Privacy Policy

Last updated: 28 September 2026

Aesthetic Plastic Surgery Ltd is committed to protecting the privacy of our patients and of everyone who visits our websites. This policy explains what personal data we collect, why we collect it, how we look after it and the rights you have.

It applies to this website (allaboutcosmeticsurgery.co.uk), to our other websites (lucianion.co.uk and aesthetic-plastic-surgery.co.uk), and to the information we hold when you contact us, attend a consultation or have treatment with us.

Our promises

• Care first: we only use your health information to look after you safely.
• No selling: we never sell your personal data.
• No marketing from health data: we never use your health information for marketing.

Who we are

Aesthetic Plastic Surgery Ltd is the "controller" of your personal data. We are registered in England and Wales (company number 04412624) and our clinic is run by Mr Lucian Ion, Consultant Plastic Surgeon.

Aesthetic Plastic Surgery Ltd
Aveling House
1B Upper Wimpole Street
London W1G 6AB
Telephone: 020 7486 7757
E-mail: contact@aps.london

For any question about your personal data, you can contact our Data Protection Officer at contact@aps.london or at the address above.

The personal data we collect

When you contact us by telephone, e-mail or message: your name, contact details and what you tell us about your enquiry. This can include information about your health if you choose to share it.

When you send a question for our Questions & Answers pages: your question, name and e-mail address. We use your contact details only to reply to you. If we publish a question and its answer, we do so without your name or contact details.

When you complete a patient survey: your answers and, if you give them, your name and e-mail address.

When you become a patient: your identity and contact details, date of birth, GP details, medical history, consultation notes, clinical photographs, treatment and aftercare records, correspondence and payment details.

When you visit our website:

• our web hosting company automatically records technical information for security and to keep the site working: your IP address, the type of browser and device you use, the pages you request and the date and time. These records are kept for a short period and are not used to identify you;
• only if you accept analytics cookies, we use Google Analytics to understand how visitors use the site (see our Cookie Policy).

When you visit our clinic: we may operate CCTV for the safety and security of patients and staff.

Why we use your data and our legal basis

Data protection law requires us to have a legal basis for each use of your personal data.

• To answer your enquiry and arrange a consultation: to take steps you have asked for before entering into a contract with us, and our legitimate interest in responding to people who contact us.
• To provide your consultation, treatment and aftercare: to perform our contract with you. Your health information is "special category data"; we use it because it is necessary for the provision of health care by, or under the responsibility of, a health professional (UK GDPR Article 9(2)(h) and the Data Protection Act 2018, Schedule 1, paragraph 2).
• Clinical photographs: we take photographs as part of your medical record. We will only show them to others (for example in our before-and-after galleries, with identifying features hidden) with your explicit written consent, which you can withdraw at any time.
• To take payment, keep accounts and meet regulatory duties (for example to the Care Quality Commission, the General Medical Council and HM Revenue & Customs): to comply with our legal obligations.
• To keep our website secure and working: our legitimate interest in running a safe website.
• Website analytics: your consent, which you give or refuse through our cookie banner.
• News or information about our services: only with your consent. You can unsubscribe at any time.

We do not make decisions about you based solely on automated processing.

Who we share your data with

We only share what is needed, and only for the purposes above:

• people involved in your care, such as the hospitals where you are treated, anaesthetists, other doctors and nurses, laboratories and, with your agreement, your GP;
• the Breast and Cosmetic Implant Registry (run by NHS England): if you have breast implant surgery, we send details of your operation and implants to the registry for your long-term safety, so that you can be traced and contacted if a safety concern is found with an implant. Consent is not required for this in England, but we will not include your details if you tell us you do not want them included;
• service providers who work on our behalf, such as our IT, e-mail, website hosting and payment providers, and professional advisers and insurers. They may only use your data to provide their service to us;
• regulators, the police or courts, where the law requires us to.

International transfers

Some of our service providers (for example e-mail and analytics services) may store or process data outside the UK. When this happens we make sure your data is protected, for example by using countries the UK considers adequate (including the UK–US "data bridge") or the UK's approved data transfer agreements.

How long we keep your data

We keep personal data only as long as we need it:

• medical records, including clinical photographs: in line with the Records Management Code of Practice for Health and Social Care, normally at least 8 years after your last treatment for adults, and longer where there is a clinical or legal reason (for example after implant surgery);
• financial records: 6 years after the end of the financial year they relate to;
• enquiries that do not lead to a consultation: deleted 2 years after we last hear from you;
• published questions and answers: kept on the website without your name or contact details.

After these periods we securely delete or anonymise the data.

How we protect your data

We use appropriate technical and organisational measures to protect your data from loss, misuse and unauthorised access. Access to medical records is limited to the people who need it to look after you.

Your rights

You have the right to:

• access the personal data we hold about you (a "subject access request");
• have inaccurate data corrected;
• ask us to delete your data or restrict how we use it;
• object to how we use your data, including for direct marketing (we will always stop direct marketing if you ask);
• ask for data you gave us to be transferred to you or another organisation;
• withdraw your consent at any time, where we rely on consent (this does not affect anything we did before you withdrew it).

Some rights have exceptions. For example, we must keep medical records for the periods above even if you ask us to delete them. We will explain if an exception applies.

To use any of these rights, contact us using the details in Who we are. It is free, and we will normally respond within one month.

Complaints

If you are unhappy with how we have handled your personal data, please tell us first using the details in Who we are. We will acknowledge your complaint within 30 days and let you know the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.

Children

Our services and website are intended for adults aged 18 and over.

Links to other websites

Our website links to other websites, such as hospitals and professional bodies. We are not responsible for their privacy practices, so please read their privacy policies.

Changes to this policy

We review this policy regularly. The date at the top shows when it was last updated.