dIGITAL PATIENT SAFETY

A specialist data protection assessment for aesthetic clinics

The Digital Patient Safety Assessment: know exactly where your clinic stands on UK data protection law

You give your patients the highest standard of care. This assessment extends that high standard to the personal data that they trust you with, so you can grow, adopt new technology, and answer patient or supplier questions with confidence.

The Digital Patient Safety Assessment is a specialist review of your clinic against the UK GDPR, the Data Protection Act 2018 and Privacy and Electronic Communications Regulations, as amended by the Data (Use and Access) Act 2025. It's built for all businesses that handle health data, where patient photos, health information, social media and AI tools make data protection a bigger risk than most clinicians realise.

What you get

• A maturity rating: see where your clinic sits on our five-stage scale, from Forming to Leading
• Every risk, explained: a clear account of each data protection risk and issue found, including in your use of AI and medical devices, with fixes that suit your stage of growth
• Clear priorities: risks ranked so you tackle the biggest ones first
• A 12-month roadmap: what to do, when, and how each step raises your maturity

We prioritise recommendations by both risk and commercial benefit, so you can act with confidence.

What we look at

We review how you manage all the personal data your business uses, with a deeper focus on the areas that matter most in the aesthetics sector:

• Lawful basis and data mapping across patient records, booking and clinical systems
• How you collect data and what you tell patients, in person, online and on social media
• Cookies, tracking technologies, WhatsApp and push notifications
• Data generated or recorded by medical devices
• Use of AI tools, including skin analysis and imaging, consultation note-taking, chatbots and automated replies, treatment simulations, and staff use of general AI tools such as ChatGPT, Gemini or Claude
• Clinical photography and other health data
• Records of processing and accountability, including who can access patient records
• Data Protection Impact Assessments and high-risk processing
• Patient rights, including access requests, corrections and consent
• Supplier contracts and data sharing, covering booking platforms, clinical software, marketing tools and other processors
• Breach readiness and incident response, weighted to the reputational and contractual exposure of a patient data leak

If you operate in more than one country, the assessment can be extended to cover other jurisdictions.

AI in your clinic

AI is already part of everyday clinic life: skin analysis and imaging tools, consultation note-takers, chatbots answering DMs and booking enquiries, and apps that simulate treatment results.

We find where AI is in use across your clinic, including features built into devices and software you already have. We then check that each use is lawful, transparent to patients and properly contracted, so you can adopt new technology instead of discovering the risk after a complaint.

How it works

Scheduled meetings with key people in your clinic, a review of your website and social media presence, and a review of your existing policies and documentation.

This is a data protection assessment. It focuses on how you handle patient data under UK law, rather than clinical standards, health and safety, or CQC inspection readiness. Your findings can still help show good governance of patient information.

For further support 

Tygo's fractional DPO service picks up where the assessment leaves off, giving you senior data protection expertise on a retained basis without the cost of a full-time hire.

BCAM members receive 10% off the Digital Patient Safety Assessment.