Privacy Policy

At Tajmeel by Amna, we respect your privacy and are committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store and protect your personal information when you visit our website, contact us, book an appointment, attend a consultation, receive a treatment, purchase a product or service, communicate with us or otherwise interact with Tajmeel by Amna.

We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation, the Data Protection Act 2018 and other applicable privacy and electronic communications legislation, as amended from time to time.

1 Who We Are

For the purposes of applicable data protection law, Tajmeel by Amna is the controller of the personal information described in this Privacy Policy unless we tell you otherwise. Our contact details are:

If you have any questions about this Privacy Policy or how we use your personal information, please contact us using the details above.

2 Personal Information We May Collect

The information we collect depends on how you interact with us. We may collect the following categories of personal information.

Identity Information

• full name;
• date of birth;
• age;
• gender where relevant to treatment;
• photographic identification where required;
• signature; and
• other information required to verify your identity or suitability for a service.

Contact Information

• home or correspondence address;
• email address;
• telephone number;
• emergency contact details; and
• communication preferences.

Appointment and Booking Information

• appointment dates and times;
• treatments booked;
• consultation history;
• cancellations;
• rescheduled appointments;
• deposits;
• booking notes; and
• attendance history.

Health and Medical Information

Because we provide aesthetic and beauty treatments, we may need to collect information relating to your health. This may include:

• medical history;
• existing medical conditions;
• allergies;
• medications;
• previous procedures or treatments;
• previous reactions or complications;
• pregnancy or breastfeeding information where relevant;
• skin conditions;
• infections;
• information concerning treatment suitability;
• treatment contraindications;
• information provided during consultations; and
• other health information reasonably necessary to provide treatment safely.

Health information is treated as particularly sensitive personal information and is given additional protection.

Treatment Information

We may collect and maintain records relating to your treatments, including:

• consultation notes;
• consent records;
• treatment plans;
• products used;
• quantities administered;
• treatment locations;
• batch or product information where appropriate;
• practitioner notes;
• treatment dates;
• aftercare advice;
• follow-up information;
• treatment outcomes; and
• details of any adverse reactions or complications.

Photographs and Videos

Where appropriate, we may take photographs before, during or after a treatment for purposes such as:

• clinical assessment;
• monitoring treatment progress;
• maintaining treatment records; and
• comparing results.

Where we wish to use photographs or videos for advertising, our website, social media, educational content or other promotional purposes, we will obtain separate permission where required. Refusing consent for promotional photography will not prevent you from receiving treatment.

Payment and Transaction Information

• amounts paid;
• deposits;
• refunds;
• transaction dates;
• payment method;
• invoices;
• receipts; and
• transaction references.

Payments and deposits are taken through our booking system, Setmore, using its secure payment processing partner. Your full card details are handled by that payment processor and are not stored by Tajmeel by Amna. The payment processor handles your card or banking information in accordance with its own privacy obligations.

Communications

We may retain communications between you and Tajmeel by Amna, including:

• emails;
• telephone enquiries;
• text messages;
• website enquiries;
• appointment messages;
• complaints;
• feedback;
• social media messages; and
• other correspondence.

Website and Technical Information

When you use our website, certain technical information may be collected automatically. This may include:

• IP address;
• browser type;
• device type;
• operating system;
• approximate location derived from technical information;
• pages visited;
• time spent on pages;
• referring website;
• website interaction information; and
• cookie or similar technology information.

Further information is provided in our Cookie Policy.

Marketing Information

We may record:

• whether you have agreed to receive marketing;
• your communication preferences;
• newsletters you receive;
• whether marketing communications are opened or interacted with where our systems provide this functionality; and
• when you unsubscribe or object to marketing.

3 How We Collect Your Information

We may collect information directly from you when you:

• visit our website;
• submit an enquiry;
• telephone or email us;
• complete an online form;
• book an appointment;
• pay a deposit;
• purchase a treatment or product;
• complete a consultation form;
• provide your medical history;
• provide treatment consent;
• attend the clinic;
• communicate with a practitioner;
• submit photographs;
• subscribe to marketing;
• participate in a promotion;
• leave feedback or a review; or
• make a complaint.

We may also receive information from third parties where appropriate, including:

• booking platforms;
• payment providers;
• healthcare professionals;
• prescribers;
• pharmacies;
• practitioners working with us;
• referral partners;
• technology providers; and
• other organisations where you have authorised or reasonably expected information to be shared.

4 Why We Use Your Personal Information

We only process personal information where we have an appropriate legal reason for doing so. Depending on the circumstances, we may use your information to:

• respond to enquiries;
• arrange consultations;
• manage appointments;
• confirm or change bookings;
• assess treatment suitability;
• provide treatments and services;
• maintain appropriate treatment records;
• obtain and document informed consent;
• provide pre-treatment and aftercare information;
• monitor treatment outcomes;
• respond to complications or adverse events;
• contact you where follow-up is clinically appropriate;
• process payments and refunds;
• issue invoices and receipts;
• administer packages and courses;
• manage our relationship with you;
• handle complaints;
• establish, exercise or defend legal claims;
• comply with legal, regulatory, insurance or professional obligations;
• prevent fraud or misuse of our services;
• maintain the security of our website and systems;
• improve our services;
• administer our website;
• send marketing where permitted;
• maintain marketing suppression lists; and
• protect the rights, property and safety of our clients, staff, practitioners and business.

5 Our Lawful Bases for Processing

The lawful basis we rely upon depends on why the information is being processed. These may include:

Contract

We may process information where it is necessary to take steps at your request before entering into a contract or to perform our agreement with you. For example, this may apply when:

• arranging an appointment;
• providing a purchased service;
• taking payment; or
• administering a treatment package.

Legal Obligation

We may process information where necessary to comply with a legal or regulatory obligation that applies to us.

Legitimate Interests

We may process information where it is necessary for our legitimate business interests and those interests are not overridden by your rights and interests. Examples may include:

• running and improving our business;
• maintaining appropriate business records;
• preventing fraud;
• protecting our systems;
• dealing with complaints;
• pursuing or defending legal claims; and
• maintaining records of marketing objections.

Where we rely on legitimate interests, we consider the impact of the processing on your privacy.

Consent

In some circumstances, we rely on your consent. Examples may include:

• certain marketing communications;
• promotional use of photographs or videos; and
• specific uses of sensitive personal information where explicit consent is the appropriate legal condition.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not make processing carried out before withdrawal unlawful.

6 Health and Other Special Category Information

Information concerning your health is classified as special category personal data and receives additional legal protection. We only process this type of information where we have both:

• an appropriate lawful basis for processing personal information; and
• an additional legal condition permitting the use of special category information.

Depending on the circumstances and the nature of the service being provided, this may include explicit consent or another condition permitted by data protection law relating to the provision or management of health-related services.

We collect only the health information reasonably necessary for purposes such as:

• assessing treatment suitability;
• identifying contraindications;
• reducing treatment risks;
• documenting consent;
• providing treatment safely;
• maintaining appropriate treatment records;
• managing adverse reactions; and
• fulfilling relevant legal, professional or insurance obligations.

We do not use sensitive health information for unrelated purposes without an appropriate legal basis.

7 Treatment Records

We maintain treatment and consultation records where reasonably necessary for safe and appropriate service provision.

These records may include consultation forms, consent forms, health information, products used, treatment notes, photographs and follow-up information.

Access to treatment records is restricted to individuals who reasonably require access for their role or another lawful purpose.

8 Before and After Photographs

Clinical photographs may form part of your treatment record where appropriate.

Clinical photographs are not automatically authorised for promotional use.

Where we wish to use identifiable photographs or videos for purposes such as:

• our website;
• Instagram or other social media;
• advertisements;
• promotional materials;
• educational materials; or
• marketing campaigns,

we will obtain appropriate permission before doing so where required.

Where promotional use relies on consent, you may withdraw that consent for future use by contacting us. Withdrawal of consent does not affect processing that was lawful before consent was withdrawn.

9 Marketing Communications

We may send information about:

• new treatments;
• clinic news;
• promotions;
• offers;
• events;
• availability; and
• other services we believe may be relevant to you.

We will only send electronic marketing where we have an appropriate legal basis and where applicable electronic marketing rules allow us to do so.

You can stop receiving marketing communications at any time by:

• using the unsubscribe option contained in a marketing communication; or
• contacting us at info@byamna.co.uk.

Stopping marketing communications will not prevent us from contacting you about appointments, treatments, payments, safety information or other non-marketing matters relating to our relationship with you.

You have the right to object to the use of your personal information for direct marketing at any time. If you object, we will stop using your personal information for that purpose. We may retain limited information on a suppression list so that we can remember your request and avoid contacting you for marketing again.

10 Cookies and Website Technologies

Our website may use cookies and similar technologies. These may be used for purposes including:

• essential website functions;
• security;
• remembering preferences;
• website performance;
• analytics; and
• understanding how visitors use our website.

Where applicable law requires consent before a particular cookie or technology is used, we will request that consent. You can manage available cookie preferences through the controls provided on our website.

Please see our separate Cookie Policy for further information.

11 Who We May Share Your Information With

We do not disclose personal information unnecessarily, and we do not sell your personal information. Where necessary and legally permitted, information may be shared with organisations or individuals including:

• practitioners providing services through or on behalf of Tajmeel by Amna;
• healthcare professionals;
• prescribers;
• pharmacies;
• payment processors;
• appointment and booking system providers;
• website and hosting providers;
• email and communication providers;
• IT and cloud service providers;
• professional advisers;
• accountants;
• lawyers;
• insurers;
• regulatory or professional bodies;
• product manufacturers where necessary in connection with an adverse event or safety matter;
• law enforcement agencies;
• courts; and
• government authorities where disclosure is legally required.

Our Main Service Providers

Service providers acting on our behalf are only permitted to use personal information for the purposes for which it has been provided and must handle it appropriately.

We may also disclose information where necessary to establish, exercise or defend legal claims or protect a person's vital interests.

12 Sharing Information With Practitioners

Where a practitioner requires access to information in order to provide your consultation, treatment or aftercare, relevant information may be made available to that practitioner.

Practitioners are expected to maintain confidentiality and comply with applicable privacy, professional and legal obligations.

In some circumstances, a practitioner or other healthcare professional may process certain information as a separate data controller. Where this applies, they may provide additional privacy information explaining their responsibilities.

13 International Transfers

Some of the companies that provide website, communications, booking, payment, cloud or other technology services to us may process information outside the United Kingdom.

Where personal information is transferred internationally and UK data protection law requires additional protection, we take reasonable steps to ensure an appropriate transfer mechanism is in place. This may include:

• a country covered by UK adequacy regulations;
• approved contractual safeguards; or
• another transfer mechanism permitted by applicable data protection law.

14 How Long We Keep Personal Information

We do not keep personal information for longer than reasonably necessary for the purpose for which it was collected. The period for which information is retained depends on matters including:

• the nature of the information;
• the treatment or service provided;
• clinical or treatment-record requirements;
• applicable law;
• tax and accounting requirements;
• insurance requirements;
• professional guidance;
• limitation periods for potential legal claims;
• complaints;
• safeguarding or safety considerations; and
• the reason the information was originally collected.

Clinical and treatment records may need to be retained after your final appointment where this is necessary for professional, legal, safety or insurance purposes.

Financial and transaction information is retained for periods necessary to comply with accounting, taxation and other legal obligations.

Where information is no longer required, we will delete, anonymise or securely dispose of it where reasonably practicable.

15 Security

We take appropriate technical and organisational measures designed to protect personal information against:

• unauthorised access;
• accidental loss;
• alteration;
• misuse;
• destruction; and
• unauthorised disclosure.

Measures may include:

• access controls;
• passwords and authentication;
• secure systems;
• restricted access to clinical information;
• appropriate staff and practitioner confidentiality obligations;
• secure storage; and
• appropriate service-provider arrangements.

No internet or electronic storage system can be guaranteed to be completely secure. However, we take reasonable measures appropriate to the nature of the information we process.

16 Data Breaches

If a personal data breach occurs, we will assess the nature and potential consequences of the breach.

Where legally required, we will report a qualifying breach to the appropriate supervisory authority.

Where a breach is likely to result in a high risk to an individual's rights and freedoms and notification is legally required, we will also inform affected individuals without undue delay.

17 Your Data Protection Rights

Depending on the circumstances, you may have rights in relation to your personal information. These may include the following.

Right to Be Informed

You have the right to receive information about how your personal information is collected and used.

Right of Access

You may request confirmation of whether we process your personal information and request a copy of personal information we hold about you.

Right to Rectification

You may ask us to correct inaccurate information or complete information that is incomplete.

Right to Erasure

In certain circumstances, you may ask us to erase your personal information. This right is not absolute. We may need to retain information where there is a lawful reason to do so, including legal, regulatory, professional, insurance or legal-claims requirements.

Right to Restrict Processing

In certain circumstances, you may ask us to restrict the way in which we use your information.

Right to Data Portability

Where the legal requirements for data portability are met, you may have the right to receive certain information in a structured, commonly used and machine-readable format or request that it be transferred to another organisation.

Right to Object

You may have the right to object to processing based on legitimate interests. You also have an absolute right to object to processing for direct marketing purposes.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Rights Concerning Automated Decisions

Where applicable, you may have rights relating to decisions made solely through automated processing that produce legal or similarly significant effects.

Unless we tell you otherwise, Tajmeel by Amna does not use solely automated decision-making to make treatment decisions that have legal or similarly significant effects on you.

18 Exercising Your Rights

To exercise a data protection right, contact us at:

We may need to request additional information to confirm your identity before responding to a request.

We will respond within the timeframe required by applicable data protection law. This is normally within one month of receiving your request, although this may be extended where a request is complex or you make a number of requests. If an extension is needed, we will tell you within the first month.

There is usually no charge for making a request. We may charge a reasonable fee, or refuse to act, where a request is manifestly unfounded or excessive, as permitted by law.

Some rights are subject to conditions and exemptions, so we may not always be required to comply with a request in full. Where we cannot comply with a request, we will explain the reason where required by law.

19 Data Protection Complaints

If you are concerned about how Tajmeel by Amna has collected, used, stored or shared your personal information, please contact us in the first instance at info@byamna.co.uk.

We will provide a way for you to raise a data protection complaint. We will acknowledge receipt of a data protection complaint within the period required by applicable law, currently no later than 30 days after receipt, and will take appropriate steps to investigate the complaint without undue delay.

We will keep you appropriately informed and communicate the outcome of our investigation.

You also have the right to raise a concern or complaint with the Information Commissioner's Office (ICO), the UK's data protection supervisory authority:

Your right to contact the ICO is not affected by our internal complaints process.

20 Children

Our aesthetic services are primarily intended for adults. In line with UK law, we do not provide anti-wrinkle or dermal filler injections to anyone under the age of 18, for cosmetic purposes.

Where we lawfully collect information relating to a person under the age of 18, we take additional care when deciding how that information should be collected, used and protected. Where appropriate, we may also need to collect details relating to a parent, guardian or person with parental responsibility.

Any age restrictions applicable to particular treatments continue to apply regardless of the processing of personal information.

21 Social Media

If you communicate with us through a social media platform, the platform may independently collect and process information about you. Your use of those platforms is also governed by the privacy practices of the relevant platform.

Information you make publicly available through social media may be visible to other users.

Please avoid sending sensitive medical information through public comments or other publicly visible channels.

22 External Links

Our website may contain links to websites operated by third parties. Tajmeel by Amna is not responsible for the privacy practices of independent third-party websites.

We recommend reviewing the privacy information provided by any third-party website before submitting personal information.

23 Sale or Reorganisation of the Business

If Tajmeel by Amna or relevant parts of the business are sold, transferred, merged or reorganised, personal information may need to be disclosed to professional advisers, prospective purchasers or the acquiring organisation where legally permitted.

Any such information must continue to be handled in accordance with applicable data protection law.

24 Legal Claims and Regulatory Matters

We may retain or disclose relevant information where reasonably necessary to:

• obtain legal advice;
• establish a legal claim;
• exercise legal rights;
• defend a legal claim;
• respond to an insurer;
• comply with a court order;
• respond to a regulator; or
• comply with another legal requirement.

25 Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to our services;
• changes to our systems or service providers;
• changes to how we use information;
• changes to our business; or
• changes to applicable law or regulatory guidance.

The latest version will be published on our website. Where a significant change materially affects how we use your personal information, we will take appropriate steps to bring the change to your attention where required.

26 Contact Us

If you have questions about this Privacy Policy, wish to exercise a data protection right or wish to make a data protection complaint, please contact:

Last updated: 18 August 2026