This policy explains what personal information Cardiff Hair Clinic collects about you, why we need it, how we use it, who we share it with, and the rights you have over it.

Cardiff Hair Clinic is a hair transplant surgery clinic based at 107 Clare Road, Cardiff, CF11 6QQ, led by Dr Frances Bowerman MBBS MRCS, Hair Transplant Surgeon and Medical Director. For the purposes of UK data protection law, Cardiff Hair Clinic is the “Data Controller” of the personal data described in this policy.

If you have any questions about this policy or how we handle your information, you can contact us at:

– Email: cardiffhair@gmail.com

– Phone: 07549599784

– Post: Cardiff Hair Clinic, 107 Clare Road, Cardiff, CF11 6QQ

We collect personal data when you contact us, use our enquiry/booking form, or otherwise get in touch about a consultation. This includes:

– Your name, email address and phone number

– Your age (partly so we can make sure any care we provide is age-appropriate)

– The area of hair loss or concern you tell us about, and any consultation-type you select

– How you heard about us

– Any further details you choose to share in the free-text message field

– Records of any calls, emails or messages you send us

Some of what you tell us — particularly the area of concern you select and anything you write in the message field — is “special category” data under UK GDPR because it relates to your health. We only collect and use this information with your explicit consent, given when you tick the consent box on our enquiry form or otherwise confirm you’re happy for us to hold it. You can withdraw this consent at any time by contacting us, though this may affect our ability to progress your enquiry or ongoing care.

We do not use your information for automated decision-making or profiling that has a legal or similarly significant effect on you.

If you agree to before-and-after photographs being taken as part of your treatment, we will only use these for marketing purposes (on our website, in print or on social media) with your separate, specific consent, obtained at the time. You can withdraw this consent and ask us to stop using your images at any time — we will do so as soon as reasonably practicable, though we cannot recall material already printed or shared before your request. Photographs taken for clinical record purposes only, without your marketing consent, are kept confidential and are never published.

Our website may use:

– Strictly necessary cookies — required for the site to function (for example, remembering your cookie preferences).

– Analytics — we use Independent Analytics and Google Analytics to understand how visitors use our site. Independent Analytics processes this data on our own server and does not set tracking cookies or share data with third parties. Google Analytics does use cookies and will only run once you’ve given consent through our cookie banner.

– reCAPTCHA — our enquiry form uses Google reCAPTCHA to prevent spam and automated abuse. This involves Google processing some technical data (such as your IP address and device information).

You can control or withdraw cookie consent at any time through our cookie banner or your browser settings. Turning off non-essential cookies won’t stop you using the site, but may reduce some functionality.

– Enquiries that don’t proceed to a consultation or treatment: kept for up to 12 months from your last contact with us, then deleted or anonymised, unless you ask us to remove them sooner.

– Patient and clinical records: kept in line with professional record-keeping guidance for surgical practitioners — generally a minimum of 8 years from the end of treatment (longer if you were under 18 at the time of treatment).

– Marketing images used with consent: kept until you withdraw consent or we no longer need them for the agreed purpose.

– Financial and accounting records: kept for 6 years, in line with UK tax record-keeping requirements.

We don’t sell your personal data. We may share it with:

– Our website hosting and technical support provider, who process data on our behalf and under contract.

– Our email provider, where enquiry details are sent to our clinic inbox.

– Google, in connection with the analytics and spam-protection tools described above.

– Regulators, professional bodies or legal authorities, where we’re required to by law.

– Any other party you’ve specifically asked us to share your information with.

Some of the tools we use (including Google Analytics and Google reCAPTCHA) are provided by companies based in the United States. Where personal data is transferred outside the UK, we rely on a recognised UK data protection safeguard — such as the UK’s data bridge arrangement with the US, or standard contractual clauses — to keep your information protected to a UK standard.

We use appropriate technical and organisational measures to protect your personal data, including secure website hosting, restricted access to clinical and enquiry records, and confidentiality obligations on anyone who handles your information on our behalf.

Under UK GDPR, you have the right to:

– Ask what personal data we hold about you and get a copy of it (right of access)

– Ask us to correct inaccurate or incomplete information (right to rectification)

– Ask us to delete your information, where we have no continuing lawful reason to keep it (right to erasure)

– Ask us to restrict or object to certain processing

– Withdraw consent at any time, where we rely on consent

– Ask for your information in a portable format, where relevant

– Complain to the Information Commissioner’s Office (ICO) if you’re unhappy with how we’ve handled your information — visit ico.org.uk or call 0303 123 1113

To exercise any of these rights, contact us using the details above. We’ll respond within one month.

Our services are intended for adults. If you’re under 18 and have a concern about hair loss, please ask a parent or guardian to contact us on your behalf.

We may update this policy from time to time. The latest version will always be available on this page.