Privacy Policy
This privacy notice explains how Harley Street Hair Transplants collects, uses, stores and shares personal information when you visit our website, make an enquiry, attend a consultation, receive treatment or otherwise communicate with us.
Last updated: 10 August 2026
Who We Are
Harley Street Hair Transplants is responsible for deciding how personal information covered by this notice is used for our clinic, consultation and patient-administration activities.
Because hair-restoration enquiries and treatment may involve medical information, some of the information we process may be health data, which receives additional protection under UK data-protection law.
Information We May Collect
The information we need depends on whether you are browsing the website, asking a question, arranging a consultation, receiving treatment or contacting us about an existing patient matter.
Identity & Contact Details
- Name and title.
- Date of birth where required.
- Postal address and postcode.
- Email address and telephone number.
- Preferred consultation location.
- Emergency or representative contact details where appropriate.
Medical & Treatment Information
- Hair-loss history, pattern and areas of concern.
- Relevant medical history and current health conditions.
- Medication, allergies and previous procedures.
- Scalp and donor-area information.
- Consultation, treatment and aftercare records.
- Clinical observations and treatment planning information.
- Information relating to healing, recovery or follow-up.
Photographs & Files
- Hairline, crown, donor-area or scalp photographs you provide.
- Pre-treatment and postoperative clinical photographs.
- Documents or files submitted with an enquiry.
- Other images required for consultation, treatment or follow-up.
Appointments & Communications
- Appointment and consultation records.
- Email, telephone, form and message correspondence.
- Records of advice, discussions, decisions and consent.
- Complaints, feedback and other correspondence.
- Records relating to aftercare and follow-up communication.
Payment & Administrative Information
- Payment and transaction information.
- Invoices, quotations and treatment-cost records.
- Finance-related information where relevant to an application.
- Booking and appointment administration.
- Records required for accounting, fraud prevention or legal purposes.
Website & Technical Information
- IP address and approximate device or browser information.
- Website usage and navigation information.
- Cookie and consent preferences.
- Technical logs used for security and website operation.
- Information submitted through website forms.
Special-Category Health Information
Information about your physical or mental health is classed as special-category personal data under UK data-protection law. Where we process health information, we only do so where there is an appropriate lawful basis and an applicable special-category condition, and we apply additional confidentiality and security safeguards where required.
How and Why We Use Personal Information
We only use personal information where there is a lawful reason to do so. The basis used depends on the purpose and the circumstances.
To respond to questions, review information you provide, arrange appointments and take steps at your request before treatment is agreed.
Legitimate interests where appropriate
To assess hair-loss concerns, donor-area suitability, medical history, potential treatment options and relevant clinical risks.
plus an applicable Article 9 health-data condition
To provide agreed clinical services, document treatment, manage follow-up, provide aftercare and maintain appropriate patient records.
plus applicable health-care or other Article 9 condition
To provide quotations, process payments, maintain financial records and administer appointments or treatment bookings.
Legal obligation
To respond appropriately where information is relevant to patient safety, medical risk, emergency care or safeguarding.
plus applicable Article 9 condition
To investigate concerns, respond to complaints, maintain evidence, obtain professional advice and establish, exercise or defend legal claims.
and legal-claims condition where applicable
To maintain website functionality, prevent misuse, diagnose technical issues and protect our systems and users.
Consent where required for cookies
To send information about services where you have agreed to receive it or where electronic-marketing rules otherwise permit us to contact you.
subject to PECR
Health Data and Article 9
Health information receives additional protection. Where health data is necessary for assessment, clinical care or treatment, processing must also satisfy an applicable condition under Article 9 of the UK GDPR and, where required, the Data Protection Act 2018. Depending on the circumstances, this may include the health-or-social-care condition, explicit consent, vital interests or the establishment, exercise or defence of legal claims.
Where Information Comes From & Who We Share It With
Most personal information is provided directly by you, although there are circumstances where information may be received from another authorised or relevant source.
Where We Obtain Information
- Directly from you through forms, calls, emails or messages.
- During consultations, appointments and treatment.
- From photographs, documents or files you provide.
- From a representative, family member or carer where they are authorised to communicate for you.
- From a healthcare professional or provider where this is appropriate and lawful.
- From our website and associated technical systems.
Who We May Share Information With
- Clinicians and healthcare professionals involved in your assessment, treatment or aftercare.
- Healthcare providers where information is required for appropriate care or referral.
- Appointment, communications, IT, cloud-storage, website or administrative service providers acting for us.
- Payment or finance service providers where required to process a transaction or application.
- Professional advisers such as legal, insurance or accounting advisers where necessary.
- Regulators, courts, law-enforcement bodies, emergency services or public authorities where disclosure is required or permitted by law.
Confidentiality
Clinical and health information is handled confidentially. We only share information where there is an appropriate reason to do so, and we aim to limit disclosure to information that is relevant and necessary for the purpose.
We do not sell patient personal information.
International Data Transfers
Some technology or service providers may process personal information outside the United Kingdom. Where a restricted international transfer takes place, we will use an appropriate lawful transfer mechanism, such as UK adequacy regulations or recognised contractual safeguards, where required by UK data-protection law.
You may contact us if you would like further information about safeguards relevant to an international transfer of your personal information.
How Long We Keep Personal Information
We keep personal information only for as long as it is reasonably required for the purpose for which it was collected and for applicable legal, clinical, accounting, insurance or regulatory requirements.
Retained for an appropriate period according to whether the enquiry progresses to consultation or treatment and whether the information is needed for follow-up, administration or legal purposes.
Retained according to applicable legal, professional, clinical, insurance and record-keeping requirements relevant to the care provided.
Retained for the period required by applicable accounting, taxation, payment and legal obligations.
Retained for as long as reasonably necessary to investigate and resolve the matter and to establish, exercise or defend legal rights.
Retained while relevant to the marketing relationship. Where you opt out, we may retain sufficient information on a suppression list to ensure your preference continues to be respected.
Retention depends on the purpose, security requirements and the settings of the relevant website, analytics or cookie technology.
How We Protect Your Information
We use appropriate technical and organisational measures intended to protect personal information against unauthorised access, accidental loss, misuse, alteration or disclosure.
Access to patient and clinical information should be limited to people who need the information for their role or an authorised purpose. However, no internet transmission or electronic-storage system can be guaranteed to be completely secure.
Patient Photographs
Photographs supplied for consultation, clinical assessment, treatment or follow-up may form part of the relevant patient record. Clinical use of photographs is separate from publication or promotional use.
Where an identifiable patient photograph is proposed for marketing, website, social-media or promotional use, an appropriate separate permission or lawful basis should be established for that use.
Your Data-Protection Rights
Your rights depend on the circumstances and the lawful basis being used. Some rights are subject to legal exemptions or limitations.
You can ask whether we hold personal information about you and request a copy of information you are entitled to receive.
You can ask us to correct personal information that is inaccurate or complete information that is incomplete.
In certain circumstances you can ask for personal information to be deleted. This right does not apply where information must lawfully be retained.
In certain circumstances you can ask us to restrict how personal information is used.
You may have the right to object to processing based on legitimate interests or certain other grounds.
Where the legal requirements are met, you may request certain information in a structured, commonly used and machine-readable form.
Where we rely on consent, you can withdraw that consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.
You can raise concerns directly with us and you also have the right to complain to the Information Commissioner's Office.
Your Right to Object to Direct Marketing
You can object to the use of your personal information for direct marketing at any time. You can also use the unsubscribe or opt-out method included with relevant marketing communications.
Making a Data-Rights Request
Contact us using the details below and explain what you are requesting. We may need enough information to confirm your identity before disclosing personal information.
Data-rights requests are handled in accordance with the applicable UK data-protection time limits. A subject-access request normally has to be dealt with without undue delay and within one month, subject to the statutory rules that may apply in particular circumstances.
Marketing Communications
We may contact you about relevant services where you have consented or where another lawful electronic-marketing route is available under applicable law.
You can change your marketing preference at any time by contacting us or using an unsubscribe facility where one is provided.
Cookies & Similar Technologies
Our website may use cookies and similar technologies for essential functionality, security, preferences, measurement or other website functions.
Strictly necessary technologies may operate without consent where the law permits. Where consent is legally required for non-essential cookies or similar technology, an appropriate consent mechanism should be used before that technology is activated.
How to Make a Privacy Complaint
If you have concerns about the way Harley Street Hair Transplants has handled your personal information, please contact us first so the matter can be reviewed.
You also have the right to complain to the Information Commissioner's Office. The ICO can also be contacted on 0303 123 1113.
Changes to This Privacy Policy
We may update this privacy notice where our services, systems, legal obligations or use of personal information changes. The latest version will be published on this page and the update date should be revised when material changes are made.
Privacy Contact Details
Contact Harley Street Hair Transplants if you have a privacy question, wish to exercise a data-protection right or want to raise a concern about the handling of your information.
Harley Street Hair Transplants
22a Harley Street
London W1G 9PF