Legal & Policies

PRIVACY POLICY How we collect, use and protect your information. HairMD London Last updated: September 2026 1. Who We Are HairMD London is the trading name of Atlanthor Ltd, a company registered in England and Wales under company number 14279430. Clinical procedures are carried out at Seymour Clinic, 78-80 Seymour Place, London W1H 2EH. Seymour Clinic is registered with the Care Quality Commission (CQC). Dr Feyroza Mustaeva practises at Seymour Clinic under Practising Privileges granted by the clinic. For the purposes of UK data protection law, Atlanthor Ltd is the controller of personal data processed by HairMD London, except where another organisation acts as a separate controller in its own right. Contact details: info@hairmdlondon.com | +44 (0)7743 017360 ICO Registration Number: ZB908501 We are committed to protecting your personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), where applicable. 2. What Information We Collect Depending on how you interact with HairMD London, we may collect and process your name, contact details and date of birth; the contents of enquiries and communications with us; appointment, consultation and treatment information; medical history, medications, allergies and other health information relevant to your assessment or care; clinical assessment findings, diagnoses where applicable, treatment recommendations and treatment plans; and clinical or trichoscopic photographs and other images where relevant to assessment, treatment planning, monitoring or the clinical record. We may also process photographs, videos or testimonials for promotional purposes where appropriate consent has been obtained; payment and transaction information, although payment card details may be processed directly by our payment provider; documents, photographs and other information you choose to provide to us; and records of your communications with us. When you use our website, we may collect technical information such as your IP address, browser type, device type and website usage information. We may also use cookies and similar technologies, subject to applicable consent requirements. Information concerning your health constitutes special category personal data under UK GDPR and receives additional legal protection. We only collect personal information that is reasonably necessary for the purposes described in this Privacy Policy. 3. How We Use Your Information We may use your personal information to respond to enquiries and requests for information; arrange consultations and appointments; assess suitability for treatment; provide consultations, treatment and aftercare; communicate with you regarding your care, appointments or enquiries; maintain appropriate clinical and administrative records; process and administer payments; manage patient safety and continuity of care; improve the operation, security and performance of our website and services; send optional marketing communications where permitted by law; comply with our legal, regulatory, insurance and professional obligations; and establish, exercise or defend legal claims where necessary. We do not sell or rent your personal data and do not provide it to third parties for their own unrelated marketing purposes. 4. Lawful Bases for Processing Under UK GDPR, we must have a lawful basis for processing personal data. Depending on the circumstances, we may rely on contract or steps taken before entering into a contract where processing is necessary to arrange or provide services requested by you; legitimate interests where processing is reasonably necessary for the effective administration, security and improvement of our practice and website, responding to enquiries or protecting our legitimate business interests, provided those interests are not overridden by your rights and interests; legal obligation where processing is necessary to comply with legal, regulatory or professional requirements; and consent where consent is the appropriate lawful basis, including certain optional marketing communications and non-essential cookies or similar technologies. Health and Special Category Data Health information is special category personal data under UK GDPR. Where we process health information for medical assessment, diagnosis, treatment, aftercare or related clinical purposes, we may rely on Article 9(2)(h) UK GDPR, which permits processing necessary for medical diagnosis or the provision or management of health or social care or treatment, subject to the required safeguards and duties of confidentiality. We may also rely on the relevant health or social care condition under Schedule 1, Part 1 of the Data Protection Act 2018. Other Article 9 conditions may apply where appropriate and permitted by law. Clinical Photographs and Promotional Images Clinical or trichoscopic photographs may be taken and retained where necessary for assessment, treatment planning, monitoring outcomes, patient safety or maintaining an appropriate clinical record. The use of identifiable patient photographs, videos, testimonials or other clinical material for advertising, marketing, our website or social media is separate from their use for clinical care. Where required, we will obtain appropriate separate explicit consent before using identifiable clinical material for promotional purposes. Refusing consent for promotional use will not affect your eligibility for treatment or the standard of clinical care you receive. Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn. Processing for Specific Purposes When responding to an enquiry, we may process your name, contact details and information contained within your enquiry on the basis of our legitimate interests and/or steps taken at your request before entering into a contract, as applicable. When arranging or providing consultations or treatment, we may process identification, contact, appointment and health information on the basis of contract and/or legal obligation, as applicable. Where health information is involved, the relevant special category condition will generally be Article 9(2)(h) UK GDPR together with the applicable provisions of the Data Protection Act 2018. When maintaining clinical records, we may process health information, clinical assessments, photographs and treatment records on the basis of legal obligation and/or legitimate interests, as applicable, together with Article 9(2)(h) UK GDPR and the applicable provisions of the Data Protection Act 2018. Website analytics and other non-essential technologies may process information such as your IP address, browser, device and website usage information on the basis of consent where this is required by PECR or UK data protection law. Technical information required for website security and essential functionality may be processed on the basis of our legitimate interests or as otherwise permitted by applicable law. Where we send optional marketing communications, we will do so on the basis of consent or another lawful basis permitted under applicable direct-marketing law, depending on the circumstances. 5. Who We Share Your Information With We only share personal information where it is reasonably necessary for your care, the operation of our services or compliance with our legal and professional obligations. This may include Seymour Clinic where necessary in connection with consultations, procedures, clinical care, facility administration, patient safety, regulatory requirements or record-keeping. Seymour Clinic may process personal information in its own capacity where applicable. We may also share relevant information with website and hosting providers, including Wix; email and communications service providers; analytics providers, including Google services where enabled and permitted; payment processors used to handle electronic payments; finance providers where applicable and where you choose to use third-party finance; clinical or electronic medical record systems where applicable; healthcare professionals involved in your care where necessary and appropriate; professional indemnity and insurance providers; and accountants, legal advisers and other professional advisers where reasonably necessary. Service providers acting as processors are expected to process personal data in accordance with our instructions and applicable data protection requirements. Some organisations may instead act as independent controllers of information they receive. We may also disclose personal information where required by law, regulation, court order or professional obligation, or where reasonably necessary to protect the rights, health or safety of patients or others. This may include disclosure to relevant regulators such as the General Medical Council (GMC) or the Care Quality Commission (CQC), where appropriate. We do not sell or rent your personal information to third parties. 6. International Transfers Some organisations that provide services to us, including website, communications or technology providers, may process personal information outside the United Kingdom. Where personal information is transferred outside the UK, we take appropriate steps to ensure that the transfer is made in accordance with applicable UK data protection law. Depending on the country and circumstances, this may include reliance on UK adequacy regulations or appropriate contractual safeguards, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with supplementary safeguards where appropriate. 7. How Long We Keep Your Information We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and to meet applicable legal, regulatory, professional, insurance and record-keeping requirements. General enquiries that do not result in a consultation or treatment are retained only for as long as reasonably necessary to respond to and manage the enquiry, subject to any legal or legitimate business need to retain them for longer. Where an enquiry results in a consultation, assessment or treatment, relevant information may become part of the patient's clinical or administrative record. Clinical records, including relevant clinical photographs and treatment information, are retained in accordance with applicable legal, professional, regulatory and insurance requirements. The appropriate retention period may vary according to the type of record, treatment and individual circumstances. Marketing information based on consent will normally be retained until you withdraw your consent or the information is no longer required for that purpose. Website analytics information is retained in accordance with the settings applied to the relevant analytics services and applicable data protection requirements. When personal information is no longer required, we will securely delete it or anonymise it so that it can no longer identify you, subject to applicable technical and legal requirements. 8. How We Protect Your Information We take appropriate technical and organisational measures designed to protect personal information against unauthorised or unlawful processing, accidental loss, destruction, alteration or disclosure. These measures may include secure systems and hosting, access controls, confidentiality requirements and restricting access to personal information to those who reasonably require it. However, no website, electronic communication or method of data storage can be guaranteed to be completely secure. Where a personal data breach is likely to result in a risk to individuals' rights and freedoms, we will notify the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to affected individuals, we will also inform those individuals without undue delay where required by law. 9. Your Data Protection Rights Depending on the circumstances and the lawful basis on which we process your information, you may have the right to request access to personal information we hold about you; request correction of inaccurate or incomplete information; request erasure of your personal information in certain circumstances; request restriction of processing in certain circumstances; object to processing based on legitimate interests in certain circumstances; object to the use of your personal information for direct marketing at any time; request data portability in certain circumstances where processing is automated and based on consent or contract; and withdraw consent at any time where we rely upon consent as the lawful basis for processing. These rights are subject to certain legal conditions and exemptions. In particular, the right to erasure is not absolute, and we may be required or entitled to retain clinical or other records despite a request for deletion. We do not use solely automated decision-making or profiling that produces legal or similarly significant effects concerning patients. We will normally respond to a valid request relating to your data protection rights within one month. Where permitted by law, this period may be extended by up to a further two months where a request is complex or numerous. If an extension is necessary, we will inform you within the initial one-month period. To exercise your rights, please contact info@hairmdlondon.com. We may need to verify your identity before fulfilling certain requests. Complaints If you have concerns about how we use your personal information, we encourage you to contact us first so that we can try to resolve the matter. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator. Further information is available at ico.org.uk, or you can contact the ICO by telephone on 0303 123 1113. 10. Children and Young People Our services are primarily intended for adults. We do not knowingly collect personal information relating to children through our website except where it is appropriate and lawful to do so, for example where a parent or guardian contacts us regarding a young person. Where we process personal information relating to a child or young person, we take appropriate steps to protect that information in accordance with applicable data protection law and professional requirements. 11. Cookies and Similar Technologies Our website may use cookies and similar technologies to provide essential website functionality, maintain security, understand website usage and, where applicable, support analytics or marketing functions. Cookies that are strictly necessary for the operation of the website may be used without consent where permitted by law. Where consent is required for non-essential cookies or similar technologies, these will only be used in accordance with the choices you make through our cookie consent mechanism. You can change or withdraw your cookie preferences where the website provides this functionality. Further information is provided in our Cookie Policy. 12. Changes to This Privacy Policy We may update this Privacy Policy from time to time to reflect changes to our services, systems, regulatory requirements or applicable law. The latest version will be published on this website together with the date of the most recent update. 13. Contact Us For questions about this Privacy Policy, the way we use your personal information or to exercise your data protection rights, please contact: HairMD London Trading name of Atlanthor Ltd Company number: 14279430 78-80 Seymour Place London W1H 2EH United Kingdom Email: info@hairmdlondon.com Telephone: +44 (0)7743 017360 ICO Registration Number: ZB908501