Privacy Policy for CliniHair

At CliniHair, protecting your privacy is a priority. This Privacy Policy explains what personal data we collect, how we use it, and your rights under UK law.

If you have any questions, please contact us at the details provided at the end of this policy.

1. Who We Are

CliniHair is a private trichology clinic based in Southampton, Hampshire, providing hair and scalp consultations and related clinical services. CliniHair is the data controller for the purposes of UK GDPR.

12 Royal Mail House, Terminus Terrace, Southampton SO14 3FD 07435963096 | clinihair.co.uk

2. What Information We Collect

We may collect and process the following personal data:

• Identity and contact data: name, date of birth, email address, telephone number
• Health and clinical data: medical history, medications, hair and scalp conditions, consultation notes, treatment plans, and blood test results you share with us
• Payment data: processed securely via Stripe: CliniHair does not store card details directly
• Booking data: appointment details processed via Halaxy
• Technical data: IP addresses, browser type, and basic website usage data

3. Legal Basis for Processing

We process your personal data under UK GDPR on the following lawful bases:

• Contractual necessity: to provide and manage your consultation and clinical services
• Legal obligation: to comply with applicable laws and professional regulatory requirements
• Legitimate interests: to improve our services, maintain website security, and communicate with you about your care
• Consent: where you have given explicit consent, including for marketing communications

Special category (health) data is processed under UK GDPR Article 9(2)(h), processing necessary for the provision of health care and where applicable, on the basis of your explicit consent under Article 9(2)(a).

4. How We Use Your Data

We use your personal data to:

• Provide trichology consultations and related clinical services
• Manage appointments and process payments
• Communicate with you regarding your care and appointments
• Comply with our legal and professional obligations
• Improve our website and services

We will only use your data for the purposes for which it was collected, or for compatible purposes where permitted by law.

5. Third-Party Processors

We use the following third-party services to help deliver our services. These act as data processors on our behalf and are contractually bound to handle your data securely:

• Halaxy: appointment booking and practice management
• Stripe: secure payment processing

We do not sell your personal data to any third party. We may share data with other healthcare professionals involved in your care, or where required by law.

6. Data Retention

We retain personal and clinical data in line with professional and legal guidance:

• Adult clinical records: 8 years from the date of last treatment
• Children’s clinical records: until the patient’s 25th birthday (or 26th if treatment was ongoing at age 17)
• Financial records: 7 years in line with HMRC requirements

When data is no longer required, it will be securely deleted or anonymised.

7. Children

CliniHair offers paediatric trichology consultations. Where a patient is under 18, consent for the collection and processing of their clinical data is obtained from a parent or legal guardian. We do not knowingly collect personal data from children for any other purpose without appropriate parental consent.

8. Cookies

This website may use technically necessary cookies to ensure basic functionality, such as session management. We do not currently use tracking, analytics, or advertising cookies. If this changes, this policy will be updated accordingly. You may control or disable cookies at any time through your browser settings.

9. Your Rights

Under UK GDPR, you have the right to:

• Access: request a copy of the personal data we hold about you
• Rectification: request correction of inaccurate or incomplete data
• Erasure: request deletion of your data, subject to legal and professional retention obligations
• Restriction: request that we limit how we process your data in certain circumstances
• Portability: receive your data in a structured, machine-readable format
• Object: object to processing based on legitimate interests or for direct marketing
• Withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, please contact us at the details below. We will respond within one month.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

10. Security

We implement appropriate technical and organisational measures to protect your data from unauthorised access, disclosure, or loss. No method of online transmission is entirely secure, and we cannot guarantee absolute security, but we take our obligations seriously.

11. Changes to This Policy

This policy may be updated periodically to reflect changes in our practices or legal requirements. The current version will always be available at clinihair.co.uk/privacy-policy with the date of last revision.

12. Contact

CliniHair 12 Royal Mail House, Terminus Terrace, Southampton SO14 3FD, 07435963096 | clinihair.co.uk

Last updated: March 2026