Client Confidentiality
How client and patient material is handled.
Scope
This page describes how Helia Aesthetics LLC handles information entrusted to it by clients. The binding obligations for an engagement are set out in that client's agreement, which takes precedence over this page.
Account access
We ask for delegated access through the platform's own business tools rather than for a client's personal password. Access is limited to the people working on the account, and it is handed back or revoked when an engagement ends.
Patient material
We publish identifiable patient material only where the practice confirms in writing that the patient has consented to that use, and the consent record stays with the practice as the data controller for its own patients. Patient information is special category data under the UK GDPR. We do not request clinical records, and we do not need them to do our work.
Storage and deletion
Client material is kept in the tools used to run the account and is not shared outside the people working on it. When an engagement ends, we hand over the working material and delete our copies on request, except where we have to keep something as a business record.
Subcontractors
Where we use a subcontractor or a tool that touches client material, it is bound by the same confidentiality obligations we owe the client.
Security incidents
If client material is exposed or accessed without authorisation, we tell the affected client without undue delay and in any case within 72 hours of becoming aware, and we tell them what we know and what we are doing about it.
Changes
This page was last updated on 9 October 2026.