Privacy Notice – Follicle Hair Ltd

This Privacy Notice explains how Follicle Hair Ltd (“Follicle”, “we”, “us”, “our”) collects, uses, stores, shares, and protects personal data when you use our website, create an account, request treatment, place an order, communicate with us, or otherwise use our services.

Follicle Hair Ltd acts as a data controller under UK data protection law and processes personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and applicable healthcare, prescribing, pharmacy, consumer, and electronic communications requirements.

If you do not agree with this Privacy Notice, you should not use our website or submit personal information to us. If anything is unclear, please contact us at contact@follicle.uk.

1. Our Commitment to Privacy and Patient Safety

Follicle Hair Ltd is committed to protecting the confidentiality, integrity, and security of personal information, particularly health information used to assess treatment suitability and support safe healthcare provision.

We process personal data lawfully, fairly, and transparently, and only collect information that is necessary for the purposes described in this Privacy Notice.

We implement appropriate technical and organisational safeguards to protect health data, work with appropriately registered healthcare professionals and regulated pharmacy services, and keep this Privacy Notice under regular review to reflect changes in our services or legal obligations.

2. Scope of this Privacy Notice

This Privacy Notice applies to website visitors, account holders, patients, customers, and anyone who contacts us or uses our online services.

It also explains how personal data may be shared with iPharmacy, prescribing pharmacists, doctors, and other service providers involved in delivering our services.

3. Personal Data We Collect

We collect identity and contact data such as your name, title, date of birth, age, gender, billing and delivery addresses, email address, telephone number, account login details, preferences, and customer support history.

We collect health and medical data, which is classified as special category data. This may include medical questionnaire responses, symptoms, conditions, allergies, contraindications, relevant medical history, treatment requests, prescription requirements, prescription history, clinical notes, prescriber communications, and other patient safety information provided in connection with your treatment or order.

We also collect order, transaction, and service data, including details of products or treatments requested, order status, dispatch and delivery information, customer service interactions, and billing status. Payment card information is processed securely by payment providers.

Technical and website usage data is collected automatically and may include your IP address, browser type, operating system, device identifiers, referral sources, pages visited, clickstream data, and cookie or analytics information where permitted.

4. How We Collect Personal Data

We collect personal data directly from you when you create an account, complete questionnaires, place orders, contact us, or update your details.

We may also receive data from prescribing pharmacists, doctors, iPharmacy, payment providers, identity or age verification services, IT providers, delivery partners, and other service providers involved in delivering our services.

In addition, certain data is collected automatically through website technologies such as cookies and analytics tools.

5. How We Use Personal Data

We use personal data for healthcare and prescribing purposes, including assessing whether treatment is clinically appropriate, facilitating remote consultations, requesting additional information where necessary, issuing prescriptions, sharing relevant information with iPharmacy for dispensing, and maintaining accurate healthcare records.

We use personal data to deliver services, including registering and managing your account, processing orders, arranging delivery, providing customer support, and managing refunds, complaints, and service issues.

We also use personal data for compliance, safety, and governance purposes, including meeting legal and regulatory requirements, preventing fraud or misuse, ensuring system security, and improving clinical and operational standards.

We may send service-related communications necessary for your account or treatment. Marketing communications may be sent where permitted by law, and you can unsubscribe at any time.

Health data is not used for direct marketing.

6. Protected Health Information (PHI) and Health Information

For the purposes of this Privacy Notice, “Protected Health Information” or “PHI” refers to identifiable health and medical information that we collect, use, store or share in connection with Follicle’s online healthcare services.

Under UK data protection law, health information is treated as special category personal data and is subject to additional protections.

How we use your health information

When you use Follicle’s online healthcare services, we may collect information about your health, medical history, current or previous medicines, allergies, symptoms, photographs, treatment preferences and other information that is necessary to assess whether a treatment is clinically appropriate for you.

We may use your health information to:

• Assess your suitability for treatment.
• Allow an appropriately qualified healthcare professional to review your consultation.
• Prescribe treatment where clinically appropriate.
• Arrange for prescribed medicines to be dispensed and supplied.
• Communicate with you about your consultation, prescription, treatment or order.
• Provide ongoing clinical care, including follow-up or safety communications.
• Maintain appropriate clinical, prescribing and dispensing records.
• Investigate complaints, clinical incidents or concerns.
• Comply with our legal, professional, regulatory and safeguarding obligations.
• Protect the safety of patients and the public.

Health information is treated as special category personal data under UK data protection law and is subject to additional protections.

We only process health information where we have a lawful basis to do so under the UK GDPR and Data Protection Act 2018, including where processing is necessary for the provision and management of healthcare by, or under the responsibility of, an appropriately qualified healthcare professional.

When we may share your health information

We only disclose health information where this is necessary and lawful.

This may include sharing relevant information with:

• The healthcare professional responsible for reviewing your consultation and prescribing treatment.
• iPharmacy, where it is responsible for dispensing and supplying your prescribed medication.
• Healthcare professionals involved in your care where appropriate.
• Service providers that process information on our behalf and are subject to appropriate confidentiality and data-protection obligations.
• Regulators, professional bodies or public authorities where we are legally or professionally required to do so.
• Emergency services, healthcare providers or other appropriate organisations where disclosure is necessary to protect your vital interests or the safety of another person.

We do not disclose your health information to third parties for unrelated marketing purposes.

Your rights regarding your health information

Subject to the requirements and exemptions contained in applicable data-protection legislation, you may have the right to:

• Request confirmation that we process your personal information.
• Request a copy of the personal information and health information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your personal information where there is no legal or regulatory requirement for us to retain it.
• Request restriction of the way in which your information is processed.
• Object to certain types of processing.
• Request transfer of certain information to you or another organisation where the right to data portability applies.
• Withdraw consent where we rely specifically on consent as the lawful basis for processing.

Some healthcare, prescribing and dispensing records must be retained for legal, regulatory, clinical or professional reasons. This means that a request for deletion will not always result in the deletion of all information we hold about you.

To exercise any of these rights, please contact us using the privacy contact details provided in this Privacy Notice. We may need to verify your identity before fulfilling a request.

Complaints about the use of your health information

If you have any concerns about the way we collect, use, disclose or protect your personal or health information, please contact us using the details provided in this Privacy Notice.

We will investigate privacy-related complaints and respond in accordance with our legal and regulatory obligations.

You also have the right to raise a complaint with the Information Commissioner’s Office (ICO), the UK’s independent data-protection regulator.

You can find further information about your rights and how to make a complaint at the Information Commissioner’s Office website: www.ico.org.uk.

Our duty to protect your health information

Follicle Hair Ltd recognises that health information is confidential and particularly sensitive.

We have a legal and professional responsibility to protect the confidentiality, integrity and security of the personal and health information entrusted to us.

We maintain appropriate technical and organisational safeguards designed to protect information against unauthorised access, disclosure, alteration, loss or destruction.

Access to health information is restricted to individuals who require access for legitimate clinical, dispensing, administrative, regulatory or operational purposes.

Healthcare professionals involved in your treatment are also subject to their own professional duties of confidentiality.

We retain personal and health information only for as long as necessary to fulfil the purposes for which it was collected and to comply with applicable legal, clinical, regulatory and professional record-retention requirements.

7. iPharmacy – Dispensing Pharmacy

Your prescription and relevant personal data will be shared with iPharmacy for the purposes of dispensing, supplying, and delivering prescribed medicines, as well as maintaining legally required pharmacy records.

iPharmacy acts as an independent data controller for its pharmacy services and is responsible for compliance with pharmacy law, professional standards, patient safety, and confidentiality obligations.

Dispensing Pharmacy: iPharmacy
Address: 45 3rd Floor Albemarle Street, Mayfair, London, England, W1S 4JL
GPhC Pharmacy Registration No: 9011222

Where medicines are supplied remotely, iPharmacy operates as a distance selling pharmacy and must comply with all applicable regulatory requirements, including registration with the General Pharmaceutical Council (GPhC).

The pharmacy is responsible for governance, including safe handling of prescriptions, record keeping, audit, and risk management.

Superintendent Pharmacist: Saaqib Anwar
GPhC Registration No: 2074940

Information about pharmacy registration and responsible pharmacists is available where required by law or upon request.

8. Prescribing Pharmacists and Doctors

Your personal and health data may be shared with UK-registered prescribing pharmacists and doctors who assess your medical information, determine treatment suitability, and issue prescriptions where appropriate.

These professionals may act as independent data controllers for their clinical decisions and records and must comply with applicable professional and data protection obligations.

9. Verification of Healthcare Professionals and Pharmacy

Patients may independently verify the registration status of pharmacists, doctors, and pharmacy premises using official regulator registers, including the General Pharmaceutical Council (GPhC) register and the General Medical Council (GMC) register.

These registers provide information about registration status, licences, and any relevant restrictions.

10. Legal Basis for Processing

We rely on several lawful bases under UK data protection law.

For personal data, these include performance of a contract, compliance with legal obligations, legitimate interests, and consent where required.

For health data, we primarily rely on provisions allowing processing necessary for medical diagnosis, treatment, and healthcare management.

We do not rely on consent as the primary basis for healthcare-related processing where records must be retained for safety or legal reasons.

11. Sharing Personal Data

We may share personal data with trusted third parties where necessary for service delivery, compliance, or administration.

These include:

• iPharmacy.
• Prescribing professionals.
• Payment processors.
• IT providers.
• Delivery services.
• Analytics providers.
• Insurers.
• Auditors.
• Regulators.

Personal data may also be disclosed to authorities where required by law or to protect rights and safety.

Where third parties act as processors, they are required to follow our instructions and protect personal data appropriately.

12. International Transfers

Where personal data is transferred outside the United Kingdom, appropriate safeguards are implemented in accordance with applicable data protection law, including recognised transfer mechanisms such as adequacy decisions or standard contractual clauses.

13. Communications and Secure Messaging

We may contact you by email, SMS, telephone, post, or secure messaging.

You are responsible for checking communications regularly.

While we aim to use secure channels, email may not always be fully secure unless encrypted.

14. Cookies and Similar Technologies

We use cookies and similar technologies to operate the website, remember preferences, analyse usage, improve services, and support security.

You can manage cookie preferences through your browser settings or consent tools where applicable.

15. Data Retention

Personal data is retained only for as long as necessary for the purposes for which it was collected, including healthcare, legal, regulatory, and audit requirements.

Medical and prescription records may be retained for specific periods required by professional and regulatory guidance.

16. Data Security

We implement appropriate technical and organisational measures to protect personal data from unauthorised access, loss, misuse, or disclosure.

These measures include secure systems, access controls, encryption where appropriate, staff training, and incident response procedures.

However, no method of transmission over the internet is completely secure, and you are responsible for maintaining the confidentiality of your account credentials.

17. Your Data Protection Rights

You may have rights under data protection law, including the right to:

• Access your data.
• Request correction.
• Request deletion in certain circumstances.
• Restrict processing.
• Object to processing.
• Receive data in a portable format.
• Withdraw consent where applicable.

Requests can be made by contacting contact@follicle.uk, and we may need to verify your identity before responding.

18. Children

Our services are intended for adults unless otherwise stated.

We do not knowingly provide prescription services to children without appropriate legal and clinical safeguards.

19. Accuracy of Health Information

You must provide accurate and complete medical information.

Inaccurate or incomplete information may affect treatment decisions and patient safety.

Where remote treatment is not appropriate, you may be advised to seek in-person care.

20. Linked Websites

Our website may contain links to third-party websites.

We are not responsible for their privacy practices, and you should review their policies before providing personal data.

21. Complaints

If you have concerns about how your personal data is used, please contact us at contact@follicle.uk.

You also have the right to complain to the UK Information Commissioner’s Office (ICO).

22. Contact Details

Email: contact@follicle.uk

23. Changes to this Privacy Notice

We may update this Privacy Notice from time to time.

The latest version will always be available on our website, and significant changes may be communicated through appropriate channels.