Privacy Policy

Last updated: 13 July 2026

CosmePay is a trading name of The Cambridge Practice Ltd.

The Cambridge Practice Ltd is registered in England and Wales under company number 12732644.

Our registered office is:

Compass House
Chivers Way
Histon
Cambridge
England
CB24 9AD

For the purposes of UK data protection law, The Cambridge Practice Ltd is the data controller responsible for the personal information processed through CosmePay.

The Cambridge Practice Ltd is registered with the Information Commissioner’s Office as a data controller under registration number ZC095084.

Our ICO registration was first registered on 18 February 2026 and is currently due to expire on 17 February 2027. Our registration can be checked on the ICO’s public register.

This policy explains how CosmePay collects, uses, stores and shares personal information when you:

• visit our website;
• contact us or make an enquiry;
• ask us to help research cosmetic surgery options;
• request an introduction to a surgeon or clinical team;
• communicate with us by email, telephone, WhatsApp or another messaging service;
• use a CosmePay treatment payment account or online portal;
• make or receive a treatment-related payment; or
• otherwise use our services.

CosmePay is not a clinic, hospital or medical adviser. However, we may receive limited health-related information where this is necessary to understand your enquiry, support an introduction or communicate with a surgeon or clinical team.

Depending on how you use our services, we may collect the following categories of information.

This may include:

• your name;
• date of birth;
• address;
• country of residence;
• email address;
• telephone number; and
• preferred method of communication.

This may include:

• the type of procedure or treatment you are considering;
• your preferred timing;
• your preferred location, surgeon or clinic;
• your budget or expected treatment cost;
• questions or concerns you raise;
• your communication and language preferences; and
• information about what you are hoping to achieve.

Where necessary, and normally only with your explicit consent, we may process information relating to your health.

This may include:

• relevant medical history;
• information about previous procedures;
• photographs provided for the purpose of a surgeon consultation;
• information about medication, allergies or existing conditions;
• correspondence from a surgeon or clinical team; and
• information relating to treatment suitability, recovery or aftercare.

We aim to collect only the minimum health information reasonably needed to support the relevant introduction or communication.

Detailed medical assessments and clinical records should normally be provided directly to the treating surgeon or clinical team.

Where required to operate a payment account, prevent fraud, comply with legal obligations or meet the requirements of our banking and payment providers, we may collect:

• copies of identity documents;
• proof of address;
• date and place of birth;
• nationality;
• information about the source of funds;
• verification photographs or electronic verification results; and
• fraud-prevention or sanctions-screening information.

This may include:

• bank account details;
• payment account details;
• amounts received;
• your available CosmePay account balance;
• currency conversion information;
• payment instructions;
• details of the surgeon, clinic or hospital to be paid;
• transaction dates and references;
• payment confirmations; and
• records of refunds, cancelled payments or payment queries.

We do not normally store complete payment-card security details ourselves where these are processed by a specialist payment provider.

We may retain records of:

• emails;
• telephone calls and call notes;
• WhatsApp or other messages;
• contact-form submissions;
• complaints;
• enquiries; and
• communications with surgeons, clinics or hospitals on your behalf.

When you use our website or online portal, we may collect:

• your IP address;
• browser type;
• device type;
• login and account activity;
• pages viewed;
• dates and times of access;
• security logs;
• cookie identifiers; and
• general website usage information.

We may collect information:

• directly from you;
• through our website or contact forms;
• through your CosmePay payment account or online portal;
• during telephone, email or messaging conversations;
• from a person acting with your authority;
• from a surgeon, clinic, hospital or clinical team;
• from payment, banking, identity-verification or fraud-prevention providers;
• from publicly available sources; or
• from a person or business that referred you to CosmePay.

Where we receive your information from another source, we will provide appropriate privacy information as soon as reasonably practicable unless an applicable exemption applies.

We may use your information to:

• respond to your enquiry;
• understand what you are looking for;
• explain how the cosmetic surgery process works in practical terms;
• carry out initial non-clinical research;
• identify surgeons whose services may broadly match your stated preferences;
• introduce you to an approved surgeon or clinical team;
• support communication between you and a surgeon, clinic or hospital;
• provide interpretation or communication support where required;
• open and administer a CosmePay treatment payment account;
• provide access to the online payment portal;
• receive, record and reconcile treatment funds;
• arrange currency conversion;
• process payments to approved surgeons, clinics, hospitals or treatment facilities;
• communicate about payment amounts, deadlines and confirmations;
• verify identity and prevent fraud;
• respond to complaints and disputes;
• maintain security and protect our website, portal and services;
• comply with accounting, tax, legal and regulatory obligations;
• establish, exercise or defend legal claims;
• improve our services; and
• send marketing communications where permitted.

We do not sell personal information.

UK data protection law requires us to have a lawful basis for using personal information.

Depending on the circumstances, we may rely on the following lawful bases.

We may process your information where necessary to:

• respond to your request for services;
• arrange a surgeon introduction;
• open or administer your payment account;
• process a payment instruction; or
• perform our agreement with you.

We may process information where necessary to comply with obligations relating to:

• accounting and taxation;
• fraud prevention;
• financial record-keeping;
• court orders;
• law-enforcement requests; or
• other legal or regulatory requirements.

We may process information where necessary for our legitimate interests, provided those interests are not overridden by your rights.

Our legitimate interests may include:

• operating and improving CosmePay;
• providing customer support;
• keeping appropriate business records;
• maintaining the security of our systems;
• preventing fraud and misuse;
• managing complaints;
• communicating with surgeons and treatment providers;
• protecting our legal rights; and
• understanding how customers use our services.

We may rely on your consent where:

• you ask us to send marketing communications;
• you agree to the use of optional cookies;
• you ask us to share information that would not otherwise be necessary for our services; or
• consent is otherwise the most appropriate basis.

You may withdraw your consent at any time. Withdrawal will not affect processing that took place before consent was withdrawn.

Information about your health is treated as special-category personal data and receives additional protection.

Where CosmePay needs to receive, use or share health information to support a surgeon introduction or communication with a clinical team, we will normally rely on:

• your explicit consent under Article 9 of the UK GDPR; together with
• the relevant Article 6 lawful basis, such as taking steps at your request before providing a service.

We will explain what information is required and who it may be shared with.

You are not required to provide health information to CosmePay. However, if you do not provide information that is necessary for an introduction or communication request, we may be unable to provide that part of the service.

You may withdraw your explicit consent, although this will not affect information already shared or processing already carried out lawfully.

Withdrawing consent will not require a surgeon or clinic to delete information they need to retain for their own medical, legal or professional obligations.

We may share relevant personal information with:

Where you request an introduction or decide to proceed, we may share information with:

• approved cosmetic surgeons;
• their clinical or administrative teams;
• clinics;
• hospitals;
• surgical facilities; and
• aftercare providers connected with your treatment.

Only information reasonably necessary for the relevant introduction, communication or payment will be shared.

Surgeons, clinics and hospitals will normally act as separate data controllers for the information they process for clinical and treatment purposes. Their own privacy policies will apply.

We may share information with:

• banks;
• payment providers;
• foreign-exchange providers;
• account and portal providers;
• transaction-processing providers; and
• identity, fraud or compliance-checking providers.

These organisations may need to process your information to provide the payment service, verify your identity, prevent fraud and complete transactions.

We may share information with trusted providers supporting:

• website hosting;
• cloud storage;
• email and communications;
• customer relationship management;
• IT support;
• cyber security;
• document storage;
• accountancy;
• legal services;
• compliance services;
• insurance; and
• business administration.

Where these providers act on our behalf, they are required to use information only in accordance with our instructions and applicable data protection requirements.

We may disclose information:

• where required by law;
• in response to a court order or lawful authority request;
• to prevent or investigate fraud or criminal activity;
• to protect a person’s vital interests;
• to establish, exercise or defend legal claims;
• in connection with a business sale, restructuring or transfer; or
• with your consent or at your request.

CosmePay provides services connected with cosmetic surgery in Türkiye. This means that relevant personal information may need to be transferred from the United Kingdom to surgeons, clinics, hospitals or service providers located in Türkiye.

Some technology, communications or payment providers may also process information outside the United Kingdom.

Where UK data protection law treats this as a restricted international transfer, we will take appropriate steps to protect your information.

These steps may include:

• entering into an approved UK International Data Transfer Agreement;
• using an approved UK Addendum to standard contractual clauses;
• carrying out a transfer risk assessment;
• applying additional security protections;
• relying on an applicable adequacy regulation; or
• using another transfer mechanism permitted by law.

You may contact us for further information about the safeguards used for a particular transfer.

We do not retain personal information for longer than reasonably necessary.

Retention periods depend on:

• the nature of the information;
• whether you proceed with an introduction or payment service;
• legal and accounting requirements;
• fraud-prevention requirements;
• complaint and legal-claim periods;
• the need to maintain transaction records; and
• whether information remains necessary to provide the service.

As a general approach:

• basic enquiries that do not proceed may normally be retained for up to 24 months after the last meaningful contact;
• introduction and customer service records may normally be retained for up to six years after the relationship ends;
• payment and transaction records may normally be retained for up to six years after the relevant transaction or end of the customer relationship;
• health information will be retained only for as long as reasonably necessary for the introduction or communication purpose, unless it is relevant to a complaint, dispute or legal claim; and
• marketing records may be retained until consent is withdrawn or you object, together with a limited suppression record to ensure we respect your preference.

We may retain information for longer where required by law, a court, an authority, an active complaint or a legal claim.

When information is no longer required, it will be deleted, anonymised or securely destroyed.

We use appropriate technical and organisational measures designed to protect personal information against:

• unauthorised access;
• accidental loss;
• destruction;
• misuse;
• alteration; and
• unlawful disclosure.

Measures may include:

• access controls;
• password protection;
• multi-factor authentication;
• encryption where appropriate;
• restricted staff access;
• secure cloud systems;
• audit logging;
• staff confidentiality obligations;
• security monitoring; and
• supplier due diligence.

No internet, email or online-storage system can be guaranteed to be completely secure. You should avoid sending unnecessary medical or identity information through unsecured communication channels.

Our website may use cookies and similar technologies.

Some cookies are necessary for the website, account portal, security or login functions to operate.

Other cookies may help us:

• understand website usage;
• measure performance;
• remember preferences; or
• improve the website.

Where consent is required, optional cookies will not be placed unless you accept them.

You can manage your preferences using the website’s cookie controls. You may also be able to block or delete cookies through your browser settings, although this may affect some website functions.

Further information may be provided through our cookie banner or separate cookies information.

We may send information about CosmePay services where:

• you have specifically agreed to receive it;
• applicable electronic-marketing rules permit us to contact you; or
• another lawful basis applies.

You can unsubscribe at any time by:

• using the unsubscribe option in a message;
• contacting us;
• replying to ask us to stop; or
• changing any available communication preferences.

Service communications, such as account, security or transaction messages, are not marketing and may continue where necessary to provide the service.

Depending on the circumstances, you may have the right to:

• be informed about how your information is used;
• request access to your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to delete information;
• ask us to restrict how information is used;
• object to certain processing;
• request transfer of information in a portable format;
• withdraw consent;
• object to direct marketing; and
• complain to the Information Commissioner’s Office.

These rights are not absolute. In some circumstances, we may be permitted or required to continue retaining or processing information.

We may need to verify your identity before responding to a rights request.

We will normally respond without undue delay and within the period required by law.

CosmePay does not use solely automated decision-making to decide whether you are clinically suitable for treatment.

Clinical suitability and treatment decisions are made by the treating surgeon or clinical team.

Automated tools may be used for limited purposes such as identity verification, security monitoring or fraud detection. Where a decision has a significant effect and applicable law gives you specific rights, we will provide the required information and safeguards.

CosmePay’s introduction and payment services are intended for adults.

We do not knowingly provide cosmetic surgery introduction or treatment-payment services directly to children.

If we become aware that personal information has been collected from a child without an appropriate lawful basis or authority, we will take steps to delete or appropriately restrict it.

Our website may contain links to:

• surgeons;
• clinics;
• hospitals;
• payment providers;
• WhatsApp;
• social-media services; or
• other third-party websites.

Those organisations operate their own privacy practices. CosmePay is not responsible for the content or privacy practices of third-party websites or services.

You should review their privacy information before providing personal information directly to them.

We may update this policy when:

• our services change;
• our technology or providers change;
• legal requirements change; or
• we change how personal information is used.

The latest version will be published on our website with an updated revision date.

Where a change is significant, we may also notify affected customers directly.

Questions, complaints and requests relating to personal information should be sent to CosmePay through the contact form on our website or in writing to:

Data Protection Enquiries
CosmePay
The Cambridge Practice Ltd
Compass House
Chivers Way
Histon
Cambridge
England
CB24 9AD

Please clearly state that your enquiry concerns data protection or your personal information.

We would appreciate the opportunity to address any concern directly.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator responsible for data protection.

Information about making a complaint is available on the ICO’s website.