Privacy Notice
Registered name: Clinical Teledermatology Ltd. · Last updated: 26 April 2026
1. Important information and who we are
This privacy policy gives you information about how Clinical Teledermatology Ltd collects and uses your personal data through your use of this website, including any data you may provide when you use our portal or platform, register with us, sign up to our newsletter, or purchase a product or service.
Clinical Teledermatology Ltd is a limited company registered in England and Wales (company number 15598925). Our registered address is Compass House, Vision Park, Histon CB24 9AD.
If you have any questions about this privacy policy or about the use of your personal data or you want to exercise your privacy rights, please contact us: support@instaderm.co.uk · Clinical Teledermatology Ltd, Compass House, Vision Park, Histon CB24 9AD.
Clinical Teledermatology Ltd is the controller and responsible for your personal data. In this privacy policy, we refer to Clinical Teledermatology Ltd as Instaderm, we, us, our or the company.
Services
We offer two categories of services, collectively our Services. You must be resident in the UK and registered with a GP in order to register with us and access our Services. If you are under 18 years of age, you cannot access our Services without a registered parent or guardian and registering you as their named family member.
Any reference to doctors, Consultant Dermatologists, consultant or consultants is a reference to the independent contractors fulfilling our Services. These independent contractors are NHS Consultant Dermatologists on the medical and specialty register as supervised by the General Medical Council.
Any reference to platform or portal is a reference to our secure patient portal available on our website. Any reference to app is a reference to our mobile application. Any reference to our website is a reference to www.instaderm.co.uk.
Any reference to patient, you or yours is a reference to users of our website and/or our Services, whether medical or aesthetic. Please refer to our website and the terms and conditions of sale, which set out the full scope of our Services.
You must not use our website, app or our Services for medical emergencies. In emergencies, contact your General Practitioner, the A&E department of your nearest hospital or emergency services on 999.
Medical Services
We facilitate the provision of treatment for a disease, disorder or injury within dermatology. Treatment may involve prescription of medication in the form of an e-prescription with a registered pharmacy. Specifically, we offer an asynchronous Remote Medical Service involving photos and medical history submitted electronically on our platform, and a Hybrid Medical Service with a follow-up synchronous remote appointment lasting approximately 15 minutes.
Non-medical Services
We facilitate the provision of personalised skincare plans to help improve the skin’s appearance through skincare regimes which may involve non-prescription skincare products. We do not sell products directly but may provide a suggested list of readily available products. We offer an asynchronous Remote Aesthetic Service and a Hybrid Aesthetic Service with a follow-up synchronous remote appointment lasting approximately 15 minutes.
2. The types of personal data we collect about you
Personal data means any information about a living individual from which that person can be identified. We may collect, use, store and transfer different kinds of personal data about you, grouped as follows:
• Identity Data: first name, last name, previous names, username or similar identifier, marital status, title, date of birth, pronoun preferences and gender. • Contact Data: billing address, delivery address, email address and telephone numbers. • Health Data: GP details, medical conditions, medical history, medical requirements, medical consultation notes and records, medical images including photographs, and prescription records. • Financial Data: bank account and payment card details. • Transaction Data: details about payments to and from you and other details of products and Services purchased from us. • Technical Data: IP address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device ID and other technology on devices used to access this website. • Profile Data: username and password, order for our Services, interests, preferences, feedback and survey responses. • Usage Data: information about how you interact with and use our website, products and Services. • Marketing and Communications Data: preferences in receiving marketing from us and third parties and communication preferences. • Service Record Data: records relating to the Services provided, including records of meetings and decisions, call recordings, and health and safety information including incident records, investigation details and correspondence.
We also collect, use and share aggregated data such as statistical or demographic data which is not personal data as it does not directly or indirectly reveal your identity.
3. How is your personal data collected?
We use different methods to collect data from and about you, including through your interactions with us. You may give us personal data by filling in online forms or corresponding with us by post, phone, email or otherwise. This includes when you apply for our products or Services, create an account, subscribe to our service or publications, request marketing, give feedback or contact us.
Automated technologies or interactions: as you interact with our website, we automatically collect Technical Data about your equipment, browsing actions and patterns using cookies, server logs and similar technologies. Please refer to our Cookies Policy available on our website.
Third parties or publicly available sources: we may receive personal data from family members or carers, credit reference agencies, suppliers and service providers. Technical Data may come from analytics providers such as Google, advertising networks and search information providers. Contact, Financial and Transaction Data may come from technical, payment and delivery providers such as Stripe.
4. How we use your personal data
Legal basis
The law requires us to have a legal basis for collecting and using your personal data in relation to our Services, including our app, platform and portal. We rely on one or more of the following legal bases: performance of a contract with you; legitimate interests; legal obligation; and consent.
Performance of a contract with you means where we need to perform a contract we are about to enter into or have entered into with you. Legitimate interests means we may use your personal data where necessary to conduct our business and pursue our legitimate interests, while balancing the potential impact on you and your rights. Legal obligation means processing necessary for compliance with a legal obligation. Consent means active agreement to use your personal data for a specified purpose, such as subscribing to an email newsletter.
Purposes for which we will use your personal data. The purpose, types of data and legal basis are set out below.
To register you as a new customer, client or patient
Type of data: Identity, Contact, Health, Financial, Transaction, Profile, Marketing and Communications, Service Record.
Legal basis: Performance of a contract with you.
To process and deliver our Services and manage our platform and app, including managing payments, fees and charges and collecting or recovering money owed to us
Type of data: Identity, Contact, Health, Financial, Transaction, Technical, Profile, Service Record.
Legal basis: Performance of a contract with you; necessary for our legitimate interests to recover debts due to us.
To manage our relationship with you
Type of data: Identity, Contact, Health, Financial, Profile, Marketing and Communications, Service Record.
Legal basis: Performance of a contract with you; necessary to comply with a legal obligation; necessary for our legitimate interests.
To administer and protect our business and this website
Type of data: Identity, Contact, Health, Technical.
Legal basis: Necessary for our legitimate interests.
To deliver relevant website content and online advertisements and measure or understand the effectiveness of the advertising we serve
Type of data: Identity, Contact, Profile, Usage, Marketing and Communications, Technical.
Legal basis: Necessary for our legitimate interests.
To use data analytics to improve our website, products and Services, customer relationships and experiences and measure the effectiveness of our communications and marketing
Type of data: Technical, Usage.
Legal basis: Necessary for our legitimate interests.
To send relevant marketing communications and make personalised suggestions and recommendations about goods or Services that may be of interest to you
Type of data: Identity, Contact, Technical, Usage, Profile, Marketing and Communications.
Legal basis: Necessary for our legitimate interests; consent, having obtained your prior consent to receiving direct marketing communications.
To carry out market research through your voluntary participation in surveys
Type of data: No specific category stated.
Legal basis: Necessary for our legitimate interests.
Direct marketing
You will receive marketing communications if you requested information from us or purchased goods or Services and have not opted out. We may analyse Identity, Contact, Technical, Usage and Profile Data to form a view of products, Services and offers that may interest you.
Third-party marketing
We will get your express consent before sharing personal data with any third party for its own direct marketing purposes.
Opting out of marketing
You can stop marketing communications at any time using opt-out links in marketing messages or by contacting us. You will still receive essential service-related communications such as appointment reminders, Terms updates and contact-detail checks.
Cookies
For information about the cookies we use and how to change cookie preferences, please refer to our Cookies Policy available on www.instaderm.co.uk.
5. Disclosures of your personal data
We may share personal data where necessary with doctors fulfilling our Services, external health providers such as GPs and consultants, and organisations needed for safeguarding or where required by law. We also share data with Stripe for payments and identity checks; Signature RX for e-prescriptions; Google for storage, remote consultations and hosting the app; Apple for app hosting; and Azuki Limited for website and app maintenance. We may share data with a buyer, transferee or merger partner. Third parties must respect security and process data lawfully.
6. International transfers
When transferring personal data out of the UK, we ensure appropriate safeguards. We transfer only to countries deemed adequate by the UK or use UK-approved standard contractual safeguards, including the International Data Transfer Agreement. Contact us for a copy of the safeguards.
7. Data security
We use appropriate security measures to prevent personal data being accidentally lost, used, accessed without authorisation, altered or disclosed. Access is limited to those with a business need and they process data on our instructions under confidentiality duties. We have breach procedures and notify you and regulators where legally required. Personal Data is stored on Google Cloud servers in the UK; Google has implemented the NHS DSP Toolkit. We also hold cyber security insurance.
8. Data retention
We retain personal data only as long as reasonably necessary for legal, regulatory, tax, accounting and reporting requirements, and longer where there is a complaint or prospect of litigation. Basic customer Contact, Identity, Financial and Transaction Data may be retained for up to eight years after the relationship ends. We may anonymise data for research or statistics indefinitely.
9. Your legal rights
You may request access, correction, erasure, restriction or transfer of your personal data; object to processing based on legitimate interests and always object to direct marketing; and withdraw consent where we rely on it. Restriction may be requested while accuracy is established, where processing is unlawful, where data is needed for legal claims, or while an objection is assessed. Contact us to exercise rights. We may request identity information, normally respond within one month, and may charge a reasonable fee for clearly unfounded, repetitive or excessive requests.
10. Complaints
You have the right to complain to the Information Commissioner’s Office, the UK data protection regulator, at www.ico.org.uk. We would appreciate the chance to address concerns first by email or post.
11. Changes to the privacy policy and your duty to inform us of changes
We keep this privacy policy under regular review. Please keep your personal data accurate and tell us about changes during your relationship with us, such as a new address or email address.
12. Third-party links
Our website may include links to third-party websites, plug-ins and applications. Those third parties may collect or share data. We do not control third-party sites and are not responsible for their privacy statements. When you leave our website, read the privacy policy of each site you visit.
Whenever we transfer your personal data out of the UK to service providers or other controllers, we ensure a similar degree of protection by transferring only to countries deemed by the UK to provide an adequate level of protection, or by using specific standard contractual terms approved for use in the UK, namely the International Data Transfer Agreement. To obtain a copy of these safeguards, contact us using the details above.