain subscribed. If you do not confirm or you unsubscribe, Mailchimp may retain the minimum status information needed to honour the pending, unsubscribe or suppression choice and prevent unwanted messages.

Cloudflare keeps service and security information according to the periods needed to provide and protect its services. Resend processes a Contact message for delivery, and the delivered copy is then held in odNOVA’s Google Workspace account under the Contact or clinical-record period that applies.

AesthetiDocs applies the retention criteria described in its own privacy notice to information it handles on its platform.

Your choices

Your data protection rights

Depending on why and how your information is used, you may have rights to ask for access, correction, erasure, restriction or portability, or to object to certain processing. Where processing relies on consent, you may withdraw that consent.

To make a request, email contact@odnovaaesthetics.com. You may also complain to the Information Commissioner’s Office. Current information about doing so is available on the ICO website.

This policy will be updated when the way information is handled changes.