How we look after your information.

1. Who we are

Tess Hair & Scalp Clinic Ltd (company number NI692168), trading as Tess Hair and Scalp Clinic, is a hair loss and scalp clinic at 77A Botanic Avenue, Belfast, BT7 1JL. We are the “data controller” for the personal information described in this policy. You can contact us about your data at tesshairandscalpclinic@gmail.com or on 028 9096 4731.

2. What information we collect

• Contact details: your name, phone number, email address and, if you give it, your postal address.
• Booking details: the treatments you book, appointment times, deposits and payments, and any notes you add to a booking.
• Health information (special category data): details about your hair and scalp concerns, medical history, medications, allergies, recent blood tests, pregnancy or recent childbirth, and photographs of your scalp taken during consultations. We only collect this so we can assess and treat you safely.
• Website use: basic, anonymised statistics about how our website is used (pages visited, device type). We do not use advertising cookies.
• Marketing preferences: whether you have asked to receive our newsletter.

3. Why we use it, and our legal basis

• To provide your consultation and treatment — necessary to carry out our contract with you (UK GDPR Article 6(1)(b)).
• To use your health information for your assessment and treatment — with your explicit consent (Article 9(2)(a)), which we ask for on our forms and at your first appointment. You can withdraw consent at any time, but without this information we may not be able to treat you safely.
• To take deposits and payments, and keep accounts — our legal obligations (Article 6(1)(c)).
• To reply to enquiries, and to remind you about appointments — our legitimate interests in running the clinic (Article 6(1)(f)).
• To send you our newsletter — only with your consent, which you can withdraw at any time using the unsubscribe link.

4. Who we share it with

We never sell your information. We share it only with the services we use to run the clinic, who process it on our instructions:

• Wix — hosts our booking system, online shop, enquiry forms and email newsletter.
• Vercel — hosts our website.
• Fresha — our appointment system used for bookings made through Google.
• Wix Payments and Stripe — process card payments. We do not see or store your full card number.
• Google — our website fonts are loaded from Google Fonts. If you follow our “Open in Google Maps” link, Google’s own privacy policy applies there.
• Our accountant, and professional advisers where needed. We may also share information if the law requires it.

Some of these providers store data outside the UK. Where they do, they use UK-approved safeguards (such as the UK International Data Transfer Agreement or an adequacy decision).

5. How long we keep it

• Consultation and treatment records: 8 years after your last appointment, in line with common practice for health and beauty records and to deal with any claims.
• Enquiry form messages where you do not become a client: 12 months.
• Booking and payment records: 6 years, as required for tax purposes.
• Newsletter details: until you unsubscribe.

6. Your rights

You have the right to ask us for a copy of your information, to correct it, to delete it, to limit how we use it, to object to our use of it, and to withdraw consent at any time. To do any of these, email tesshairandscalpclinic@gmail.com. We will reply within one month. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

7. Keeping your information safe

Our website uses HTTPS encryption. Health information you give us is stored in our booking and client record system and is only seen by the clinic team who need it for your care. Please don’t send medical details by email or social media messages; give them to us in the clinic or through our secure form.

8. Cookies

Our website only sets cookies that are needed for the shop basket and booking to work, plus anonymous statistics that do not identify you.

9. Children

Our treatments are for adults. Under-18s can be treated only with a parent or guardian present, who will give consent on their behalf.

10. Changes

We will post any changes to this policy on this page and update the date at the top.