Privacy Policy

Who we are

Demo Clinic is a demonstration website, not a real clinic. There is no real business behind it, and every name, address, phone number and email address on this site is a placeholder. This policy is included to show how a real clinic's privacy policy would read, and to describe accurately how this demonstration site itself behaves.

On a live site, this section would name the clinic, its address, and the contact details of the data controller.

This policy explains what we collect, why we collect it, how long we keep it, and the rights you have under the UK GDPR and the Data Protection Act 2018.

The information we collect

When you enquire or book a consultation

• Your name, telephone number and email address
• The treatment you are interested in and anything you tell us in your message
• Any appointment details we agree with you

When you attend the clinic

• Details of your hair and scalp, relevant medical history, medication and allergies where this is necessary for your safety and to advise you properly
• Clinical notes, consent records and, with your separate agreement, photographs

Information about your health — and photographs used for clinical purposes — is "special category" data under the UK GDPR and receives extra protection. We collect only what we need in order to advise you and treat you safely.

When you use this website

• Technical information needed to serve the site securely, such as your device type and approximate location derived from your IP address
• Analytics and marketing information, but only where you have given consent through our cookie banner. See our Cookie Policy.

Why we use it, and our lawful basis

• To respond to your enquiry and arrange a consultation — our legitimate interests in dealing with a request you have made to us, and, where you ask us to arrange treatment, performance of a contract with you.
• To assess your hair and scalp and provide treatment safely — for health information we rely on your explicit consent, and where relevant on Article 9(2)(h) of the UK GDPR (the provision of health or social care and treatment). You can withdraw consent at any time.
• To take and store clinical photographs — your explicit consent, recorded separately. Photographs are never used in marketing or on social media unless you have given specific, separate written consent, which you may withdraw.
• To keep records and meet legal or insurance obligations — compliance with a legal obligation and our legitimate interests in defending claims.
• To send marketing emails or messages — your consent. Every message includes an unsubscribe option.
• To measure website use and advertising — your consent, given through the cookie banner.

Who we share it with

We do not sell your personal information. We share it only where necessary, with:

• Service providers who help us operate — for example our website host, email provider, appointment or booking software and, where relevant, a clinical partner involved in your treatment. They act on our instructions under a written agreement.
• Professional advisers, insurers or regulators where we are required or permitted to do so.

Some providers may process data outside the UK. Where that happens, we make sure appropriate safeguards are in place, such as UK adequacy regulations or the International Data Transfer Agreement.

How long we keep it

• Enquiries that do not lead to an appointment — up to 12 months, then deleted.
• Client and treatment records, including consent forms — normally 8 years from your last appointment, in line with recognised guidance for adult health records. For clients treated under the age of 18, until their 25th birthday.
• Clinical photographs — kept with the treatment record and deleted at the same time, or sooner if you withdraw consent.
• Marketing consents and unsubscribe records — for as long as needed to honour your preference.
• Cookie consent records — up to 12 months, after which we ask you again.

How we protect it

Records are held on access-controlled systems with encrypted connections, and paper records are kept securely on the premises. Only the practitioner and, where necessary, staff involved in your care can access clinical records.

Your rights

You have the right to:

• Ask for a copy of the personal information we hold about you
• Have inaccurate information corrected
• Ask us to delete information, where we are not required to keep it
• Ask us to restrict or object to how we use it
• Ask us to transfer information you gave us to another provider
• Withdraw consent at any time, including consent to photographs or marketing

On a live site, this section would tell you how to exercise those rights and who to contact. Nothing you send through this demonstration site reaches a real clinic. We will respond within one month.

Complaints

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority: ico.org.uk/make-a-complaint or 0303 123 1113.

Changes to this policy

We review this policy periodically and will update the date above whenever it changes.