This policy explains how ARRA handles personal information when you visit arra.london, contact us or receive our services.
Last updated: 22nd September 2026
ARRA is operated by Aurea Miralux Ltd, company number 16657689.
Registered office: 6 Dering Street, London W1S 1AD.
Contact: contact@arra.london
We collect contact, booking and payment details, medical history, consent forms, treatment records, images and correspondence from you, our systems and professionals involved in your care. Website use may generate device, usage and cookie data. We use this information for enquiries, appointments, treatment, aftercare, payments and record keeping. Without information needed for safe care, treatment may not be possible. We rely on contractual necessity for bookings and care, legal obligations for required records, and legitimate interests for enquiries, security and complaints, balanced against your rights. Health information requires an additional condition: healthcare under professional confidentiality, legal claims, or explicit consent where applicable. Marketing requires consent; essential booking and care messages are separate.
Before-and-after photographs and Aura scans are confidential clinical records. Identifiable promotional images require separate, explicit consent. Aura supports assessment; your practitioner makes treatment decisions.
We use Semble for bookings and Aura for skin imaging. Necessary information may be shared with authorised staff, healthcare professionals, service providers, advisers, insurers or authorities for legitimate purposes, under appropriate confidentiality and security arrangements. We do not sell patient information.
Semble lists UK/EU hosting and some US processing; Aura lists European cloud processing and support in Europe, Switzerland and India. Locations depend on enabled services and support. Their published terms provide for UK adequacy arrangements or appropriate transfer safeguards, including UK-approved contractual clauses where required. Contact us for relevant safeguard details.
We use appropriate security measures. Clinical retention depends on treatment, patient age, professional guidance and claim requirements; financial records follow tax requirements. Enquiries are kept through resolution and necessary follow-up. Marketing records are kept while relevant, with limited opt-out records retained to respect your wishes. Records are securely deleted or anonymised when no longer needed.
Subject to legal exceptions, you may request access, correction, deletion, restriction or portability, object to processing, or withdraw consent without affecting earlier lawful use. You may always object to direct marketing. Necessary clinical records may be retained. Email contact@arra.london; we normally respond within one month. You may complain to the ICO at ico.org.uk/make-a-complaint/.
We use essential cookies for website functions and request consent for optional analytics and advertising cookies. You can change your choices through Cookie Settings. We update this policy when our practices change.
