The Wellbeing Medic

Dr Charlotte Norton · Medical Aesthetics & Treatments

Privacy policy

Your privacy matters, especially when it comes to your health. This policy explains what information we collect about you, why we need it, how we keep it safe and the rights you have.

Last updated: 13 November 2026

1. Who we are

The Wellbeing Medic is a trading name of Norton Management Consultancy Ltd, a company registered in England and Wales (company number 12566305). Treatments are provided by Dr Charlotte Norton, a GMC-registered doctor (GMC no. 7139552). Norton Management Consultancy Ltd is the data controller for your personal information.

If you have any questions about this policy or your information, contact Dr Norton at drnorton@thewellbeingmedic.com or on 07772 602298.

2. The information we collect

  • Contact details: your name, address, postcode, email address, phone number and date of birth.
  • Health information: your medical history, medicines, allergies, weight and other measurements, consultation notes, treatment records, consent forms and aftercare.
  • Clinical photographs: before and after photos taken as part of your medical record.
  • Booking and payment information: appointment details, deposits and payments. Card payments are handled by our payment providers, and we never see or store your full card details.
  • Communications: messages you send us through our website form, email, text or WhatsApp, and notes of phone or video calls.
  • Website information: basic technical information such as your IP address and how you use our website, collected through cookies (see section 9).

3. How we use your information and our legal basis

  • To respond to your enquiry and arrange appointments. Legal basis: taking steps at your request before entering into a contract, and performing our contract with you.
  • To assess you, provide safe treatment and keep medical records. Legal basis: performing our contract with you and our legal obligations. Because health information is special category data, we process it for the purposes of providing health care, under Article 9(2)(h) of the UK GDPR and the Data Protection Act 2018, by or under the responsibility of a doctor bound by professional confidentiality.
  • To take payments and keep financial records. Legal basis: performing our contract and complying with tax and accounting law.
  • To deal with complaints, claims and regulatory requirements. Legal basis: our legal obligations and our legitimate interests in defending legal claims.
  • To send you news and offers. Only if you’ve opted in. Legal basis: your consent, which you can withdraw at any time by replying “stop” or emailing us.
  • To use photographs for marketing or training. Only with your separate, written consent, which you can withdraw at any time.

4. Who we share your information with

We never sell your information. We only share it where we need to, and only what is necessary:

  • Your GP or other healthcare professionals, with your consent, or without it only where there is a serious risk to your health or safety, or another person’s.
  • UK-registered pharmacies and laboratories, to dispense prescriptions or process blood tests.
  • Service providers who help us run the business, such as our website host (WordPress.com), email, secure clinical record and video consultation software, WhatsApp, payment providers and our accountant. They may only use your information on our instructions.
  • Our medical indemnity provider and professional advisers, if needed to handle a complaint or claim.
  • Regulators, the police or courts, where we are legally required to.

Some of our service providers may store information outside the UK. Where they do, we make sure appropriate safeguards are in place, such as UK-approved contract terms.

5. How long we keep your information

  • Medical records and clinical photographs: at least 8 years after your last treatment, in line with NHS guidance on keeping adult health records, or longer if needed for a complaint or claim.
  • Financial records: 6 years, as required for tax purposes.
  • Enquiries that don’t lead to treatment: 12 months.
  • Marketing preferences: until you unsubscribe.

6. How we keep your information safe

We keep records in secure, password-protected and encrypted systems, limit access to people who need it, and never leave paper records unattended during home visits. Video consultations take place on a secure platform. If there is ever a data breach that puts you at risk, we will tell you and the ICO as required by law.

7. Your rights

Under UK data protection law, you have the right to:

  • ask for a copy of the information we hold about you
  • ask us to correct information that is wrong or incomplete
  • ask us to delete your information (we may need to keep medical records for the period above)
  • ask us to restrict or object to how we use your information
  • ask for your information in a format you can take to another provider
  • withdraw your consent at any time, where we rely on it

To use any of these rights, email drnorton@thewellbeingmedic.com. We’ll respond within one month and there’s usually no charge.

8. Making a complaint

If you’re unhappy with how we’ve handled your information, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

9. Cookies

Our website is hosted by WordPress.com, which uses cookies to make the site work, keep it secure and understand how it’s used. You can control cookies through the cookie banner and your browser settings. Find out more in Automattic’s cookie policy.

10. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page. Please also see our terms and conditions.