Privacy Policy
Welcome to the Adoreal Privacy Notice.
Last Updated: July 29th, 2024
Introduction
This privacy notice is intended for:
1. Users of Adoreal’s services;
2. Visitors to Adoreal’s websites;
3. Users of Adoreal’s systems and applications;
4. Members of the general public who are interested in contacting us or who may be contacted by Adoreal; and
5. Any individual who has received this notice.
Adoreal understands that privacy is important to you. We are committed to treating your personal data with care and integrity.
Our privacy notice tells you what personal data we collect and how we collect it, including any data you may provide through this website when you visit the site or inquire about a product or service or take part in an event. It explains what we use your personal data for and how we protect your personal data and keep it safe. It also informs you how long we keep your data, who we share your data with or how we otherwise process it. This privacy notice explains our general practices. However, where local laws or regulations require that we process information differently, or refrain from such processing, we will always comply with the applicable local law. This website is not intended for children, however we may collect data relating to children subject to their parent’s or guardian’s consent.
Adoreal values your privacy. Adoreal is made up of different legal companies related to us by common control or ownership (the “Adoreal Group”). This privacy notice is issued on behalf of the Adoreal Group so when we mention “Adoreal”, “we”, “us” or “our”, this is who we are referring to. Adoreal Limited (incorporated in the Republic of Ireland under number 72345090 D, whose registered office is at South Circular Road,Dublin 8, Ireland) is the controller and responsible for this website.
The terms “you”, “your” or “user” refer to you as the person interacting with Adoreal via this website or in any other capacity including as a professional adviser, employee or contractor, investor, vendor or any other entity interacting with us on behalf of another person.
It is important that you read this privacy notice together with any other privacy notice or fair processing notice we may provide to you on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy notice supplements other notices and privacy policies and is not intended to override them.
We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the DPO using the details set out below.
DPO Details:
DPO Centre Limited
50 Liverpool Street,
London EC2M 7PY, UK
Contact email: [email protected]
Telephone number: +44 (0) 203 797 1289
If you have any other enquiries please contact us on [email protected].
You have the right to make a complaint at any time to the data protection regulator in the country where you usually live or work, or where the alleged data protection infringement has taken place. We would, however, appreciate the chance to deal with your concerns before you approach the applicable data protection regulator so please contact us in the first instance.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us by contacting us on [email protected].
Personal data means any information or piece of information which could identify you either directly (e.g. your name) or indirectly (e.g. a unique ID number).
In this privacy notice, we explain:
Who is the controller of your personal data?
Contact information and your privacy point of contact
What personal data do we collect about you?
How do we collect your personal data?
How do we use your personal data?
Why are we allowed to collect and use your personal data?
How do we protect your personal data?
What are your rights regarding your personal data?
With whom do we share your personal data?
In what instances do we transfer your personal data outside of your home country?
Additional information if you are in the European Economic Area (EEA)
Information about children
Marketing
Withdrawal of Consent/ Opting out of Marketing
Change of Purpose
How we update this Privacy Notice?
Our responsibility regarding websites that we do not own or control
Who is the controller of your personal data?
Adoreal is the controller of personal data provided by you in relation to the set up and registration for an Adoreal account (“Operational Data”)
You are the controller of any data, such as communication messages, files, images or other contentthat you add to your Adoreal account or that is added by a third party to your account or that we otherwise process in accordance with your or the third party’s instructions (“Customer Data”). Adoreal is a data processor in regard to Customer Data.
Contact information and your privacy point of contact
If you want to exercise your rights, have any questions about this privacy notice, need more information or would like to raise a concern or make a complaint, you can do so by contacting [email protected].
What personal data do we collect about you?
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). The personal data we collect, and process may include:
Identity data – your name, surname (including prefix or title), alias, gender, age or date of birth, social security number, as well as your preferred language. Similar information about children may also be collected in very limited circumstances, see ‘Information about children’ for more information;
Contact data – information that enables us to contact you, e.g. your personal or business email, mailing address, telephone and mobile numbers and profile on a social media platform;
Booking Data – information provided for the booking of an appointment with a chosen clinic e.g. name, surname, date/time, health/ medical data;
Special Categories of personal data- information about your health, medical treatment, equality and diversity, ethnicity;
Background Check Data – information to verify the accuracy of an individual’s personal and professional history including criminal convictions and records, credit history, education;
Recruitment Data - information gathered during the hiring process including, demographic information, education and employment history, cv’s, interview notes, gender;
Employee Data - information collected for employment purposes including name, surname, gender, date of birth, contact details, dependents and next of kin information, marital status, emergency contact information, financial information, professional memberships and licenses, appraisals and disciplinary details;
Technical data and Network Activity Information – information about your device and your usage of our websites, apps and systems, including your IP address, device ID, hardware model and version, mobile network information, operating system, platform and other online identifiers, type of browser, browser plug-in types and versions, browsing history, search history, access time, pages viewed, URLs clicked on, forms submitted, time zone setting/physical location and other technology on the devices that you use to access our website;
Financial Information – your credit card, paypal account or bank details, including account name, account number and sort code if payments are made by you to Adoreal;
Usage Data – data related to your use of our services offered (including feedback), your purchase history and preferences, your interactions with us, your preferred method of communications with us, and services you may use relating to your selection of aesthetic/cosmetic/plastic surgery practitioners and institutions/clinics, your use of the 3D enhanced imaging and simulation creator including details of healthcare professional and clinic selected, surgery type information, cost ;
Health Information – your health status, current and historical health conditions and health information inferred from information that you have provided to us, including an aesthetic assessment where you would be asked questions related to any previous procedures/treatment that you have had, and your potential maximum expenditure, any medication that you are prescribed.
Feedback and Opinion Data - we will collect feedback from you regarding your feelings towards your consultation, treatment and post-surgical experience so that we can maintain and improve our service and reduce barriers in communication between you and your healthcare provider;
Marketing and Communications Data - includes your preferences for receiving marketing materials from us and your communication preferences such as via email; and
Audio Visual Data – photos, videos and voice recordings of you, if you choose to submit those to us. These may include any 3D enhanced images or simulations that you may create using the Crisalix 3D image creator provided to you within your Adoreal account. The 3D enhanced images or simulations are created using ARKit, TrueDepth API, Camera APIs, Photo APIs, or other software for depth of facial mapping information.
Audiovisual Recording Data – audiovisual recordings of meetings held on Teams, Zoom, Google Meet that we may hold with you, including collection of information from Microsoft Outlook Calendar or Google Calendar about the meeting held. The recordings of the meetings are created using an AI tool called Fathom, which is also used to transcribe and take notes of matters discussed at the meeting we may have with you. The transcript is shared with you.
We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. ‘Aggregated Data’ could be derived from your personal data but is not considered personal data as this data will not directly or indirectly reveal your identity or contain any of your persona data. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.
You can choose not to give us personal data when we ask for it. If you decide not to give us your personal data, it may restrict our relationship with you. For example, we may not be able to provide you with the services that you have requested.
How do we collect your personal data?
When you visit our websites or use our services, we collect your personal data.
Directly from you when you:
Visit or use some parts of our websites and/or services we might ask you to provide personal data to us. We also collect some information about you automatically when you visit our websites or use our services, like your IP address, device type, and browser details.
Use your Adoreal account that a clinic created for you as one of their patients, or you use your own Adoreal account to update your personal details, photos and images, use it to communicate with the clinic or healthcare professional about your treatment, provide feedback or take part in surveys, use the 3D enhanced imaging or simulation to create images, or make any bookings and payments through the account, when you contact us with any queries, complaints or for IT support;
Register with us to use Adoreal’s authentication services (currently OTP via mobile phone and email);
Create an account and profile on one of our websites, or apps - as you interact with our website, we will automatically also collect Technical Data about your equipment, browsing actions and patterns subject to us obtaining your consent where this is required, for example for marketing or tracking cookies. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. Please also see our Cookie Notice for additional information.
We may also receive personal data including Technical Data about you if you visit our websites, apps and systems to inquire about our services:
• Book an appointment for example by using our booking widget, or through your Adoreal account;
• Share or use your social media profile to contact Adoreal;
• Sign up with Adoreal to receive promotional marketing materials and direct marketing communications;
• Get in touch for support or to provide feedback to Adoreal;
• Attend any online events that Adoreal may organise, such as a webcast;
• Respond to any self-assessment surveys that you choose to participate in; and
• Share any adverse events or medical information enquiries in your Adoreal account.
From other sources:
The majority of information that we collect, we collect directly from you. However, sometimes we may collect personal data about you from other sources, such as publicly available materials or trusted third parties like the healthcare clinics that use our product, and from marketing and research partners. We use this information to supplement the personal data we already hold about you, in order to better inform, personalise and improve our services. Where a clinic creates an Adoreal account for you as a patient – therefore the clinic that you have contacted for treatment provides personal data about you to Adoreal to create your Adoreal account;
When you talk about us online, for example when you mention an Adoreal product in a Tweet or on other social media, we may collect your personal data from the third-party, such as social media handles and other personal data you make available. If you connect your social media account to our websites, or apps, certain personal data from your social media account will be shared with us. This may include, amongst other personal data, your name, email address, photos, list of social media contacts, and any other accessible information;
How do we use your personal data?
We use your personal data for the purposes we have described below in this privacy notice, or for purposes which are reasonably compatible to the ones described.
Legal Bases
“Consent” means that the individual has given clear permission for their personal data to be processed for a specific purpose. Consent must be freely given, specific, informed and unambiguous indication. Of the individual's wishes by which he or she. By clear affirmative action. Shows agreement to the processing of personal data relating to him or her.
“Legitimate interest” means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.
“Performance of a contract” means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.
“Comply with a legal obligation” means processing your personal data where it is necessary for compliance with a legal obligation that we are subject to.
“Vital Interest” means processing your personal data in a life or death circumstance. Where the processing is vital to the individual’s survival and where they need emergency medical care and are incapable of giving consent.
Practical application
We have set out below, in a table format, a description of the ways we may use your personal data, for what purposes, and the applicable legal bases we rely on to do so.
We have also identified what our legitimate interests are where appropriate. Note that we may process your personal data on more than one lawful basis depending on the specific purpose for which we are processing your data.