Who we are

Harley Street Hairline is a specialist hair transplant practice operated by Dr Anzal Qurbain MBBS BSc(Hons) MBA FFPM (GMC: 4369286), practising from 19 Harley Street Hospital, London W1G 9PF. Dr Qurbain is the data controller for the purposes of UK GDPR and the Data Protection Act 2018.

If you have any questions about how we handle your information, contact us at: hello@harleystreethairline.co.uk

What information we collect

We collect personal information when you submit an assessment, contact us, or book a consultation. This includes:

Identity data: full name, date of birth, age
Contact data: email address, phone number, postal address
Medical and health data: hair loss history, Norwood scale classification, medical history, medications, allergies, scalp and donor area photographs
Financial data: payment information (processed securely by Stripe — we do not store card details)
Technical data: IP address, browser type, pages visited (via server logs for security purposes only)

Special category data

Photographs of your scalp and medical history constitute special category data under UK GDPR. We process this data solely to assess your suitability for hair transplant procedures and to provide treatment. The legal basis for processing special category data is your explicit consent, given when you submit your assessment or proceed to consultation. You may withdraw consent at any time by contacting us, though this may affect our ability to provide the service.

How we use your information

We use your personal data for the following purposes:

Reviewing your private assessment and advising on candidacy for FUE hair transplant
Booking and managing consultations and procedures
Sending appointment reminders and pre-procedure questionnaires
Processing payments and issuing receipts
Maintaining clinical records as required by GMC standards and the Medical Defence Union
Responding to enquiries submitted via the website contact form

We will never use your personal data for marketing purposes without your explicit opt-in consent, and we will never sell your data to any third party.

Legal basis for processing

Contract: processing your assessment and booking is necessary to provide the service you have requested
Explicit consent: for special category health and photographic data
Legitimate interests: communicating with you about your enquiry, maintaining site security
Legal obligation: retaining clinical records in accordance with GMC guidance (minimum 8 years for adults)

Who we share your data with

We do not sell or share your personal data with third parties for commercial purposes. We may share data with the following processors, strictly to deliver our services:

Stripe, Inc. — payment processing (Stripe Privacy Policy: stripe.com/gb/privacy)
Google Workspace — secure email delivery
Amazon Web Services — secure server infrastructure located in the UK/EU

All processors are bound by data processing agreements and UK GDPR-compliant safeguards. We may also disclose information where required by law or a court order.

Data retention

We retain clinical records (including consultation notes, procedure records and photographs) for a minimum of 8 years following your last appointment, in line with GMC guidance. Assessment submissions where no consultation proceeds are deleted after 2 years. Contact form enquiries are retained for 12 months. You may request earlier deletion where there is no legal obligation to retain your data.

Your rights

Under UK GDPR you have the following rights regarding your personal data:

Right of access — request a copy of the personal data we hold about you
Right to rectification — request correction of inaccurate data
Right to erasure — request deletion of your data where there is no legal obligation to retain it
Right to restriction — request that we limit processing of your data in certain circumstances
Right to data portability — receive your data in a structured, machine-readable format
Right to object — object to processing based on legitimate interests
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, email hello@harleystreethairline.co.uk. We will respond within 30 days. There is no charge for a first request.

Cookies

Our website uses only essential session cookies required for form security (nonce tokens). We do not use advertising or tracking cookies, and we do not use Google Analytics or similar third-party analytics services.

Security

Your data is stored on servers secured with SSL/TLS encryption. Assessment photographs are stored in a restricted directory and are accessible only to Dr Qurbain and authorised practice staff. We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss or destruction.

Changes to this policy

We may update this policy from time to time. The current version will always be available at this page with the date of last update shown at the top.

Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO): ico.org.uk · 0303 123 1113.

Privacy Policy