Privacy policy

The controller of personal data processed through HairFUE is the administrator of the hairfue.com service. You can reach the administrator about anything in this policy at [email protected].

This policy explains what we collect, why, who receives it and what rights you have. It applies to patients, clinic users and visitors of hairfue.com.

Account data. Your email address, a password stored only as a secure hash, your name if you give it, and the confirmation that you verified your email.

Health data. When you use the graft estimate or request quotes, you may give us photos of your scalp (front, top, crown and sides), your hair-loss pattern, answers about previous treatment and other medical history. This is special category data under Article 9 of the GDPR, and we treat it with the strictest protection described below.

Request data. Your budget, preferred countries and techniques, travel window, the clinics matched to your request, the offers you receive and your messages with clinics.

Clinic data. For clinic users, the clinic profile, team members, offers, billing contact and subscription status. Card details are entered on the payment operator's page and never reach our servers.

Technical data. IP address, browser type and server logs needed to keep the service secure and working.

We process health data only on the basis of your explicit consent under Article 9(2)(a) of the GDPR. You give it with a separate checkbox each time you upload photos or send a quote request, and we store the exact consent text and the time you gave it.

You can withdraw consent at any time in your dashboard at /app/privacy. Withdrawal stops further sharing and deletes the photos of that request. It does not affect processing that happened before you withdrew.

Other data is processed to provide the service you asked for (Article 6(1)(b)), to meet legal obligations such as tax and accounting records (Article 6(1)(c)) and for our legitimate interest in keeping the service secure and preventing abuse (Article 6(1)(f)).

Your health data reaches a clinic only when you send a request and agree that this clinic may see it. A request goes to 3 to 5 clinics that match your criteria, and you can see and limit which clinics receive your photos before sending.

A clinic that receives your request becomes a separate controller of the data it receives, for the purpose of preparing an offer and, if you book, providing treatment. Its own privacy policy then applies to what it does with your data.

We never sell your data and never share it with clinics you did not select, with advertisers or with data brokers.

We use a small number of processors bound by data processing agreements. We describe them by category:

• a hosting provider with servers in the European Union, which stores the service and its databases,
• a payment operator, which processes clinic subscription payments,
• an email delivery provider, which sends sign-in codes, confirmations and notifications,
• an AI model provider, which analyses photos for the graft estimate when you request it.

Where a processor handles data outside the European Economic Area, the transfer relies on an adequacy decision or standard contractual clauses approved by the European Commission.

Photos and medical answers are encrypted at rest, and the storage paths of photos are encrypted too. Photos are kept on private storage that is not reachable from the web, and each view by a clinic is checked against your consent.

All traffic uses encrypted connections. Access by our staff is limited to what is needed to run and support the service.

Health data from a quote request is deleted automatically 180 days after the request is closed or withdrawn, or earlier if you delete it yourself.

Account data is kept while your account exists. When you delete your account, we delete or anonymise your data, except records we must keep by law, such as invoices for clinic subscriptions, which we keep for the period required by tax law.

Server logs are kept for a short period needed for security and then deleted.

Under the GDPR you have the right to:

• access your data and receive a copy of it,
• export your data in a machine-readable format, available any time at /app/privacy,
• correct inaccurate data,
• delete your photos, your health data or your whole account,
• restrict processing and object to processing based on legitimate interest,
• withdraw consent at any time,
• lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.

Most of these actions are available in your dashboard. For anything else, write to [email protected] and we answer within one month.

Clinics and doctors listed from public information can ask for a correction or removal of their profile through the correction request page.

HairFUE uses only strictly necessary cookies: a session cookie that keeps you signed in and a security cookie that protects forms against cross-site request forgery. They are required for the service to work, so they do not need consent.

We do not use advertising, tracking or social media cookies, and we do not load third-party trackers. That is why you do not see a cookie banner.

HairFUE is intended for adults. You must be at least 18 years old to create an account or send a quote request.

If we change this policy, we publish the new version on this page with a new date. If a change affects how we use health data, we ask for your consent again before it applies to you.