Privacy Policy
This privacy policy explains how Edinburgh Hair Transplant Clinics collects, uses, shares, stores and protects personal information when you visit our website, contact the clinic or request information about hair-restoration services.
It also explains your rights under the UK General Data Protection Regulation, the Data Protection Act 2018 and applicable electronic-communications law.
Last updated: 3 October 2026
Contents [show] [hide]
Who We Are and Who Controls Your Data
Edinburgh Hair Transplant Clinics operates this website and is responsible for personal information collected through the website, enquiry forms and general clinic communications.
In data-protection terminology, we act as the data controller for this information because we determine why and how it is used.
83 Princes St
Edinburgh EH2 2ER
Personal Information We May Collect
The information we collect depends on how you use the website and whether you proceed from a general enquiry to a consultation or treatment.
Identity and contact details
- name;
- telephone number;
- email address;
- postal address where required;
- preferred method of contact.
Enquiry information
- the treatment you are interested in;
- preferred clinic or appointment information;
- messages submitted through contact forms;
- emails, telephone calls and messages;
- consultation requests and responses.
Hair and health information
- hair-loss history and treatment goals;
- photographs you choose to provide;
- medical conditions or medication;
- previous treatments or procedures;
- other health information relevant to suitability.
Transaction information
- quotations and payment status;
- appointment and booking information;
- invoices and financial records;
- refund or cancellation information.
Card payments may be processed by a specialist payment provider. We do not normally receive or store complete card details.
Technical website information
- IP address;
- browser and device type;
- pages visited and referring website;
- cookie preferences;
- security and diagnostic logs.
Communication preferences
- marketing consent or opt-out status;
- preferred communication channel;
- records of consent;
- records of objections or suppression requests.
Purposes and Lawful Bases
Data-protection law requires us to identify a lawful basis for each purpose for which we use personal information.
| Purpose | Information used | Lawful basis |
|---|---|---|
| Responding to enquiries and arranging consultations | Identity, contact details, enquiry details and relevant photographs | Steps taken at your request before entering a contract and our legitimate interest in responding to enquiries. |
| Providing appointments, consultations or agreed services | Contact, booking, treatment and transaction information | Performance of a contract or steps requested before entering a contract. |
| Assessing possible treatment suitability | Hair-loss information, photographs and relevant health information | Contract or pre-contract steps, together with an appropriate special-category condition such as explicit consent or healthcare purposes. |
| Maintaining necessary clinical, regulatory, tax or accounting records | Consultation, treatment, transaction and identity information | Legal obligation, contract and, where relevant, healthcare purposes. |
| Operating, protecting and improving the website | Technical information, logs, device information and usage data | Legitimate interests in website operation, security, fraud prevention and service improvement. |
| Sending marketing communications | Name, contact details and marketing preferences | Consent or legitimate interests where electronic-communications law permits it. |
| Managing complaints, disputes and legal claims | Relevant communications, records, transaction and treatment information | Legal obligation, legitimate interests and the establishment, exercise or defence of legal claims. |
Health Information and Special-Category Data
Information about your health is treated as special-category personal data under UK data-protection law and receives additional legal protection.
You may voluntarily provide health information when asking whether a hair transplant, PRP treatment, medication discussion or another hair-restoration service might be suitable.
Why health information may be required
- to understand the nature of your hair loss;
- to identify information relevant to treatment suitability;
- to communicate your enquiry to an appropriate clinician;
- to protect your health and safety;
- to maintain necessary consultation or treatment records.
How it is protected
- access is limited to people who need the information;
- service providers must handle information under appropriate obligations;
- clinical providers are expected to maintain professional confidentiality;
- we minimise the information requested;
- we do not use health information for unrelated advertising.
Who We May Share Personal Information With
We do not sell personal information. We only share it where there is a legitimate operational, clinical, contractual or legal reason.
Clinicians and healthcare providers
Relevant information may be shared with surgeons, clinicians, treatment facilities, prescribing services or other healthcare providers involved in assessing or delivering requested services.
Technology and communications providers
This may include website hosting, form delivery, email, telephone, messaging, customer-management, cloud storage, anti-spam and IT-support providers.
Payment and booking providers
Relevant information may be shared with payment processors, appointment systems, accounting providers or finance providers where you use those services.
Website integrations
Review widgets, maps, videos, analytics tools, social-media links and messaging tools may receive technical information when they are loaded or used.
Professional advisers
We may share information with accountants, insurers, solicitors, auditors or other professional advisers where reasonably necessary.
Authorities and legal recipients
Information may be disclosed where required by law, court order, regulatory requirement, safeguarding obligation or the establishment, exercise or defence of legal claims.
Service providers acting on our instructions are expected to use personal information only for the agreed purpose and to maintain appropriate security and confidentiality.
International Data Transfers
Some website, cloud, communications, analytics or software providers may process information outside the United Kingdom.
Where personal information is transferred internationally, we require an appropriate legal mechanism. Depending on the destination and provider, this may include:
- a UK adequacy regulation;
- the UK International Data Transfer Agreement;
- the UK Addendum to approved contractual clauses;
- another legally recognised transfer safeguard;
- a limited statutory exception where legally permitted.
You may contact us for further information about safeguards relevant to your personal information.
Data-Retention Periods
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, regulatory, clinical, accounting, security and dispute-resolution requirements.
| Record category | Typical retention approach |
|---|---|
| General website enquiries | Normally up to 24 months after the last substantive contact, unless the enquiry progresses or a longer period is reasonably required. |
| Consultation and clinical records | Kept according to applicable legal obligations, professional guidance and the relevant clinical provider’s record-retention schedule. |
| Booking, transaction and accounting records | Retained for the period required by tax and accounting law, commonly up to six years. |
| Marketing records | Retained until consent is withdrawn, an objection is made or the information is no longer required. Suppression records may be retained to respect an opt-out. |
| Complaints and legal disputes | Retained for the duration of the matter and any relevant legal, regulatory or limitation period. |
| Security and technical logs | Normally retained only for the period needed for security, diagnostics and fraud prevention, commonly no longer than 12 months. |
Information may be deleted, anonymised or retained for longer where a legal hold, safeguarding matter, regulatory requirement or legal claim applies.
Security Measures
We use reasonable technical and organisational measures designed to protect personal information from accidental loss, unauthorised access, alteration, disclosure or destruction.
Access controls
Access should be limited to staff, clinicians and providers who require the information for an authorised purpose.
Secure systems
Measures may include encrypted connections, protected accounts, access logging, backups and security updates.
Supplier controls
Relevant service providers are expected to maintain appropriate security and process information under agreed instructions.
No internet transmission or storage system can be guaranteed to be completely secure. Please avoid sending unnecessary sensitive information by ordinary email or messaging services.
Children’s information
This website is not intended for children to submit treatment enquiries independently.
Where an enquiry concerns a person under 18, we may require involvement from a parent, guardian or other person with appropriate legal authority.
Automated decisions
We do not intend to make decisions producing legal or similarly significant effects solely through automated processing.
Treatment suitability should involve appropriate human assessment rather than being determined solely by an automated tool.
Your Data-Protection Rights
Depending on the circumstances and lawful basis, you may have the following rights:
Access
Request a copy of personal information we hold about you.
Correction
Ask us to correct inaccurate or incomplete personal information.
Erasure
Ask us to delete information where the legal conditions for erasure apply.
Restriction
Ask us to restrict certain uses of information in qualifying circumstances.
Objection
Object to processing based on legitimate interests or to direct marketing.
Data portability
Request qualifying information in a structured, commonly used and machine-readable format.
Withdrawing consent
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.
Making a rights request
Contact us using the details below and clearly describe the information or action you are requesting.
We may request proportionate evidence of identity before releasing information. Data-protection rights are not absolute, and legal exemptions may apply.
Use the postal address in the contact details section above.
Data-Protection Complaints
You may complain to us if you believe we have not handled personal information in accordance with data-protection law.
Please email info@edinburghhairtransplantclinics.co.uk with the subject line Data Protection Complaint.
Include:
- your name and contact details;
- a clear description of your concern;
- relevant dates, correspondence or supporting evidence;
- the outcome you are seeking.
We will acknowledge receipt of a data-protection complaint within 30 days and will take appropriate steps to investigate and respond without undue delay. We will keep you informed if the matter requires additional time.
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Changes to This Privacy Policy
We may amend this policy when our services, systems, suppliers or legal obligations change.
The latest version will be published on this page with an updated revision date. Material changes may also be communicated through the website or directly where appropriate.
