Last updated: 6 October 2026. We review this policy every year, and whenever the site changes in a way that matters for your data.
This policy explains how LCAS processes the personal data of people who visit lcas.ae and of people who write to us through its forms. We process personal data in line with the data protection laws of the United Arab Emirates, including the rules on health information that apply in Dubai Healthcare City, and, where they apply to you, the EU or UK General Data Protection Regulation. When you become our patient, your medical records are covered by the patient privacy notice you receive at the clinic.
1. Who is responsible for your data
London Centre for Aesthetic Surgery Gulf FZ-LLC District 1, Building 64 (Block E, Suite 4017), Dubai Healthcare City, Dubai, United Arab Emirates Email: info@lcas.ae
2. The data we process
When you browse. The systems that run the site receive the technical data of every visit: IP address, browser and device, the page requested, date and time, and the page you came from. We use them to show you the pages, to protect the site from abuse and to find faults. Only with your consent do we also collect visit statistics with Google Analytics (see the Cookie policy).
When you write to us. The contact form asks for your name, email, phone number, country, age and your message. The consultation form asks for your name, email, phone number, the treatment area you are interested in, the days and time that suit you, how you prefer to be contacted and an optional message. The treatment area, and anything you write about your health, are health information: we use them only to answer you and prepare your consultation. Please keep medical details for the consultation itself.
When you message us on WhatsApp. If you use the WhatsApp links on the site, the conversation takes place on WhatsApp, a service of Meta, under its own terms and privacy policy.
Anti-spam check. To tell people from automated programs, the forms use Cloudflare Turnstile, which analyses technical signals from your browser, such as the IP address and device characteristics.
3. Why we process your data, and on what basis
| Purpose | Basis |
|---|---|
| Answering your request, calling you back and arranging your consultation | Your consent, given with the box in the form, and the steps you ask us to take before treatment |
| Running the site, protecting it from abuse and spam, fixing faults | Our legitimate interest in a safe, working site |
| Visit statistics (Google Analytics) | Your consent, given in the cookie banner |
| Meeting legal and regulatory obligations and defending our rights | Legal obligation and legitimate interest |
The data marked as required are needed to answer you: without them we cannot reply. Consent to statistics is optional; you can refuse or withdraw it at any time.
4. Who receives your data
Your data are processed by our authorised clinical and administrative staff. We also use providers who process data on our behalf, under contract:
- Cloudflare, Inc.: hosting and delivery of the site, security and the anti-spam check (Turnstile);
- The Rocket Science Group LLC (Mailchimp Transactional, “Mandrill”): sending the emails generated by the forms;
- Google Ireland Limited / Google LLC: Google Analytics (only with your consent) and Google Fonts;
- the providers that support our IT systems.
Data may be disclosed to the health and public authorities when the law requires it. We do not sell your data and we do not publish it.
5. Processing outside the United Arab Emirates
Some providers process data outside the UAE, for example in the European Union or the United States. We use providers that offer contractual safeguards for personal data and, where EU or UK law applies, rely on the transfer mechanisms it recognises. You can ask us about the safeguards in place.
6. How long we keep your data
- Requests sent through the forms: for as long as needed to handle the request and any follow-up; we then delete or anonymise them, unless the law requires us to keep them longer or we need them to protect our rights. If you become our patient, the retention rules for medical records apply.
- Technical browsing data: for short periods, as long as needed for security and fault finding.
- Statistics: according to the Google Analytics retention settings, 14 months at most.
7. Your rights
At any time you can ask us to:
- tell you whether we process data about you, and give you a copy;
- correct or complete them;
- delete them when they are no longer needed or when you withdraw consent, unless we must keep them by law;
- limit or stop their use;
- give them to you in a structured, commonly used format;
- withdraw your consent, without affecting processing already carried out.
Write to info@lcas.ae. We answer free of charge within one month. You can also complain to the competent data protection authority.
8. Cookies
The site uses technical cookies and, only with your consent, statistics cookies. The details are in the Cookie policy; you can change your choices at any time from Cookie settings.
9. Security
Communication with the site is encrypted (HTTPS), access to data is limited to the people who need it for their work, and our providers apply appropriate security measures.
10. Minors
The forms are meant for adults. If you are under 18, please ask a parent or guardian to contact us for you.
11. Changes
We may update this policy; the date at the top shows the version in force. If a change affects processing based on consent, we will ask for your consent again.