Last updated: 21 October 2026
Who we are
DROM Clinic Limited (“DROM Clinic”, “we”, “us”) runs DROM Clinic at 81-83 Walton Street, London SW3 2HP. We are registered in England and Wales under company number 17053324, with our registered office at the same address. We are the controller of the personal information described here, and we are registered with the Information Commission (still known as the ICO) under registration reference ZC162252.
If you have a question about this policy or about your information, email hello@dromclinic.com or write to us at the address above.
What this policy covers
It explains how we handle the personal information you give us through this website, by email, by phone or on WhatsApp, the records we keep if you become a patient, and the limited technical information processed when you visit the site.
The information we collect
- Your contact details: name, email address and phone number.
- Booking details: the treatment you are interested in, your preferred day and time, whether this is your first visit, and any accessibility support you need.
- Anything you choose to tell us in a message or note, which may include information about your health or the concern you would like treated.
- If you become a patient: your medical history, consultation and treatment notes, consent forms, clinical photographs and the results of any tests we arrange.
- Technical information processed by our website host when you visit, such as your IP address, browser type and the pages requested, kept in short-lived logs for security and to keep the site running.
Usually this information comes from you. Sometimes it comes from someone who contacts us or books on your behalf, or from another healthcare professional who refers you to us.
You don’t have to give us any information, but without your contact details we can’t reply to you, and without your medical history we can’t treat you safely.
How we use it, and why we are allowed to
- To reply to your enquiry and arrange a consultation or booking. Our lawful bases are taking steps at your request before providing a service to you, and our legitimate interest in responding to people who contact us.
- To provide your care if you become a patient, including keeping clinical records. Our lawful bases are our contract with you and our legal obligations as a healthcare provider.
- To keep this website secure and working. Our lawful basis is our legitimate interest in running a safe website.
Information about your health is “special category” data under UK data protection law. When you ask us about treatment and tell us about your health, and when you become our patient, we use it for health care purposes (Article 9(2)(h) of the UK GDPR, and Schedule 1, paragraph 2 of the Data Protection Act 2018). Only our doctors and staff bound by a duty of confidentiality handle it.
Clinical photographs form part of your record. We use a photograph of you in our marketing only with your separate written consent, which you can withdraw at any time.
We do not sell your information, we do not make automated decisions about you, and we only send you marketing if you have asked us to.
Where your information is kept
Our online forms are not connected yet, so at the moment this website does not send or store anything you type into them. Once they are connected, what you send will go to our own secure clinic database and be kept as part of our client records.
Emails are held in our Microsoft 365 account, WhatsApp messages in our WhatsApp Business account, and client records in our clinic database, which is stored on servers in the European Economic Area. Access is limited to the members of the DROM Clinic team who need it to look after you.
Who we share it with
- Service providers who help us run the clinic and this website, and who act only on our instructions: our website host (Vercel), our email provider (Microsoft), the provider that hosts our clinic database (Supabase), and the provider that processes card payments.
- WhatsApp (Meta), if you choose to contact us that way. Your messages are then also covered by WhatsApp’s own privacy policy.
- Google, which provides the maps on our contact, booking and clinic pages (see “Cookies and similar technology” below).
- Pharmacies, laboratories and other healthcare professionals involved in your care, where your treatment needs them.
- Our insurers and professional advisers, where we need them to run the clinic or to deal with a claim (for health information, on the basis that it is needed to establish or defend a legal claim).
- Regulators, professional bodies or the courts, where the law requires it.
Some of these providers are based outside the UK:
- Our website host, Vercel Inc., is based in the United States. Our contract with Vercel includes the ICO’s International Data Transfer Addendum, which we rely on for transfers to the United States.
- Our clinic database is stored on servers in the European Economic Area. The company that runs it, Supabase, is based in Singapore and its support staff work in several countries, so our contract with Supabase includes the ICO’s International Data Transfer Addendum.
- Where another provider handles your information outside the UK, we rely on UK adequacy regulations or on the ICO’s International Data Transfer Agreement or Addendum. You can ask us for details.
How long we keep it
- Enquiries that do not lead to treatment: up to 12 months after our last contact with you, then deleted.
- Patient records, including clinical photographs: 8 years after your last treatment, in line with the NHS records management code for adult records, or longer only while a complaint, claim or legal requirement makes it necessary.
- Website logs: only as long as our host needs them for security and fault-finding.
Cookies and similar technology
We do not use advertising or analytics cookies of our own, and we do not track you across other websites.
- The maps on our contact, booking and clinic pages are provided by Google and load automatically when you open these pages. Your browser then connects to Google, which receives your IP address and device information, may read or set its own cookies (for example if you are signed in to Google), and may use this information for its own purposes, such as advertising, including outside the UK, under Google’s privacy policy. We show the map so that you can find us easily, which is our legitimate interest. We do not set any cookies for it ourselves.
- The review ratings on our home page are fetched by our own server, so your browser does not connect to Google or Trustpilot to show them.
Your rights
You have the right to:
- ask for a copy of the information we hold about you;
- ask us to correct information that is wrong or incomplete;
- ask us to delete your information, where we are not required to keep it;
- ask us to restrict or stop using your information, or object to how we use it;
- ask for information you gave us in a portable format;
- where we rely on your consent, for example to use a photograph in our marketing, withdraw it at any time, without affecting anything we did before you withdrew it.
Your right to object: where we rely on our legitimate interests, you can object at any time, and we will stop unless we have strong legitimate grounds to continue.
To use any of these rights, email hello@dromclinic.com. We will reply within one month. Some rights are limited where the law requires us to keep clinical records; we will explain if that applies to you.
Keeping your information safe
We use appropriate technical and organisational measures to protect your information, including encrypted connections to this website and restricted access to our records.
Making a complaint
If you are unhappy with how we have handled your information, please tell us first so we can put it right. Email hello@dromclinic.com with “Privacy complaint” in the subject line. We will acknowledge your complaint within 30 days, keep you updated on progress, and tell you the outcome without undue delay.
You also have the right to complain to the Information Commission (still known as the ICO) at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Age
Our treatments are for adults aged 18 and over, and this website is not intended for children.
Changes to this policy
We may update this policy from time to time. The date at the top shows when it last changed.
