Privacy Notice

Effective Date: 22 July 2026

This Privacy Notice explains how The Heritage Clinic Group Ltd, trading as Dr. Raja Hair Restoration (“we”, “our”, “us”), collects, uses, stores and protects your personal information when you visit our website, enquire about our services or receive treatment from us.

We are committed to protecting your privacy and processing your personal data fairly, lawfully and transparently in accordance with:

• UK General Data Protection Regulation (UK GDPR)

• Data Protection Act 2018

• Privacy and Electronic Communications Regulations (PECR)

• Common law duty of confidentiality

• Applicable Care Quality Commission (CQC) standards

• Other applicable healthcare and regulatory requirements

Who We Are

Data Controller

The Heritage Clinic Group Ltd
Trading as Dr. Raja Hair Restoration

For any questions regarding this Privacy Notice or your personal information, please contact us using the details on our Contact page.

The Information We Collect

Depending upon how you interact with us, we may collect:

Identity Information

• Name

• Date of birth

• Gender

• Photographic identification where required

• Medical record number

Contact Information

• Address

• Email address

• Telephone number

Medical Information (Special Category Data)

As a healthcare provider we routinely process health information including:

• Medical history

• Medication history

• Allergies

• Lifestyle information relevant to treatment

• Photographs of the scalp, beard or donor area

• Clinical consultation notes

• Treatment records

• Surgical records

• Follow-up assessments

• Consent forms

• Outcome photographs

This information constitutes special category personal data under Article 9 UK GDPR.

Financial Information

Where applicable:

• Payment history

• Invoice information

• Transaction references

We do not store your full payment card details.

Website Information

When you visit our website we may automatically collect:

• IP address

• Browser type

• Device information

• Operating system

• Pages visited

• Referral source

• Date and time of access

• Cookie identifiers

How We Collect Information

Information may be collected:

• Through our website

• Consultation forms

• Online assessment forms

• Telephone conversations

• Email correspondence

• WhatsApp communications where used

• Video consultations

• In-person consultations

• During treatment

• During follow-up appointments

• Through cookies and website analytics

Why We Process Your Information

We process your information for the following purposes:

Medical Care

To:

• Assess suitability for treatment

• Provide consultations

• Deliver hair restoration procedures

• Monitor clinical outcomes

• Arrange follow-up care

• Maintain accurate medical records

Administration

To:

• Arrange appointments

• Respond to enquiries

• Manage bookings

• Process payments

• Provide quotations

• Communicate with patients

Regulatory Compliance

To comply with:

• UK healthcare legislation

• Care Quality Commission (CQC) requirements

• Medical record keeping obligations

• Insurance requirements

• Legal obligations

• Requests from regulatory authorities where required

Service Improvement

We may analyse anonymised or aggregated information to improve:

• Patient experience

• Clinical outcomes

• Website performance

• Internal quality assurance

• Clinical audit and governance

Marketing

We will only send marketing communications where:

• You have provided consent; or

• We are otherwise permitted to do so under applicable law.

You may withdraw consent at any time.

Our Lawful Basis for Processing

Under UK GDPR we rely upon one or more of the following lawful bases:

Article 6

• Consent

• Performance of a contract

• Compliance with legal obligations

• Legitimate interests

Article 9 (Special Category Data)

Where health information is processed we rely upon:

• Provision of healthcare

• Medical diagnosis

• Management of healthcare systems

• Public health obligations

• Explicit consent where required

Photographs

Clinical photographs form an important part of hair restoration treatment.

They may be taken:

• Before treatment

• During treatment

• After treatment

• During follow-up

Photographs form part of your confidential medical record.

They will only be used for marketing, education or publication where separate appropriate consent has been obtained.

CCTV

For the safety and security of patients, visitors, staff and property, CCTV operates within certain areas of our premises.

CCTV may also be present within clinical areas where it is considered necessary for:

• Patient safety

• Staff safety

• Security

• Clinical governance

• Investigation of incidents

• Regulatory compliance

CCTV is not used for routine monitoring of patients.

Access to recordings is strictly limited to authorised personnel and recordings are retained only for an appropriate period unless required for investigation, legal proceedings or regulatory purposes.

Appropriate signage is displayed throughout the clinic.

Clinical Documentation and AI Technology

We may use secure clinical documentation technologies, including artificial intelligence-assisted transcription tools, solely to assist healthcare professionals in accurately documenting consultations and treatment records.

These technologies operate under strict confidentiality obligations and appropriate contractual safeguards.

Clinical decisions are always made by appropriately qualified healthcare professionals and never by artificial intelligence.

Sharing Information

We do not sell personal information.

We may share information where appropriate with:

• Laboratories

• Pharmacies

• Healthcare professionals involved in your care

• CQC

• HMRC where legally required

• Courts and law enforcement where legally required

• Professional indemnity insurers

• Solicitors

• IT providers

• Cloud hosting providers

• Secure payment providers

• Website providers

• CRM providers

• Practice management software providers

All suppliers processing personal information on our behalf are required to comply with UK data protection legislation and appropriate contractual safeguards.

International Transfers

Where any service provider processes data outside the United Kingdom, appropriate safeguards will be implemented, including:

• UK International Data Transfer Agreements

• UK Addendum to EU Standard Contractual Clauses

• Adequacy Regulations where applicable

Data Security

We implement appropriate technical and organisational measures including:

• Encryption where appropriate

• Password protection

• Access controls

• Role-based permissions

• Secure backups

• Staff confidentiality obligations

• Regular software updates

• Secure cloud infrastructure

While we take reasonable steps to protect personal information, no electronic transmission or storage system can be guaranteed to be completely secure.

How Long We Keep Information

We retain information only for as long as necessary to fulfil legal, regulatory and clinical obligations.

Retention periods may vary depending upon the type of information and applicable legal requirements.

Medical records are retained in accordance with applicable healthcare regulations and professional guidance.

Cookies

Our website uses cookies to:

• Operate essential website functions

• Improve website performance

• Analyse visitor behaviour

• Measure advertising performance

• Improve user experience

You may control cookies through your browser settings.

Some features may not function correctly if cookies are disabled.

Your Rights

Subject to applicable law, you may have the right to:

• Request access to your personal information

• Request correction of inaccurate information

• Request erasure in certain circumstances

• Request restriction of processing

• Object to certain processing

• Request portability of your information

• Withdraw consent where consent applies

• Lodge a complaint with the Information Commissioner’s Office (ICO)

Certain rights may be limited where healthcare legislation or legal obligations require us to retain information.

Third-Party Websites

Our website may contain links to third-party websites.

We are not responsible for the privacy practices or content of external websites.

Children’s Privacy

Our services are primarily intended for adults.

Where treatment is provided to a person under 18 years of age, personal information will be processed in accordance with applicable legal requirements relating to children and parental responsibility.

Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect legal, regulatory or operational changes.

The latest version will always be available on this website.

Contact Us

If you have any questions about this Privacy Notice or wish to exercise your rights, please contact us using the details provided on our Contact page.

If you remain dissatisfied, you may complain to the:

Information Commissioner’s Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Website: https://ico.org.uk

The ICO recommends that concerns are first raised with the organisation before submitting a complaint.