Privacy Policy
Fix My Hair (“we”) is a UK hair-restoration clinic operating under GMC-registered doctor oversight. This notice explains what personal data we collect on this site and in our clinic portal, why, how long we keep it, and the rights you have under UK GDPR and the Data (Use and Access) Act. Last updated: 18 July 2026.
What we collect, and why
Your enquiry. When you complete the hair-loss assessment or a contact form we collect your name, phone number, email, your quiz answers and any photos you choose to add. Quiz answers and scalp photos are health information — special-category data — and we process them only with your explicit consent, given via the required checkbox, to prepare your assessment and contact you about it (UK GDPR Articles 6(1)(a) and 9(2)(a)). Photos are re-encoded on your device before upload, which strips camera location (EXIF/GPS) metadata, and are stored in a private, access-audited medical store — never a public link.
Bookings. If you book a consultation we receive the booking details (name, email, chosen time) from our scheduling provider, Cal.com, and attach them to your enquiry so the clinical team is ready for your call.
Booking reminder (optional).If you enquire but haven’t booked a consultation within an hour, and you ticked the optional marketing checkbox, we pass your first name and email address — once, and nothing else — to our email platform so it can send you a reminder with your booking link. Without that consent this never happens.
Calls. Consultation calls may be recorded for clinical accuracy — you hear a disclosure at the start of any recorded call. Recordings live in a private store with time-limited access.
Ad measurement (optional). Only if you accept measurement in the cookie banner, we keep a first-party record of which ad brought you here (e.g. a Google click ID). Only if you additionally tick the optional marketing checkbox, we confirm enquiry milestones back to Google and Meta using a one-way hash of your email/phone — never your quiz answers, photos, or any clinical detail. Neither ever happens by default.
How long we keep it
| Data | Kept for | Why |
|---|---|---|
| Enquiries that don’t become patients (including quiz answers, photos and unmatched bookings) | 12 months from your last activity | Storage limitation — automatically erased after the window |
| Patient medical records | 8 years from last activity | UK adult medical-record retention guidance |
| Records of your consent choices | Duration of the above | Legal proof that consent was given (or refused) |
Erasure is engine-driven: every column holding personal data is registered in a classification registry that drives our automated erasure, export and retention jobs — nothing depends on someone remembering a table.
Cookies & on-device storage
| Name | Type | Lifetime | Purpose |
|---|---|---|---|
| fmh_consent | Strictly necessary | 6 months | Remembers your Accept/Reject choice |
| fmh_attr | Consent-gated (measurement) | 90 days | First-party record of the ad click that brought you here. Never set before you accept; deleted if you reject or withdraw |
| fmh_attribution / fmh_lp_assessment | Session storage (this tab only) | Until the tab closes | Carries your consented ad-click record to the enquiry form; personalises your results on this visit. Never sent anywhere else |
| Login cookies | Strictly necessary | Session | Keep patients and staff signed in to the secure portal |
There are no third-party advertising or analytics scripts on this site — our security policy blocks them outright. Anonymous, cookie-free page-speed measurements are collected in aggregate to keep the site fast.
Who processes data for us
Your data stays inside our clinical systems, run by vetted processors under contract: Supabase (encrypted database & media storage), Vercel (site hosting), Twilio (calls, SMS & WhatsApp), Cal.com (consultation scheduling — loads only when you choose to book), Stripe (payments), Resend (email), and OpenAI / Anthropic (transcribing and summarising consultation calls for the clinical record). Google and Meta receive hashed conversion confirmations only with your marketing consent, as described above. We never sell your data.
Your rights
You can ask for a copy of your data, correct it, have it erased, restrict or object to processing, and withdraw any consent at any time — withdrawing is as easy as giving it, and never affects the care you receive. To exercise any right, call or WhatsApp us on 07575 570528or write to the clinic team via fixmyhair.co.uk. We respond within one month. If you are unhappy with our answer you can complain to the Information Commissioner’s Office at ico.org.uk.