Effective Date: April 21, 2026 Last Updated: April 21, 2026
This document explains the messaging consent you give to High Cloud Limited (trading as HairPath) when you submit your phone number through any form on hairpath.co or interact with our lead-generation flows. It sits alongside our Privacy Policy (UK) and Terms of Service (UK).
Under PECR Regulation 22, we must obtain your prior consent before sending electronic direct marketing by SMS, WhatsApp, MMS, or automated calling systems. By ticking the consent box (or otherwise actively opting in at the point of submission), you provide that consent.
By opting in, you agree that the following parties may contact you about your enquiry:
High Cloud Limited — the controller of your enquiry, sending confirmations, appointment reminders, educational content, and marketing about hair-restoration options;
Partner clinics — one or more hair-transplant clinics (primarily located in Turkey) who may contact you to arrange a consultation, send a quotation, and follow up on your interest.
Each clinic acts as an independent data controller for its own messaging and will have its own privacy notice. You may withdraw consent for any clinic at any time (see Section 7).
Messages may include:
Transactional: form-submission confirmations, appointment reminders, consultation-booking confirmations, receipt of payments (if applicable);
Service: candidacy results, clinic recommendations, requested quotes, follow-up questions from clinicians (e.g., clearer photo, medication list);
Marketing: educational content about hair loss and hair-transplant options, special offers, seasonal promotions, invitations to webinars or clinic events, abandoned-form reminders.
Message frequency: Typically 1–10 messages per week, varying based on your enquiry stage, requested information, and clinic response cycles. Frequency may increase short-term around consultation scheduling and decrease to quarterly or less after a decision.
Channels used: SMS, WhatsApp (via official Business API), MMS, email, automated voicemail drops, and live calls. Different channels may be used at different enquiry stages.
Standard message, call, and data rates may apply from your mobile network operator, depending on your tariff. We do not charge any fee for our messages; however, your carrier may. If you are uncertain about your plan, contact your mobile operator before opting in.
We rely on the following lawful bases for direct marketing by electronic means:
PECR Reg. 22(1) + (2): Your prior consent given by ticking the consent box at submission, which under ICO guidance is a specific, informed, unambiguous, and freely-given indication of your agreement — the same standard as Art. 4(11) / Art. 7 UK GDPR;
PECR Reg. 22(3) — "soft opt-in": Where you are an existing customer who has purchased (or negotiated for) similar services from us, we may send marketing for similar services with a simple opt-out, provided we gave you a simple means to refuse at the point of collection and in every subsequent message.
For marketing about third-party products (e.g., a clinic's non-hair services), we always rely on explicit opt-in consent and do not use the soft opt-in.
By ticking the consent box or submitting the form with the consent checkbox, you confirm that you:
Are at least 18 years old;
Are the account holder for, or are authorised to provide, the mobile number you entered;
Freely consent to receive the types of messages in Section 3, from the parties in Section 2, on the channels in Section 3, at the approximate frequency in Section 3;
Understand that your consent is not a condition of purchase — you can contact any clinic directly without using our Service;
Understand you can withdraw consent at any time (Section 7) and that withdrawal is as simple as giving consent;
Understand standard carrier rates may apply (Section 4);
Understand that by providing your number, you are not signed up to receive messages from any other company — each clinic and each service has its own consent flow.
Your consent is recorded with a timestamp, IP address, the specific language you agreed to, the URL and form name, and the consent-box state, and stored in our CRM audit log for at least 5 years to evidence compliance with PECR and UK GDPR Art. 7(1).
You can withdraw messaging consent at any time — easily, free of charge, and without having to explain why.
SMS: Reply STOP to any message. We will send one final confirmation SMS confirming you have been unsubscribed (this single opt-out-confirmation message is permitted by ICO guidance and does not itself require fresh consent) and then stop all marketing SMS to that number. Other STOP keywords we honour: STOP ALL, UNSUBSCRIBE, CANCEL, END, QUIT, OPT-OUT.
WhatsApp: Reply STOP, or use WhatsApp's own Block or Report buttons. We will mark your number as opted-out within 24 hours.
Email: Click the unsubscribe link at the foot of any marketing email.
All channels at once: Email with "REMOVE ALL" in the subject line. Include the phone numbers and email addresses you want unsubscribed. We will confirm removal within 10 working days.
Calls: Tell the caller to remove you from the list; they will update your profile immediately.
We maintain a suppression list indefinitely to honour your opt-out, even if you later submit another form without realising.
Opting out of marketing does not automatically stop critical transactional messages (e.g., appointment confirmations, safety-related messages about a booked procedure). If you want to stop these too, reply STOP ALL or email us directly.
Withdrawing consent does not affect the lawfulness of processing before withdrawal. You retain all other rights under the Terms of Service and Privacy Policy.
SMS: Reply HELP to any message and we will respond with:
Who we are (High Cloud Limited);
A brief description of the service;
Our support email () and phone (+90 535 481 71 95);
Instructions to reply STOP to unsubscribe.
WhatsApp: Reply HELP for the same information, or use the WhatsApp business-profile contact details.
Email / phone: Contact or +90 535 481 71 95 during our stated business hours.
You represent that the mobile number and email address you provided are yours or that you are authorised to receive messages at them. If your number changes, reassigns, or is no longer in use, please:
Reply STOP to any message to end communications; or
Email to update your record.
We are not liable for messages sent to a number that has been reassigned by your carrier to a new user, provided we acted reasonably based on the contact details you gave us.
If we contact you via WhatsApp:
Messages are sent via the official WhatsApp Business API, through a licensed Business Solution Provider (BSP);
Messages may be subject to Meta's template approval system for outbound business-initiated messaging;
Some types of content are prohibited by Meta's WhatsApp Business Policy (e.g., promoting certain restricted products);
You can block our WhatsApp number natively inside WhatsApp; we will receive that signal and mark your number as opted-out;
Meta Platforms Ireland Ltd is the controller of WhatsApp-level metadata (delivery receipts, read receipts, etc.); we are controllers of the message content that relates to your enquiry.
Inbound and outbound phone calls may be recorded for quality assurance, staff training, compliance monitoring, and fraud prevention. Call recording is lawful under DPA 2018 and the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2000 where:
We have given you clear notice at the start of the call that the call may be recorded, and
We have a lawful basis under Art. 6 UK GDPR (typically legitimate interests) and, where special-category data is discussed, an Art. 9 condition (explicit consent).
You may request a copy of a call recording you were party to, or request deletion, by emailing . Recordings are typically retained for 12 months (see Section 7 of the Privacy Policy).
Before we introduce you to a partner clinic, we ensure the clinic:
Has read and accepted our PECR-compliant partner agreement;
Will identify themselves clearly in the first message they send you;
Will include an opt-out mechanism in every marketing message;
Honours your opt-out if you reply STOP to them directly.
If you opt out of a specific clinic's messages but not ours, we will flag that clinic in your record and will not share your data with that clinic again. If a partner clinic contacts you after you have opted out, please email with the clinic name and the message; we will investigate and take remedial action, which may include terminating the partnership.
If you are registered with the UK Telephone Preference Service (TPS) or Corporate TPS (CTPS), we will not make unsolicited live marketing calls to your number unless you have given us specific prior consent overriding your TPS registration (PECR Reg. 21(2)). By ticking the consent box on the form, you give that specific prior consent for us and our partner clinics to make marketing calls about hair-restoration services in response to your enquiry. You can withdraw this at any time as described in Section 7.
We do not use automated calling systems (pre-recorded messages / robocalls) for marketing without separate, specific opt-in consent for that channel under PECR Reg. 19.
Our messaging is not directed at anyone under 18. We do not knowingly send marketing messages to children. If you believe we hold a phone number for someone under 18, email ; we will delete it promptly.
We may update this document from time to time. Material changes — especially to the categories of message you will receive, the parties contacting you, or the opt-out mechanism — will be notified via email or SMS to existing opt-in contacts before the change takes effect. The "Last Updated" date at the top reflects the most recent version.
Data controller: High Cloud Limited (trading as HairPath) Registered in: England and Wales Registered office: London, London England WC2H 9JQ Email: Phone: +90 535 481 71 95 ICO reference: available on request.
You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint if you believe we have breached PECR or UK GDPR.