[Template. Have this reviewed for your entity before launch. Last updated: July 2026.]
Who we are
Aurelia Institute (“we”) operates this website and the training academy it describes. We are the data controller for personal data collected here. Contact: privacy@yourdomain.
What we collect and why
- Enquiries and prospectus requests: name, contact details and professional background, so we can answer you (legitimate interests) and, only with your consent, send marketing.
- Bookings: the above plus booking and payment records, to perform our contract with you and meet accounting law.
- Model applications: contact details, treatment interests, availability and brief suitability screening answers, processed with your explicit consent because some answers are special-category (health) data. Full medical history is taken at consultation into clinical records, not through this website. Applications never matched to a session are deleted after 12 months.
- Learning centre: account, progress and certificate records, kept to perform our contract with you.
- Marketing: only with consent (or the soft opt-in for our own customers), with one-click unsubscribe in every email.
Your rights
Access, rectification, erasure, restriction, portability and objection, plus withdrawal of consent at any time (including health-data consent, which stops model-application processing). Email privacy@yourdomain; we respond within one month. You may complain to the ICO (ico.org.uk).
Security and retention
Data is stored on secured systems with access restricted by role; screening answers are visible only to the clinical team. Booking and financial records are kept six years (tax law); clinical records follow healthcare retention norms; CRM records are reviewed against activity and purpose.
Cookies
This site sets only strictly necessary cookies by default. If analytics are added, they will be consent-based and documented here.