Privacy policy
A plain-English explanation of the information we collect, why we collect it, and the rights you have over it.
Aesta is software for UK aesthetic and skin clinics, built by a small UK team. This policy explains what personal data we collect through the Aesta website and early-access programme, and how we handle it.
Who we are
Aesta is a product of Gopher IT Support Limited, a company registered in England and Wales under number 09965667, with its registered office at The Hutt, 10 Park Street, Hatfield, Hertfordshire, AL9 5AX. Gopher IT Support Limited is the data controller for the personal data described in this policy. You can reach us about privacy at privacy@heyaesta.com.
What data we collect
At the moment, the only personal data we collect comes through our early-access sign-up form. This may include:
- Your name and the name of your clinic.
- Your email address and phone number.
- Brief information about your clinic (number of locations, current software).
We also use privacy-friendly, cookieless visitor analytics (Vercel Web Analytics) that sets no cookies and does not identify you. With your consent, we use advertising from Meta and session analytics from Microsoft Clarity; if you do not consent, these are not set. You can see exactly what they do, and change your choice, on our cookie notice.
Why we collect it
We collect early-access details solely to contact you about joining the Aesta Founding Cohort and to answer any questions you send us. We will not use your details for any other purpose without telling you first.
Our lawful basis
Under UK GDPR, we rely on our legitimate interests to respond to your early-access enquiry and to take steps at your request before any agreement. For the advertising and analytics cookies described below, we rely on your consent, which you can withdraw at any time. Declining consent does not affect anything else, and you can still apply and hear back from us.
Sharing your data
We do not sell your personal data, and we do not share it with third parties for their own marketing purposes. We use a small number of trusted service providers to run the site and handle your enquiry, including our website host and analytics provider (Vercel), our email provider (Resend), and Google Fonts, which serves the fonts on this site. If you consent to the cookies below, Meta and Microsoft also receive limited usage data as independent controllers. Each provider is bound by appropriate terms.
Cookies
This site uses essential cookies and cookieless analytics that need no consent, and, with your agreement, advertising from Meta and session analytics from Microsoft Clarity. Those are set only if you accept them, and Meta and Microsoft act as independent controllers for the data they then receive. The full detail, and a way to change your choice, is on our cookie notice.
International transfers
Some of our providers process data outside the UK. Where that happens, the transfer is covered by appropriate safeguards, such as UK adequacy regulations or the UK International Data Transfer Agreement, so your data keeps a level of protection similar to the UK.
Patient data and clinic records
Once the Aesta product launches, clinics that subscribe will upload and store patient records inside the platform. For that data, the clinic is the data controller and Aesta is the data processor, acting only on the clinic's instructions. A full Data Processing Agreement will be provided to every subscribing clinic before they begin using the product. You can read the draft terms on our data processing page.
Security
We take reasonable technical and organisational steps to protect the personal data we hold. Patient records within the Aesta platform are encrypted at the application level before being stored. More detail is on our security and privacy page.
How long we keep your data
We keep your early-access enquiry details for as long as is needed to manage your application or until you ask us to delete them, whichever comes first.
Your rights under UK GDPR
Under the UK General Data Protection Regulation you have the right to:
- Access the personal data we hold about you.
- Correct any inaccurate information.
- Delete your data, subject to any legal obligations we hold.
- Restrict or object to certain processing.
- Portability of your data in a machine-readable format.
- Withdraw consent at any time where we rely on consent to process your data.
To exercise any of these rights, please contact us via the early-access form. We aim to respond within one calendar month.
If you are unhappy with how we have handled your data, you also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
Changes to this policy
We may update this policy as the product and our legal obligations develop. The date at the top of this page will reflect the most recent revision. Significant changes will be communicated directly to anyone already on our early-access list.
Contact
For any question about this policy, or to exercise your rights, email us at privacy@heyaesta.com. You can also reach us via the early-access form, and we will respond as quickly as we can.
Last reviewed: July 2026
Questions about your data?
Get in touch via the early-access form and we will answer promptly.
Contact us