Legal

Privacy policy

Last updated: 9 November 2026

I take your privacy as seriously as I take your care. This policy explains, in plain English, what personal information I collect through this website and when you become a patient, why I collect it, who I share it with, how long I keep it, and the rights you have over it.

In this policy, “I”, “me” and “my” mean Dr Natasha Murcott and Dr. N Murcott Ltd, the company through which she practises. “You” means anyone who uses this website, sends an enquiry or becomes a patient.

1. Who is responsible for your information

The data controller for the personal information described in this policy is:

Company: Dr. N Murcott Ltd, registered in England and Wales, company number 13715182
Registered office: 6 Parkside Court, Greenhough Road, Lichfield WS13 7AU
Privacy contact: dr.n.murcott@gmail.com

I am registered with the Information Commissioner’s Office (ICO) as a data controller.

I practise at clinics in Bath, Paddington and Lichfield. Where I see patients within another practice, some of your information may be shared with that practice, for example to arrange your appointment, and it may hold some information for its own purposes, such as its appointment diary or reception records.

This policy is written to meet the requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What information I collect

When you send an enquiry through this website

The enquiry form asks for:

your name
your email address
your preferred clinic
your question, in a free-text box

Some people use the free-text box to tell me about a concern, a previous treatment or a health matter. Anything you write there about your health counts as special category data under UK GDPR, and I treat it with extra care (see section 4). Please only share what you are comfortable sharing at this stage, and please do not include your detailed medical history. We can always talk about the rest in person.

When you book an appointment

Online booking is handled by my booking system, Clinic Membership (see section 5). When you book, it collects the details needed to arrange your appointment, such as your name, email address, phone number, the clinic and the appointment time. The consultation fee and treatment deposits are paid when you book, and your card may be saved securely in the booking system. Card payments are processed by Stripe.

When you become a patient

Safe aesthetic treatment depends on a full picture of your health. As part of your consultation and care I will collect and keep a clinical record, which may include:

your medical history, medications, allergies and relevant health conditions
notes from consultations and treatments, including the products used and batch numbers
clinical photographs, taken only with your consent
signed consent forms
aftercare advice given and any follow-up notes
correspondence with you about your care

Most of this is health information and is special category data.

You do not have to give me your medical history, but I need it to treat you safely. If you choose not to share it, I may not be able to offer you treatment.

Information I do not collect through this website

My own website pages do not use analytics or advertising trackers (see section 9 for cookies, including those set by the booking calendar). I do not knowingly collect information from anyone under 18, and I do not offer treatments or consultations to anyone under 18.

3. Why I use your information and my lawful basis

UK GDPR requires me to have a lawful basis for each way I use your information.

What I do	Lawful basis (Article 6 UK GDPR)
Reply to your enquiry and help you choose and book an appointment	Taking steps at your request before entering into a contract (Article 6(1)(b)), and my legitimate interest in responding to people who contact me (Article 6(1)(f))
Provide consultations, treatment and aftercare	Performance of a contract with you (Article 6(1)(b))
Keep clinical records for the required period	Compliance with a legal obligation where a law requires records to be kept (Article 6(1)(c)), and otherwise my legitimate interests in meeting professional record-keeping standards and being able to answer any later question or concern about your care (Article 6(1)(f))
Handle payments, invoices and accounting	Performance of a contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c))
Deal with complaints, claims and insurance	Legitimate interests in protecting patients and my practice (Article 6(1)(f)) and legal obligation (Article 6(1)(c))
Send you appointment reminders	Performance of a contract (Article 6(1)(b))

4. Health information (special category data)

Because health information is more sensitive, UK GDPR requires an additional condition under Article 9 before it can be used.

Health information you include in the enquiry form. I rely on your explicit consent (Article 9(2)(a) UK GDPR). Beside the submit button there is a tick box with a short consent statement (shown at the end of this policy). By ticking it, you agree to me using any health information you choose to include so that I can reply to your enquiry. You can withdraw that consent at any time by contacting me, and I will delete the health information from your enquiry unless you have since become a patient and it forms part of your clinical record.

Health information in your clinical record. I rely on Article 9(2)(h) UK GDPR (the provision of health care or treatment), together with the condition in paragraph 2 of Part 1 of Schedule 1 to the Data Protection Act 2018. This condition requires the information to be handled by, or under the responsibility of, a health professional who owes you a duty of confidentiality, and I handle it on that basis, as a dentist registered with the GDC (registration 265381).

Complaints and claims. If I need to use health information to deal with a complaint or a legal claim, I rely on Article 9(2)(f) UK GDPR (establishing, exercising or defending legal claims).

Clinical photographs are taken only with your consent for your clinical record. They will never be used on this website, on social media or anywhere public unless you have given separate, specific written consent, which you can withdraw at any time.

I never sell your information. I share it only where needed to run my practice and care for you. Most of the organisations below act on my instructions (processors) and are bound to keep it secure and confidential. Others, such as another clinician, an insurer or a regulator, make their own decisions about information they receive and have their own legal duties to protect it.

Website hosting and enquiry form handling: Netlify. Netlify hosts this website and receives the details you submit through the enquiry form before they are passed to me. Netlify is based in the United States, so your data may be processed outside the UK (see section 6).
Online booking: Clinic Membership. Clinic Membership runs my online booking calendar and holds booking and patient account details on my behalf. It has its own privacy and cookie policy at clinicmembership.co.uk/privacy.
Clinical notes and consent forms: Documenti. Documenti, a sister product of Clinic Membership, holds clinical notes, consent forms and treatment records.
Card payments: Stripe. Where a payment is taken online, it is processed by Stripe.
Email and messaging. Enquiries and correspondence are sent and received through Gmail (Google) and WhatsApp.
Cloud storage, such as iCloud or Google Drive, used securely to store practice documents.
My accountant, for invoices, payments and accounts.
Suppliers, such as skincare companies and pharmacies, where needed to supply a product or prescription for your care.
The clinics where I practise, where needed to arrange your appointment and care (see section 1).
Other professionals, such as your GP or another clinician, only where this is needed for your safety or care, and normally with your agreement.
Professional advisers, insurers and regulators, where needed to deal with a complaint, a claim or a regulatory requirement.
Other third parties, only where needed to run my practice or care for you, and under appropriate safeguards.
Anyone I am required by law to share information with, for example under a court order.

6. Information sent outside the UK

Some of the services listed above may store or process information outside the UK. Where this happens, I will make sure appropriate safeguards are in place as required by UK GDPR, such as an adequacy regulation or approved contractual terms. You can contact me for more details.

7. How long I keep your information

I keep information only for as long as I need it for the purpose it was collected, or as long as the law or my professional obligations require.

This includes enquiries that do not lead to an appointment, financial records, complaints and correspondence. Clinical records, including photographs and consent forms, are kept in line with professional guidance for medical and dental records.

When information is no longer needed, it is securely deleted or destroyed.

8. How I keep your information secure

I use appropriate technical and organisational measures to protect your information. It is kept on password-protected devices and secure, access-controlled systems, and treated as confidential. No method of sending information over the internet is completely secure, so please think about what you include in the optional free-text box on the enquiry form.

9. Cookies and tracking

My own website pages set no cookies and use no analytics, advertising or tracking tools. The fonts and videos on the site are hosted on the site itself, so viewing a page does not send your information to font or video services.

The booking calendar is different. The booking page shows Clinic Membership’s booking calendar, either within the page or on Clinic Membership’s own site. When the calendar loads, Clinic Membership sets its own cookies. Some are essential for booking to work, for example to keep you signed in and to keep the booking secure. Clinic Membership’s policy says it may also use optional analytics and advertising cookies on booking pages, but only if you accept them on its cookie banner. You can decline these. Details are in Clinic Membership’s privacy and cookie policy. The booking calendar loads only when you choose to open it, so no booking cookies are set until then.

If I add analytics or any other tool that uses cookies, I will update this policy before doing so and, where the law requires it, ask for your consent first.

10. Your rights

You have the following rights over your personal information:

Access: to ask for a copy of the information I hold about you.
Rectification: to ask me to correct information that is inaccurate or incomplete.
Erasure: to ask me to delete your information. This is not an absolute right; for example, I may need to keep clinical records for the period required by law and professional guidance.
Restriction: to ask me to limit how I use your information in certain circumstances.
Objection: to object to my use of your information where I rely on legitimate interests.
Portability: to ask for information you have given me in a commonly used electronic format, or for it to be sent to another organisation, where I rely on consent or contract and process it electronically.
Withdrawing consent: where I rely on your consent, you can withdraw it at any time. This does not affect anything done before you withdrew it.

I do not make decisions about you using purely automated processes.

To use any of these rights, contact me using the details in section 12. I will respond within one month. For a complex request, the law allows this to be extended by up to two further months, and I will tell you within the first month if that is needed. There is normally no charge. I may need to confirm your identity before releasing any information.

11. Complaining to the ICO

If you are unhappy with how I have handled your information, please contact me first so I can try to put it right.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection:

Website: ico.org.uk/make-a-complaint
Helpline: 0303 123 1113

12. How to contact me

For any question about this policy or your information:

Email: dr.n.murcott@gmail.com
WhatsApp: +44 7518 724444 (messages only)

13. Changes to this policy

I will update this policy when the way I handle information changes. The date at the top shows when it was last updated.