Effective Date: April 21, 2026 Last Updated: April 21, 2026
This Privacy Policy explains how High Cloud Limited ("we," "us," "our"), a company registered in England and Wales, collects, uses, shares, and protects your personal data when you use our website at https://hairpath.co (the "Site") or submit your information through our forms, quizzes, or lead-submission flows (together, the "Platform").
We are the data controller for the personal data we process in connection with the Platform, as that term is defined under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 ("DPA 2018").
If you have questions about this Policy, contact us at .
This Policy applies to personal data collected through the Platform from residents of the United Kingdom (England, Scotland, Wales, and Northern Ireland). The Platform is not intended for residents outside the UK; if you access it from another jurisdiction, please do not submit personal data.
This Policy does not apply to:
Third-party clinic websites, even if linked from the Platform;
Social-media platforms on which we have a presence;
Services or products provided by partner clinics directly.
Each of those entities maintains its own privacy practices, and you should review them independently.
When you submit our quiz, consultation, or lead form, you voluntarily provide:
Identity data: full name, date of birth, gender (if submitted);
Contact data: email address, mobile phone number, city/region, postcode (if submitted);
Hair-loss profile: Norwood-scale level, duration of hair loss, family history, photographs you voluntarily upload;
Lifestyle and medical indicators: whether you smoke, take finasteride/minoxidil, have a chronic condition, or previous hair procedures (only the specific items we ask);
Budget and scheduling preferences: expected price range, preferred travel months;
Marketing-consent preferences: your choices regarding email, SMS, WhatsApp, and phone communications.
When you visit the Site, we automatically collect:
Device and browser data: IP address, browser type and version, operating system, device identifiers;
Usage data: pages viewed, time on page, referring URL, clickstream;
Cookies, pixels, and similar technologies: Meta Pixel, TikTok Pixel, Google Analytics 4, Google Ads, LinkedIn Insight Tag, call-tracking scripts, session-replay scripts (where enabled — see our Cookie Banner / Section 10);
Approximate location: derived from IP address or (if you grant permission) more precise location from your device.
We may receive information about you from:
Advertising platforms (Meta, TikTok, Google, LinkedIn) regarding ad clicks, conversions, and audience-match data;
Partner clinics regarding your appointment bookings, show-up status, and procedure outcomes (for reporting and fraud-prevention only, on a limited-access basis);
Anti-fraud and telecom providers for phone-number validation, identity verification, and spam filtering.
Information about your physical hair-loss condition, medical history, medications, chronic conditions, or procedure history is special category (health) personal data under Article 9 UK GDPR. We rely on your explicit consent under Article 9(2)(a) as our Article 9 condition, in addition to a lawful basis in Article 6 (see Section 4).
You do not have to provide this information. If you do not wish to share health-related answers, you may (a) leave those fields blank, (b) skip the quiz, or (c) contact a clinic directly without using our Service. However, without this data we may not be able to pre-qualify your candidacy or make a meaningful clinic match.
You may withdraw this explicit consent at any time by emailing ; withdrawal does not affect the lawfulness of processing before withdrawal. Upon withdrawal, we will delete health-related fields (subject to Section 7 retention obligations).
The Platform is not directed at children under 18, and we do not knowingly collect personal data from anyone under 18. If we learn that we have collected personal data from a person under 18, we will delete it promptly. Parents/guardians who believe we may hold data about their child should contact .
We rely on the following lawful bases, depending on the processing activity:
Processing activity Lawful basis (Art. 6) Art. 9 condition (where health data) Providing the referral service (evaluating your submission, matching you to clinics) Contract (Art. 6(1)(b)) — performance of the pre-contractual Service you requested Explicit consent (Art. 9(2)(a)) Sharing your data with partner clinics so they can contact you Legitimate interests (Art. 6(1)(f)) — providing the service you signed up for Explicit consent (Art. 9(2)(a)) Direct marketing by email/SMS/WhatsApp/phone Consent (Art. 6(1)(a)) + PECR 2003 Reg. 22 consent for electronic direct marketing N/A (marketing messages do not contain health data) Fraud prevention, security, and system integrity Legitimate interests (Art. 6(1)(f)) N/A Analytics, advertising measurement, and service improvement Consent (Art. 6(1)(a)) via the cookie banner, for non-essential cookies N/A Complying with legal obligations (tax, accounting, regulator requests) Legal obligation (Art. 6(1)(c)) Public interest / legal claims (Art. 9(2)(f)/(g))
Where we rely on legitimate interests, we have carried out a legitimate-interests assessment (LIA) and concluded that our interests are not overridden by your fundamental rights. You can request a copy of the LIA summary by emailing .
We share your personal data only as described below:
We share your contact details, quiz answers, and (where submitted) photographs with one or more hair-transplant clinics located primarily in Turkey, who may then contact you to offer a consultation and quotation. Each clinic is an independent data controller for its own subsequent processing of your data. We provide a list of current clinic partners on request.
We engage third-party processors to run the Platform, including:
Hosting & CRM: GoHighLevel (LeadConnector) — US-based CRM and marketing automation;
Email delivery: SMTP/ESP providers (e.g., Mailgun, SendGrid) — US/EU-based;
SMS & voice: Twilio, MessageBird — US/EU-based;
WhatsApp Business API: Meta Platforms Ireland Ltd + official BSP — EU + US;
Advertising & analytics: Google (GA4, Ads, Tag Manager), Meta (Pixel), TikTok, LinkedIn;
Payment & invoicing: Stripe UK Ltd (if and when payments are taken);
Call-tracking & recording: for quality-assurance and fraud-prevention on inbound calls.
All processors are bound by Article 28 UK GDPR data processing agreements that require them to protect your data and process it only on our documented instructions.
We use cookies, pixels, and advertising IDs to measure campaign performance and show you relevant ads. Some of these tools place information in or read information from your browser and may be joint-controller activities (e.g., Meta Pixel). These activities only occur where you consent via our cookie banner, in line with PECR Reg. 6.
We may disclose your data:
To comply with a lawful request, court order, regulator demand, or law-enforcement process;
To enforce our Terms of Service or protect our rights, property, or safety (including fraud prevention);
In connection with a corporate transaction — merger, acquisition, financing, or sale of assets — in which case the acquirer will be bound to honour this Policy.
We do not sell your personal data for monetary consideration. The fees we receive from clinics are referral fees for providing candidate introductions, not payments for the sale of data as property.
🚨 Important: Because partner clinics are primarily located in Turkey, and several service providers are in the United States, your personal data will be transferred outside the United Kingdom.
Turkey is NOT covered by a UK data-protection adequacy regulation (as of this Policy's Effective Date; see the ICO's list of "UK adequacy regulations" at ico.org.uk). This means we cannot rely on adequacy to transfer your data to Turkish clinics.
Our safeguards for transfers of your personal data outside the UK are:
UK International Data Transfer Agreement (UK IDTA) — executed between High Cloud Limited and each Turkish clinic, mirroring Article 46 UK GDPR;
International Data Transfer Addendum to the EU SCCs (UK Addendum) — where a processor already uses EU SCCs, we add the UK Addendum;
Transfer Impact Assessment (TIA) — we have carried out, and periodically refresh, a TIA for Turkey and the US, evaluating government-access risks (e.g., Turkish Law No. 5651, US FISA 702, EO 12333), the safeguards in place, and supplementary technical/contractual measures;
Your explicit consent under Art. 49(1)(a) UK GDPR — at the quiz-submission step, you explicitly consent to the specific transfer to Turkish clinics after being informed of the absence of an adequacy regulation and the potential risks (including limited enforcement routes in Turkey). We use Art. 49 only as a supplementary basis, not as the sole transfer mechanism, and only for occasional, non-bulk transfers of the specific data needed to match you to a clinic.
You can request a summary of the IDTA or TIA by emailing .
Your right to withdraw transfer consent: You may withdraw consent to international transfer at any time. Withdrawal will end our ability to share your data with overseas clinics, and we will typically also end the Service to you.
We retain personal data only for as long as necessary for the purposes set out below:
Category Retention period Lead & quiz data (you did not book a procedure) 24 months from last interaction, then deleted or anonymised Lead & quiz data (you booked or attended a consultation) 7 years from last procedure or interaction, to support clinical-record requirements and limitation periods under the Limitation Act 1980 Photographs (candidacy evaluation) 24 months, or until you withdraw consent — whichever is sooner Marketing consents, opt-outs, suppression lists Indefinitely (required to honour your opt-out under PECR) Call recordings 12 months Website analytics & cookie data Per each cookie's TTL in our Cookie Notice; typically 13 months maximum Accounting / tax records 6 years (HMRC / Companies Act 2006 requirement) Disputed claims or regulator investigations Until the matter is finally resolved
When the retention period ends, we either permanently delete or anonymise the data so it can no longer identify you.
You have the following rights regarding your personal data:
Right of access (Art. 15) — request a copy of the personal data we hold about you;
Right to rectification (Art. 16) — correct inaccurate or incomplete data;
Right to erasure / "right to be forgotten" (Art. 17) — request deletion in certain circumstances;
Right to restriction of processing (Art. 18) — limit how we use your data while we investigate a concern;
Right to data portability (Art. 20) — receive your data in a structured, commonly-used, machine-readable format;
Right to object (Art. 21) — object to processing based on legitimate interests, and to direct marketing at any time;
Right to withdraw consent (Art. 7(3)) — where processing is based on consent, withdraw it at any time;
Right not to be subject to solely automated decisions (Art. 22) — request human review of any decision that produces legal or similarly significant effects on you based solely on automated processing.
We use simple rules-based pre-qualification (e.g., age ≥18, Norwood level, budget bracket) to decide which clinic(s) to match you with. This is not solely automated decision-making with legal or similarly significant effects for the purposes of Art. 22, because:
Each clinic independently reviews and decides whether to offer a consultation;
You remain free to contact any clinic directly;
The matching merely determines who gets your enquiry, not whether you receive medical treatment.
Nonetheless, you can request human review of any pre-qualification outcome by emailing .
Email with:
The right you wish to exercise;
Enough information for us to verify your identity (typically matching your submission email/phone);
The specific data or processing activity concerned.
We will respond within one month (extendable by two further months for complex requests, as permitted by Art. 12(3)). There is no fee unless requests are manifestly unfounded or excessive.
If you believe we have not complied with UK data-protection law, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) — the UK supervisory authority — at ico.org.uk/make-a-complaint or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would appreciate the chance to address your concerns first, so please contact us before approaching the ICO.
We use industry-standard technical and organisational measures to protect your data, including:
TLS 1.2+ encryption for all data in transit;
Encryption at rest for sensitive fields and photographs;
Role-based access controls and least-privilege IAM;
Multi-factor authentication for all admin access to CRM and hosting;
Regular security reviews and penetration testing;
Audit logs of access to submitted data.
No system is completely secure. If we become aware of a personal-data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours as required by Article 33 UK GDPR and, where there is a high risk, notify affected individuals under Article 34.
We use cookies and similar technologies under PECR Regulation 6. Our Cookie Banner, shown on your first visit, allows you to accept or reject non-essential cookies. You can also change your preferences at any time via the Cookie Preferences link in the Site footer.
Cookie categories:
Strictly necessary: session, load-balancing, consent-storage cookies (no consent required);
Performance / analytics: GA4, Hotjar, Microsoft Clarity (consent required);
Advertising: Meta Pixel, TikTok Pixel, Google Ads, LinkedIn Insight (consent required);
Functional: language, chat-widget state (consent required).
For a full list with individual cookie names, providers, purposes, and durations, see our Cookie Notice (or linked in the Site footer).
Under PECR Regulation 22, we will send direct marketing by email, SMS, WhatsApp, or automated call only where you have given prior consent, except in the limited "soft opt-in" case (Reg. 22(3)) where you are an existing customer and we are marketing similar products.
You can opt out of marketing at any time by:
Clicking unsubscribe in any marketing email;
Replying STOP to any SMS or WhatsApp;
Emailing with "REMOVE" in the subject line.
We maintain a suppression list indefinitely to honour your opt-out.
See our separate SMS & Communications Consent document for detailed messaging terms.
The Platform may contain links to third-party sites (including clinic websites). We are not responsible for the privacy practices of those sites, and this Policy does not apply to them.
We may update this Policy from time to time. When we do, we will revise the "Last Updated" date at the top. Material changes will be notified to you by email or a prominent notice on the Site. Please review this Policy periodically.
For privacy enquiries, data-subject requests, or to exercise any right described above:
Data controller: High Cloud Limited (trading as HairPath) Company registered in: England and Wales Registered office: London, London England WC2H 9JQ Email: Phone: +90 535 481 71 95
ICO Registration: We are registered with the Information Commissioner's Office under the UK GDPR data-protection fee regime. Our ICO registration number is available on request.
End of Privacy Policy (UK)