Privacy Policy

1. Who We Are

HairLume ("we", "us", "our") is an informational and self-assessment platform operated in the United Kingdom. We are the data controller for personal data collected through this application. For any data-related queries, contact us at privacy@hairlume.uk.

HairLume is not a medical service and does not issue prescriptions.

2. What Data We Collect and Why

We collect and process the following categories of personal data:

• ·Account data: Name and email address — to create and manage your account. Lawful basis: Contract.
• ·Health & self-assessment data: Age, hair loss stage (Norwood scale), treatment goals, risk tolerance, side-effect logs, hair photos, and AI-generated scores. This is special category data under UK GDPR. Lawful basis: Explicit consent (Article 9(2)(a)).
• ·Treatment preferences: Treatments you select or purchase. Lawful basis: Contract / Legitimate interests.
• ·Usage data: Daily check-ins, streaks, and app interactions. Lawful basis: Legitimate interests (improving the service).
• ·Community posts: Content you voluntarily publish under an anonymous name. Lawful basis: Consent.
• ·Notification preferences: Your reminder times and opt-in/out status. Lawful basis: Consent (UK PECR).

3. Special Category (Health) Data

Hair loss stage, side-effect logs, and hair photos may constitute health data under UK GDPR Article 9. We process this data only with your explicit consent, which you provide during onboarding. You may withdraw this consent at any time in your Profile settings, though doing so will limit the functionality of the app.

4. Sharing Your Data with Third Parties

We share your personal data with the following third parties:

• ·Cloud infrastructure providers: For secure data storage and processing. All providers are contractually bound by UK GDPR-compliant data processing agreements.
• ·Payment processor (Stripe): For processing any purchases. We do not store card details. Stripe's privacy policy applies to payment data.

We do not sell your personal data to third parties.

International data transfers: Some of our providers (including cloud infrastructure and payment processing) may process data outside the United Kingdom. Where this occurs, we rely on the UK adequacy regulations where applicable, or Standard Contractual Clauses adopted under UK GDPR, to ensure an equivalent level of protection for your personal data.

5. Data Retention

We retain your personal data for as long as your account is active. When you delete your profile, all personal data is erased within 30 days except where we are legally required to retain it (e.g., transaction records for 6 years under UK tax law).

6. Anonymity in Community Posts

Community posts are displayed under a pseudonym. However, photos may contain identifying information. We cannot guarantee complete anonymity. Do not post photos or details that you are not comfortable being seen by other users. You may delete your posts at any time.

7. Children's Data

Our service is not intended for persons under the age of 16. We do not knowingly collect personal data from children under 16. If you become aware that a child under 16 has provided us with personal data, please contact us at privacy@hairlume.uk and we will delete it promptly.

8. Your Rights Under UK GDPR

• ·Right of Access: Request a copy of all personal data we hold about you.
• ·Right to Rectification: Request correction of inaccurate or incomplete data.
• ·Right to Erasure: Request deletion of your data ('right to be forgotten').
• ·Right to Restrict Processing: Request that we pause processing in certain circumstances.
• ·Right to Data Portability: Request your data in a machine-readable format.
• ·Right to Withdraw Consent: Withdraw consent at any time without affecting prior lawful processing.
• ·Right to Object: Object to processing based on legitimate interests.
• ·Right to Complain: Lodge a complaint with the ICO at ico.org.uk.

To exercise any right, contact privacy@hairlume.uk. We will respond within one month.

9. Cookies & Local Storage

We use local storage to save your theme preference (light/dark mode). We do not use tracking or advertising cookies. No cookie consent banner is required as we do not deploy non-essential cookies.

10. Data Breach Notification

We have internal procedures to detect, investigate, and report personal data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it, in accordance with Article 33 UK GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay. To report a suspected data breach, contact us immediately at privacy@hairlume.uk.

11. Data Protection Responsibility

HairLume is the data controller for all personal data collected through this application. We have designated a responsible person for data protection matters. All data protection queries, subject access requests, and complaints should be directed to privacy@hairlume.uk. We are committed to complying with the UK GDPR, the Data Protection Act 2018, and all applicable data protection legislation.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be notified to you via the app. Continued use of the app after changes constitutes acceptance.

13. Contact

HairLume · Data Controller · privacy@hairlume.uk