Privacy Policy

1. Who we are

WMG Meds is the customer-facing brand for our private hair loss treatment service. Two registered companies sit behind it:

• Westminster Medical Group (Company No. 11237471) holds the Care Quality Commission (CQC) registration and is responsible for all clinical services, including clinical review, prescribing, oversight of dispensing under clinical supervision, and ongoing review. Westminster Medical Group is the data controller for your clinical and health information.
• WMG Health Ltd (Company No. 17127236) provides the booking, payment, and customer-facing commercial services. WMG Health Ltd is the data controller for your enquiry, order and payment information.

Both companies are registered in England and Wales, and services are provided at 134 Harley Street, London W1G 7JY. An intercompany data sharing arrangement is in place to allow your enquiry information to flow to the clinical team and your prescription, dispensing, and review records to flow back to you securely.

We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For any privacy matters, you can contact us at: [email protected] or by post to our clinic address.

2. What data we collect

We may collect and process the following categories of personal data:

• Identity data: your name, date of birth, sex, NHS number (if provided), and a record of any identity check we carry out
• Contact data: email address, telephone number, postal address (where delivery of medication is arranged)
• Health data: clinical history, hair loss assessment answers, presenting symptoms, current medications, allergies, bloodwork results (where requested), clinician notes and decisions, prescriptions, order and dispensing records, progress notes from ongoing reviews, and any progress photos you upload to your patient portal (this is special category data under UK GDPR)
• Payment data: billing address, payment confirmation and payment history (card details are processed by our payment provider and never stored by us)
• Account and consent data: your patient portal account details, records of the consents you give us, and, if you switch on notifications, the device information needed to send them
• Technical data: IP address, browser type and version, pages visited, time and date of visits (collected via server logs)
• Communications: questionnaire submissions, enquiry form submissions, emails and call records

3. How we collect your data

• When you complete our online assessment questionnaire, enquiry form, or any subsequent registration or consent form
• Through your patient portal, including any progress photos you choose to upload
• When you call or email us directly
• Through any follow-up correspondence with the GMC-registered doctor reviewing your case
• From WMG Healthcare or other accredited laboratories, where bloodwork is arranged as part of your treatment plan
• From dispensing records when medication is supplied to you
• When you access our website (technical data via server logs)

4. Legal basis for processing

We rely on the following lawful bases under UK GDPR:

• Contract performance, to deliver the clinical review, prescription, dispensing, and ongoing review services you have engaged us for
• Legal obligation, to comply with CQC, GMC, Human Medicines Regulations, and HMRC requirements
• Vital interests, in an emergency, to protect your life or that of another person
• Legitimate interests, to improve our services, prevent fraud, and maintain clinic security
• Provision of health care (UK GDPR Article 9(2)(h)), for health (special category) data, where we process it to provide your care, such as clinical review and prescribing, by or under the responsibility of a health professional who owes a duty of confidentiality. This also allows us to keep the clinical record that the law requires.
• Explicit consent, for optional extras and for marketing, where we ask for it (for example, progress photos you choose to upload and marketing messages). You may withdraw consent at any time, although withdrawing consent to the processing we need to treat you safely may end our ability to continue prescribing for you. We also ask for your agreement to your treatment as a matter of good clinical practice, and that is separate from the legal basis for handling your data.

5. How we use your data

• To respond to your enquiry and review your case
• To conduct your clinical review and prepare your treatment plan
• To prescribe medication where clinically appropriate
• To arrange dispensing of your medication under clinical supervision
• To arrange any bloodwork via WMG Healthcare (with your consent)
• To contact you about ongoing reviews, plan adjustments, or any clinical concerns
• To arrange delivery of your medication
• To maintain clinical records in accordance with our CQC registration obligations
• To process your payment
• To send marketing communications only with your explicit opt-in consent

Decisions about your care. Our online assessment uses safety rules that flag particular answers for clinical attention. These rules do not decide whether you are prescribed anything. A GMC-registered doctor reviews your case and makes every prescribing decision.

6. Sharing your data

We do not sell your personal data. We share it only where necessary:

• Westminster Medical Group clinicians and clinical staff, GMC-registered doctors and other healthcare professionals involved in your care
• WMG Healthcare, our sister diagnostics service, where bloodwork is arranged for you as part of treatment planning
• Our patient platform (Marlmed), which holds your assessment, clinical record, prescriptions, orders and decisions, and your patient portal account and progress photos. Marlmed acts as our data processor under a data processing agreement
• Our transactional email provider (Resend), which delivers the emails we send to patients and to our clinicians, including payment links and decision notifications. The content of those emails passes through this provider solely to deliver the message, under a data processing agreement
• Payment processor (Stripe), to process your payment securely (PCI-DSS compliant)
• Our partner pharmacy (Certus Healthcare Ltd, trading as Primed Pharmacy), which receives your name, date of birth, delivery address and prescription so that it can dispense your medication, and which handles that information under its own professional and regulatory obligations
• Delivery providers, where you have opted for medication to be delivered to you, limited to name and delivery address only. Delivery packaging is discreet and contains no medication information on the outside
• Hosting and security providers, our systems are hosted in the UK (DigitalOcean, London), and Cloudflare delivers and protects our websites, so web traffic passes through its network. Both operate under data processing agreements
• Legal or regulatory authorities, where required by law (CQC inspection, MHRA enquiry, court order, etc.)
• Your GP or other clinicians, only with your explicit written consent

All third parties are required to process your data securely and only for the specified purpose.

7. International transfers

Our systems are hosted in the UK. However, some of the service providers we use are based in, or process data in, the United States, so some of your personal data is transferred there as part of normal operation. These are Resend (email delivery), Stripe (payments), Cloudflare (website delivery and security), Google Analytics (only if you accept analytics cookies), and Sentry (error monitoring on our patient platform, with personal data removed before it is sent).

Wherever we transfer personal data outside the UK, we make sure it is protected by an appropriate safeguard, such as the UK-US data bridge where the provider is certified under it, or the UK International Data Transfer Agreement or UK Addendum to the EU standard contractual clauses.

8. Data retention

We retain your health records, prescribing records, and dispensing records for a minimum of 8 years from your last clinical contact, in accordance with NHS and CQC guidance for private healthcare providers.

Assessment data (where no prescription was dispensed) is kept only for as long as it is needed for your clinical review, any follow-up and our clinical record-keeping obligations, and is reviewed periodically. You can ask us what we hold and request deletion where our legal obligations allow, by emailing [email protected].

Payment records are retained for 7 years for HMRC compliance.

9. Your rights

Under UK GDPR, you have the right to:

• Access, request a copy of the personal data we hold about you (Subject Access Request)
• Rectification, ask us to correct inaccurate data
• Erasure, ask us to delete your data, subject to our retention obligations for clinical records
• Restriction, ask us to limit how we use your data
• Portability, receive your data in a machine-readable format
• Object, object to processing based on legitimate interests or for direct marketing
• Withdraw consent, at any time, where processing is based on consent. Note: withdrawing consent for clinical data processing may end our ability to continue treating you safely.

To exercise any of these rights, contact us at [email protected]. We will respond within one calendar month.

10. Cookies and website analytics

Essential storage. Our site stores a small piece of data in your browser (using local storage) to remember your cookie preference, so we do not show you the consent banner on every page load. This is operationally necessary, contains no personal information, and is not used for tracking. Our server also keeps standard logs (IP address, page requests, timestamps) for security and uptime monitoring.

Optional analytics cookies. If you accept via our cookie banner, we may use Google Analytics to understand which pages are most useful to visitors and to improve the site. Analytics cookies are set in your browser and process anonymised usage data on our behalf. IP addresses are anonymised before storage. We do not link analytics data to your identity or your clinical record.

What the analytics record. If you accept, the analytics describe how the site is used: which pages are viewed, which buttons are clicked, how far down a page you read, and how far through the assessment you get, counted by step number only. We never send your answers to the assessment, any health information, or the medicines you looked at to Google Analytics, and we do not use the data for advertising or remarketing.

How you arrived. If you accept, we also keep a first-party cookie for up to 30 days that notes how you first arrived (for example the campaign link or website you came from). If you then submit an assessment, it is saved with your submission so we can tell which of our pages and campaigns are useful.

The page you started from. When you start the assessment from one of our product pages, we note which page you came from and pass it to our clinical team with your assessment as background. This happens whether or not you accepted cookies, because it travels with the assessment you choose to submit. It is not shown to you and it is not treated as a request for any medicine.

If you decline, no analytics cookies are set and no analytics usage data is collected. You can change your choice at any time by clearing your browser's site data for this domain, which will re-show the banner.

We do not use advertising cookies, retargeting pixels, or social media tracking pixels (no Meta Pixel, no LinkedIn Insight Tag, no advertising trackers of any kind).

11. Security

We implement appropriate technical and organisational measures to protect your data, including:

• TLS encryption for all data in transit
• Encrypted storage for health and prescribing records
• Role-based access controls and staff training
• Regular security reviews

In the event of a data breach that is likely to affect your rights, we will notify you and the Information Commissioner's Office (ICO) within 72 hours as required by law.

12. Complaints

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

We would, however, appreciate the opportunity to address your concerns directly first. Please contact us at [email protected].

13. Changes to this policy

We may update this Privacy Policy from time to time. The date at the top of this page reflects the most recent revision. Significant changes will be communicated to active patients by email.