Privacy Policy

Last updated: 12 July 2026. Applies to: our website (thefiloclinic.ie), the FILO mobile app, and our venues — The FILO Clinic and FILO First

Who we are

This policy is issued by Filo Aesthetic Limited, a company registered in Ireland (company number 706856) with its registered office at 2nd Floor, Exchange House, Ballincollig, Co. Cork, P31 K020, Ireland. Filo Aesthetic Limited trades as FILO and operates The FILO Clinic and FILO First. In this policy, “we”, “us” and “FILO” mean Filo Aesthetic Limited.

We are the data controller for the personal data described in this policy. If you have any question about your data, contact us at info@filoaesthetics.ie or by post at the address above.

What this policy covers

One policy covers every way you interact with FILO: browsing or making an enquiry on our website; creating an account, booking or viewing your skin record in the FILO app; and attending The FILO Clinic or FILO First for consultations, skin analysis and treatments. Whichever door you come through, you are dealing with one company and one record, and this is the policy that governs it.

The data we collect

Depending on how you interact with us, we collect the following.

• Identity and contact data. Name, date of birth, email address, phone number.
• Enquiry data. The content of messages you send us through the website contact form, by email, by phone or on social media.
• Account data (app). Login credentials, account settings, communication preferences.
• Booking and transaction data. Appointments booked, attended and cancelled, the treatments involved, the venue, and payment records. Card payments are handled by our payment provider; we do not store full card numbers.
• Treatment and health data (special category data). Your consultation records; skin type, conditions and concerns; relevant medical history, medications and contraindications recorded for treatment safety; treatment notes and outcomes; clinical photographs; Visia skin analysis images and scores where you have had an analysis; and blood test results where these have been medically ordered and processed by our accredited laboratory partner. This is health data and we treat it with the protections the law requires.
• Website technical data. IP address, browser type, pages visited, and cookie identifiers as described in section 5.
• App device data. Device type and operating system, app version, unique device identifiers, push notification token, and crash and diagnostic logs.
• Usage data. How you use the website and app, such as screens or pages viewed and features used.
• CCTV. Our venues operate CCTV for the safety of clients and staff. Footage is retained for 28 days, then deleted, and is accessed only where an incident requires it.

We collect this data directly from you (when you enquire, register, book or complete a consultation), from your clinicians in the course of your care, from your device or browser, and from our laboratory partner where you have had blood work carried out.

How we use your data

The table below sets out each purpose and the legal basis we rely on under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

Purpose	What we use	Legal basis
Responding to enquiries made through our website, by email or by phone	Identity and contact data; the content of your enquiry	Legitimate interests (responding to the people who contact us); steps prior to entering a contract
Creating and managing your account in the FILO app	Identity, contact and account data	Performance of a contract (Art. 6(1)(b) GDPR)
Taking, changing and reminding you about bookings, whether made online, in the app, by phone or in person	Identity, contact, booking and device data	Performance of a contract; legitimate interests (running an orderly diary)
Providing safe treatment and planning your care	Treatment and health data, including consultation records, skin analysis and, where relevant, blood test results	Provision of health care by or under the responsibility of a professional subject to an obligation of secrecy (Art. 9(2)(h) GDPR); your explicit consent where we rely on it (Art. 9(2)(a))
Showing you your skin record, plan and progress in the FILO app	Treatment and health data, including Visia images and analysis	Your explicit consent (Art. 9(2)(a) GDPR), which you may withdraw at any time
Running, securing and improving our website and app	Technical, device and usage data; treatment data only in aggregated or anonymised form	Legitimate interests (keeping our services secure and working well). We do not use identifiable health data for analytics.
Analytics cookies and similar technologies on our website	Cookie identifiers and browsing data on our site	Your consent, given through the cookie banner and withdrawable there at any time
Sending you marketing (only if you opt in)	Contact data and communication preferences	Consent, which you may withdraw at any time via the app, your preferences, or any message we send
Meeting our legal and professional obligations	All categories as required, including clinical records	Legal obligation (Art. 6(1)(c) GDPR); Art. 9(2)(h) for clinical records

A note on restraint. Our promise is only what your skin needs. We handle data the same way: we use it to answer you, run your bookings, keep your treatment safe and show you your own progress. We do not sell your data, and we do not use your health data to profile you for advertising.

Cookies on our website

Our website uses essential cookies, which are needed for the site to work, and — only with your consent — analytics cookies that help us understand how the site is used. Analytics cookies are set only if you accept them in the cookie banner, and you can change your choice at any time through the banner or your browser settings. The analytics service we use is Google Analytics. Our site also uses the Meta (Facebook) Pixel to measure advertising; like analytics cookies, it is set only if you consent, and never on pages relating to your treatment or account. Online booking pages are provided through Zenoti, which sets cookies necessary for the booking process to function.

One record across The FILO Clinic and FILO First

The FILO Clinic and FILO First are two formats of the same company, Filo Aesthetic Limited, and your record is one record across both. This means:

• If you attend FILO First for a facial or laser hair removal and later attend The FILO Clinic for an advanced treatment, the clinical team can see your existing history, skin analysis and treatment notes, so your care is planned from complete information rather than starting over.
• Your skin analysis, wherever it was taken, forms part of the same baseline your clinicians use to plan and review treatment at either venue.
• Access is limited to the clinicians and staff involved in your care and in running your bookings, and all staff are subject to confidentiality obligations.

Because both venues are operated by the same legal entity, this is internal use of your record within one controller, not a transfer of your data to another company.

Who we share your data with

We use carefully chosen service providers (data processors) who handle data on our instructions under written contracts. They include:

• Zenoti (Soham Inc., headquartered in Bellevue, Washington, USA), our booking and clinic management platform. The FILO app is built and operated on Zenoti’s consumer app platform, so Zenoti processes bookings, client records, app accounts and payments on our behalf, whether you book online, in the app, by phone or in person. Zenoti hosts its platform on Amazon Web Services with encryption in transit and at rest, and the FILO app runs on the same infrastructure, using no sub-processors beyond those of the Zenoti platform.
• Our website hosting provider SiteGround.
• Apple and Google, to deliver push notifications to your device.
• Google (Google Analytics) and Meta (Meta Pixel), where you consent to analytics and advertising cookies on our website.
• Klaviyo, our email and marketing platform, used to send newsletters and marketing you have opted in to.
• Enfer Medical, our INAB-accredited laboratory partner, where blood tests are medically ordered as part of your care.
• Adyen (Adyen N.V., Amsterdam, the Netherlands), the regulated payment institution that processes card payments through Zenoti Payments. Adyen handles your card details directly; we never see or store full card numbers.

We may also disclose data where the law requires it, to our professional advisers under confidentiality, and to our insurers or regulators in connection with our obligations as a healthcare provider. We never sell your personal data.

International transfers

Some of our providers process data outside the EU/EEA. Zenoti is a US-headquartered company and personal data on its platform may be processed outside the EEA; Google and Meta also process data in the United States; Apple and Google process push notification data internationally. Where data leaves the EEA, the transfer is protected by an adequacy decision of the European Commission (including the EU–US Data Privacy Framework where the provider is certified) or by the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed. Adyen is headquartered in the Netherlands and regulated in the EU. You can ask us for details of the safeguards that apply to any provider.

How long we keep your data

• Clinical and treatment records, including skin analysis and consultation notes: 8 years from your last treatment, in line with healthcare record-keeping guidance and our insurance and legal obligations.
• Website enquiries: for up to 24 months after our last contact, so we can deal with follow-up questions.
• Account and booking data: for as long as your account is active, and for a reasonable period afterwards to deal with queries and meet legal obligations.
• Marketing preferences: until you withdraw consent.
• Cookie, device, diagnostic and usage data: for short, defined periods appropriate to their purpose.

Deleting the app does not delete your account or your clinical record. You can ask us to close your account at any time; note that we must keep clinical records for the periods above even after an account is closed.

How we protect your data

We apply appropriate technical and organisational measures, including encryption of data in transit, access controls that limit clinical records to those involved in your care, staff confidentiality obligations, and contractual security requirements on all our processors. No system is perfectly secure, but we treat the security of health data as a core clinical responsibility, not an IT afterthought.

Your rights

Under GDPR you have the right to:

• access a copy of your personal data;
• have inaccurate data corrected;
• have data erased, where the law allows (clinical records are subject to the retention obligations above);
• restrict or object to certain processing, including any processing based on legitimate interests;
• receive data you provided to us in a portable format;
• withdraw consent at any time, where consent is the basis we rely on — including consent to marketing, to analytics cookies, and to the in-app display of your skin record — without affecting processing already carried out.

To exercise any right, contact info@filoaesthetics.ie. We will respond within one month. You also have the right to lodge a complaint with the Data Protection Commission (dataprotection.ie), though we would welcome the chance to resolve any concern with you first.

Children and clients under 18

The FILO app is intended for users aged 18 and over, and you must be 18 or over to create an account. Clients aged 16–17 may receive certain treatments at our venues with the consent of a parent or guardian under our Under-18 Client Policy; their records are managed by the clinic together with the parent or guardian, not through an app account. We do not knowingly collect data from children through our website or app, and we do not direct marketing at anyone under 18.

Push notifications and marketing choices

We use push notifications for appointment reminders and, where you have had a skin analysis, to let you know when it is time to review your progress. You can turn notifications off at any time in your device settings or in the app. Marketing — by email or notification — is sent only if you have opted in, and every message includes a way to opt out.

Changes to this policy

We will update this policy when our services or processing change — for example, when new app features are added. We will post the updated version at this address and, for significant changes, tell you on the website or in the app before they take effect.