How we collect, use, and protect your personal data — including your health information — in full compliance with UK GDPR and the Data Protection Act 2018.
This Privacy Policy is issued by Calviera Medical Holding LTD, trading as Dr. Katie Calvo (referred to throughout as “we”, “us”, or “our”). We operate the website drkatiecalvo.com and provide aesthetic medicine consultations and treatments.
| Data Controller | Details |
|---|---|
| Trading Name | Dr. Katie Calvo |
| Legal Entity | Calviera Medical Holding LTD |
| Companies House Number | 15714954 |
| Registered Address | 167–169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom |
| info@drkatiecalvo.com | |
| Telephone | 07561 598 076 |
| Website | www.drkatiecalvo.com |
| ICO Registration | Pending registration prior to commencement of operations |
Dr. Katie Calvo is a GMC-registered aesthetic medicine physician (GMC registration details available on the General Medical Council public register at www.gmc-uk.org). We provide in-person aesthetic medicine consultations and treatments in London.
We collect and process different categories of personal data depending on your relationship with us. The categories we collect are described below.
As an aesthetic medicine practice, we process health data which is classified as “special category data” under UK GDPR. This includes:
We do not collect any data about your racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or criminal convictions, except where this is directly relevant to your treatment (for example, certain skin conditions or medications that have clinical relevance to your aesthetic care).
The table below sets out the purposes for which we process your personal data, our lawful basis under UK GDPR, and how long we retain it. We will not use your personal data in any manner incompatible with these stated purposes.
| Purpose of Processing | Lawful Basis (UK GDPR) | Retention Period |
|---|---|---|
| To respond to enquiries and book consultations | Legitimate interests (Art. 6(1)(f)) — necessary to manage our business and serve prospective patients | 2 years from last contact if no treatment proceeds |
| To provide aesthetic medicine consultations and treatments | Contract performance (Art. 6(1)(b)) and, for health data, explicit consent (Art. 9(2)(a)) and healthcare provision (Art. 9(2)(h)) | Minimum 8 years from last treatment; photographs retained for clinical comparison |
| To obtain and record your informed consent to treatment | Legal obligation (Art. 6(1)(c)) and explicit consent (Art. 9(2)(a)) | 8 years from date of consent |
| To process payments and manage accounts | Contract performance (Art. 6(1)(b)) and legal obligation for financial records (Art. 6(1)(c)) | 7 years (HMRC requirements) |
| To send appointment confirmations, reminders, and follow-up | Contract performance (Art. 6(1)(b)) and legitimate interests | Duration of patient relationship |
| To comply with legal and regulatory obligations (GMC, CQC, MHRA) | Legal obligation (Art. 6(1)(c)) | As required by applicable regulations |
| To send marketing communications | Consent (Art. 6(1)(a)) — you may withdraw at any time | Until you withdraw consent or unsubscribe |
| To manage and improve our website and services | Legitimate interests (Art. 6(1)(f)) | Up to 24 months for analytics data |
| To handle complaints and legal claims | Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)) | 6 years from resolution (Limitation Act 1980) |
| To request and manage patient reviews on Trustpilot | Legitimate interests (Art. 6(1)(f)) — reputation management | Duration of our Trustpilot account |
Where we rely on consent as our lawful basis, you have the right to withdraw your consent at any time by contacting us at info@drkatiecalvo.com. Withdrawal of consent will not affect the lawfulness of any processing carried out before withdrawal.
We process special category data (health information) in connection with the provision of aesthetic medicine services. This is inherent to our clinical practice. We process such data on the following grounds under UK GDPR Article 9:
All clinical staff who access your health information are bound by duties of professional confidentiality. We maintain strict access controls to ensure that only those who need to see your health information for the purposes of your care can access it.
Clinical photographs are taken solely for the purpose of treatment assessment and record-keeping. You will be asked for explicit consent before any photographs are taken. Photographs will not be shared externally without your separate, specific written consent.
We will only share your personal data where it is necessary, lawful, and appropriate to do so. We do not sell your personal data. The categories of recipients with whom we may share your data are as follows:
We work with a small number of trusted third-party service providers who process personal data on our behalf, under written data processing agreements that require them to maintain appropriate security and to process data only on our instructions. These include:
Where clinically necessary or where you have requested it, we may share relevant clinical information with other healthcare professionals involved in your care, such as your GP. We will always seek your consent before doing so unless disclosure is required in an emergency or by law.
In the event that we sell or transfer all or part of our business, your personal data may be transferred to the acquiring entity. We will notify you in advance of any such transfer and your data will remain subject to appropriate protections.
We aim to keep your personal data within the United Kingdom or the European Economic Area. Where any of our service providers process data outside of these areas, we ensure that appropriate safeguards are in place, such as:
If you would like further information about international transfers or the safeguards we rely upon, please contact us at info@drkatiecalvo.com.
We take the security of your personal data — and particularly your health data — very seriously. We have implemented appropriate technical and organisational measures to protect your information against unauthorised access, loss, destruction, or alteration, including:
Despite these measures, no method of transmission over the internet or electronic storage is 100% secure. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately at info@drkatiecalvo.com.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of it, and will notify you directly where the breach is likely to result in a high risk to you.
We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by law. Our key retention periods are:
| Category of Data | Retention Period |
|---|---|
| Clinical treatment records and consent forms | Minimum 8 years from the date of last treatment (or until age 25 if the patient was a minor when treated, whichever is longer) |
| Clinical photographs | Retained as part of the clinical record — minimum 8 years. If consent is withdrawn for clinical use, photographs are deleted unless retention is required for legal reasons |
| Financial and invoicing records | 7 years from the end of the relevant tax year (HMRC requirement) |
| Enquiries that did not progress to treatment | 2 years from date of last contact |
| Marketing consent records | Until consent is withdrawn, then archived for 3 years as evidence of consent/withdrawal |
| Complaint and legal claim correspondence | 6 years from resolution (Limitation Act 1980) |
| Website analytics data | Up to 24 months |
Our website uses cookies and similar technologies to improve your experience and to help us understand how visitors use our site. A cookie is a small text file placed on your device when you visit a website. For full details, see our Cookie Policy.
When you first visit our website, you will be presented with a cookie consent banner allowing you to accept or decline non-essential cookies. You can change your preferences at any time by clearing your browser cookies and revisiting our site, or by adjusting your browser settings. Please note that disabling certain cookies may affect the functionality of our website.
As a data subject, you have the following rights in relation to your personal data. We will respond to all valid requests within one calendar month of receipt, unless the request is complex or you have made multiple requests, in which case we may extend this by a further two months (we will notify you if this applies).
| Your Right | What It Means |
|---|---|
| Right of Access | You may request a copy of all personal data we hold about you (a Subject Access Request). This is free of charge. |
| Right to Rectification | You may ask us to correct inaccurate or incomplete personal data we hold about you. |
| Right to Erasure | You may ask us to delete your personal data in certain circumstances. Note that we may be legally required to retain certain records (particularly clinical records) regardless of this request. |
| Right to Restriction | You may ask us to restrict the processing of your data in certain circumstances (e.g. if you contest the accuracy of the data, while we verify it). |
| Right to Data Portability | Where we process your data by automated means on the basis of consent or contract, you may request that we provide it to you, or transfer it directly to another controller, in a structured, commonly used, machine-readable format. |
| Right to Object | You have an absolute right to object to processing of your data for direct marketing purposes. You may also object to processing based on legitimate interests, though we may be able to demonstrate compelling grounds to continue. |
| Rights re: Automated Decisions | You have the right not to be subject to decisions made solely by automated processing (including profiling) that produce legal or similarly significant effects on you. We do not make any such automated decisions about patients. |
To exercise any of your rights, please contact us in writing at info@drkatiecalvo.com or by post to 167–169 Great Portland Street, 5th Floor, London W1W 5PF. We may need to verify your identity before processing your request.
If you have any concerns about how we handle your personal data, please contact us in the first instance at info@drkatiecalvo.com. We take all complaints seriously and aim to resolve them promptly.
If you are not satisfied with our response, or if you believe we are processing your data unlawfully, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
Website: www.ico.org.uk · Telephone: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We will only send you marketing communications if you have provided your explicit consent to receive them. You can withdraw your consent at any time by:
Please allow up to 10 working days for your request to take effect. Withdrawing consent to marketing will not affect your ability to receive essential communications about appointments or treatments you have booked. We do not share your contact details with third parties for marketing purposes, and we will never sell your personal data.
Our services are provided to adults only. We do not knowingly collect or process personal data relating to individuals under the age of 18. If you believe we have inadvertently collected data about a minor, please contact us immediately at info@drkatiecalvo.com so that we may delete it.
Our website may contain links to third-party websites, social media profiles (such as Instagram @drkatiecalvo), and the Trustpilot review platform. This Privacy Policy applies solely to our website and services. We are not responsible for the privacy practices of third-party websites and encourage you to review their policies before providing any personal data.
We review this Privacy Policy periodically and will update it to reflect changes in the law, our data practices, or the services we offer. The current version and its effective date are shown at the top of this document.
If we make any significant changes, we will notify patients by email where we hold an email address for you. We encourage you to review this policy regularly. Continued use of our website or services after a policy update constitutes acceptance of the revised policy.
For any questions about this Privacy Policy or how we handle your personal data, please contact our Data Controller:
Last reviewed June 2026 · Next review due June 2027 · Version 1.0