3. How We Collect It
 
We collect information when you complete our online hair-loss assessment (via JotForm), book or attend a consultation, place an order, or contact us directly.
 
4. Our Legal Basis for Processing
 
Because health information is "special category data" under UK GDPR, we rely on the following legal bases:
 

• Explicit consent (Article 9(2)(a)) — you actively provide your medical history and photographs for the purpose of clinical assessment.
   

• Provision of health care (Article 9(2)(h)) — processing necessary for the provision of health care by, or under the responsibility of, a health professional.
   

• Performance of a contract (Article 6(1)(b)) — to provide the products and services you request.
   

• Legal obligation (Article 6(1)(c)) — to meet our record-keeping obligations.
   

5. How We Use Your Information
 

• To assess your suitability for treatment and enable clinical decision-making
   

• To prepare, dispense, and deliver your prescribed medicine
   

• To conduct and follow up on consultations
   

• To maintain patient records as required by GPhC and MHRA regulations
   

• To process payments and prevent fraud
   

• To contact you about your treatment, including safety updates relevant to medicines you have been prescribed
   

[To send marketing communications, where you have separately opted in]

5a. Identity Verification Documents
 

• As part of our assessment, we ask you to upload a photo of your government-issued ID (passport or driving licence) and a selfie photograph. This is used solely to confirm that the person completing the assessment matches the identity provided, before any prescription-only medicine is issued.
   

• Our legal basis for processing this information is our legal obligation as a GPhC-registered pharmacist to verify patient identity before supplying prescription medicines (Article 6(1)(c)), alongside your consent to provide these documents as part of your assessment (Article 6(1)(a)).
   

• We retain identity verification documents only for as long as required to meet our regulatory record-keeping obligations, currently [confirm retention period with your GPhC guidance]. [Confirm whether raw ID images are deleted/redacted after verification, retaining only a confirmation record, or retained in full for the applicable period.] We do not use identity documents for any purpose beyond verification and our regulatory obligations, and they are not used for marketing purposes.
   

6. Who We Share Your Information With
 
We share information, on a need-to-know basis, with:
 

• Compounding/dispensing partners who prepare your medicine on our instruction
   

• Delivery couriers, limited to the information needed to deliver your order
   

• Payment processors (e.g. Stripe / Wix Payments) to process your payment securely
   

• Website and form providers (e.g. Wix, JotForm) who process data on our behalf as data processors, under contract
   

• Regulators (GPhC, MHRA, CQC) where legally required
   

We do not sell your personal information to third parties.
 
7. International Data Transfers
 
Some of our service providers (such as [Wix, JotForm]) may process or store data outside the UK/EEA. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or an adequacy decision recognised under UK law. [Confirm specific safeguards used by each provider.]
 
8. How Long We Keep Your Information
 
We retain patient records in line with GPhC record-keeping requirements, generally for a minimum of [8 years / confirm exact requirement] from the date of your last treatment, or longer where required by law. Marketing data is retained only until you withdraw consent.
 
9. Your Rights
 
Under UK GDPR, you have the right to:
 

• Access the personal data we hold about you
   

• Request correction of inaccurate data
   

• Request erasure of your data, where applicable (this may be limited by our legal record-keeping obligations as a pharmacy)
   

• Withdraw consent at any time, where consent is our legal basis
   

• Object to or restrict certain processing
   

• Data portability, where applicable
   

• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk
   

To exercise any of these rights, contact us at info@hairrxclinic.co.uk.
 
10. Data Security
 
We use appropriate technical and organisational measures to protect your data, including encrypted data transmission, access controls limiting who can view patient information, and secure storage with our third-party processors.
 
11. Changes to This Policy
 
We may update this policy from time to time. The "last updated" date at the top of this page reflects the most recent revision.
 
12. Contact Us
 [Irfanlocums Ltd, trading as HairRx Clinic]
Email: info@hairrxclinic.co.uk