Last updated: 1 July 2026
Solstice Aesthetics(“we”, “us” or “our”) is the data controller responsible for your personal information when you use this patient portal. The portal runs on a software platform powered by Phensys, which acts as our data processor. This policy explains what information we collect, how we use it, and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018).
We may collect and process the following categories of personal information:
We use your personal information to:
We rely on the following lawful bases for processing your personal information. For the provision of health and social care, we rely on Article 6(1)(e) (public task) or Article 6(1)(b) (performance of a contract) together with Article 9(2)(h) (provision of health care) for special category health data. Where we rely on your consent (for example, certain communications), we rely on Article 6(1)(a) and, for health data, Article 9(2)(a). We may also process information to comply with legal obligations (Article 6(1)(c)).
Where you provide your mobile telephone number and opt in, we may send you text (SMS) messages relating to your care.
You can opt out at any time by replying STOP; reply HELP for help.
Your information may be shared with the clinicians and staff at Solstice Aesthetics who are involved in your care. We use Phensys as our data processor to host and operate the portal on our instructions and under a written agreement. We may also share information where required by law, to safeguard individuals, or with other healthcare providers involved in your care. We do not sell your personal information.
We keep your personal information only for as long as necessary to provide your care and to meet our legal, regulatory and professional record-keeping obligations. Health records are retained in line with applicable healthcare records retention requirements. When information is no longer required, it is securely deleted or anonymised.
We and Phensys implement appropriate technical and organisational measures to protect your information, including encryption, access controls and audit logging. No method of transmission or storage is completely secure, but we take reasonable steps to safeguard your information against unauthorised access, loss or misuse.
Under the UK GDPR you have rights over your personal information, including the right to be informed, the right of access, the right to rectification, the right to erasure (in certain circumstances), the right to restrict or object to processing, and the right to data portability. Where processing is based on consent, you may withdraw that consent at any time. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.
The portal uses cookies and similar technologies that are strictly necessary to keep you signed in and to keep the portal secure. Where any non-essential cookies are used, we will ask for your consent. You can control cookies through your browser settings, although disabling essential cookies may prevent the portal from working correctly.
Where the portal is used in connection with the care of a child, it should be accessed by a parent, guardian or other person with authority to act on the child’s behalf. We handle children’s information with particular care and in accordance with applicable law.
To exercise any of your rights, or if you have questions about this Privacy Policy or how we handle your information, please contact Solstice Aesthetics:
We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised “Last updated” date. Please review this page periodically to stay informed about how we protect your information.