Privacy Policy

Last updated: 16 June 2026

Vertex Medic ("Vertex Medic", "we", "us", "our") is committed to protecting your personal data and respecting your privacy.

This Privacy Policy explains how we collect, use, store, and protect your personal information when you visit vertexmedic.com, submit an enquiry, book a consultation, purchase a product, or use any of our services.

Please read this policy carefully. By using our website or services, you acknowledge that you have read and understood this policy.

1. WHO WE ARE

Vertex Medic is the data controller for personal data collected through this website and in connection with our services.

Vertex Medic is operated by CALDRENOR LTD, company number 17446753, whose registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. The registered office is a Companies House filing address, not a clinic or treatment location. Email: privacy@vertexmedic.com Website: https://vertexmedic.com

CALDRENOR LTD has applied to the Information Commissioner's Office and paid the fee; the final registration reference is still pending. This entry will be updated once the reference is issued.

2. OUR ROLE. ARRANGING AND COORDINATING YOUR CARE

Vertex Medic arranges and coordinates hair restoration care. The care itself is delivered by an independent GMC-registered clinician and a separately registered healthcare provider, each responsible for their own clinical care and each an independent controller of the health data they hold. We do not ourselves perform surgical or medical procedures.

Any surgical procedure arranged through Vertex Medic will be performed by a CQC-registered provider, or by a GMC-registered practitioners within CQC-registered facilities, who hold responsibility for clinical care under their own registration.

3. WHAT PERSONAL DATA WE COLLECT

We collect the following categories of personal data:

Contact and identity data: Name, email address, telephone number, preferred contact method, location/preferred clinic.

Enquiry and consultation data: Details of your hair loss, hair loss pattern, treatment interests, graft estimates, and responses to our hair assessment quiz or simulator.

Special category health data (Article 9 UK GDPR): Information about your health condition, hair loss history, blood test results (where obtained through the diagnostics service), and medical history relevant to treatment planning.

Photographs of your scalp and hair: If you choose to send photographs, they are compressed on your own device and stored securely. They are used to prepare your assessment, and where treatment is being considered they are shared securely with the clinician and healthcare provider involved in your care. Photographs of your scalp are health information, so they are treated as special category data under Article 9 in exactly the same way as the rest of your health information. You are never required to send photographs to make an enquiry.

Financial data: Payment information processed via Stripe (we do not store card details, these are handled by Stripe's PCI-DSS compliant infrastructure). Order information for product purchases.

Technical and usage data: IP address, browser type, device type, pages visited, time spent on pages, referral source, and interaction data collected via Google Analytics 4 (GA4) and Microsoft Clarity (subject to your cookie consent).

Communications data: Records of your communications with us by email, phone, or WhatsApp.

4. HOW WE COLLECT YOUR DATA

We collect personal data through:

• Our website contact and enquiry forms
• Our hair assessment quiz and simulator
• Email, telephone, and WhatsApp communications
• Product purchases via Stripe
• Blood test kit orders and results (via the provider's laboratory)
• Cookies and analytics tools (subject to your consent)

5. LEGAL BASIS FOR PROCESSING

We process your personal data on the following legal bases under Article 6 UK GDPR:

Consent (Article 6(1)(a)): For marketing communications, analytics cookies, and non-essential tracking technologies, where you have given explicit, active consent.

Contract (Article 6(1)(b)): For processing necessary to fulfil a product order, consultation booking, or service agreement with you.

Legitimate interests (Article 6(1)(f)): For responding to enquiries, improving our services, and maintaining records of communications. Where we rely on legitimate interests we balance them against your rights, and you can object at any time by contacting privacy@vertexmedic.com.

Legal obligation (Article 6(1)(c)): Where processing is required by law, including financial record-keeping and fraud prevention.

Special category health data (Article 9 UK GDPR): We process health data (including hair loss information and blood test results) on the basis of:

• Your explicit consent under Article 9(2)(a), taken separately from any other consent, by a clearly worded and unticked box at the point you give us the information.

We do not rely on Article 9(2)(h) for our own processing. That condition concerns the provision of health or social care, and Vertex Medic coordinates your care rather than providing it. The clinician and the healthcare provider involved in your treatment decide their own legal bases for their own clinical records, as separate controllers.

We never process special category health data on the basis of legitimate interests alone.

6. HOW WE USE YOUR DATA

We use your personal data to:

• Respond to your enquiries and arrange consultations
• Provide you with a hair assessment and personalised treatment plan
• Process product orders and payments
• Send you appointment reminders and follow-up communications
• Provide blood test results and specialist reports (where applicable)
• Improve our website and services
• Comply with legal and regulatory obligations
• Send marketing communications (only with your explicit consent)

We never sell your personal data to third parties.

7. MARKETING COMMUNICATIONS

We will only send you marketing emails, SMS, or WhatsApp messages if you have explicitly opted in to receive them.

You may withdraw consent for marketing at any time by:

• Clicking the unsubscribe link in any marketing email
• Emailing privacy@vertexmedic.com
• Texting STOP in response to any SMS

Withdrawing marketing consent does not affect the lawfulness of processing before withdrawal.

8. WHO WE SHARE YOUR DATA WITH

We share your personal data only where necessary:

CQC-registered clinics and surgeons: We share relevant consultation and health data with the CQC-registered clinic or GMC-registered surgeon fulfilling your procedure. This sharing is necessary for the provision of your treatment.

Laboratory: Where a blood test forms part of your care, samples and results are processed by the laboratory the treating provider uses. Your data is shared only as necessary for analysis and reporting.

Pharmacy: For medication prescriptions, relevant health and contact data is shared with the registered UK pharmacy the prescribing clinician uses.

EmailJS: Used to send automated confirmation emails. Data passes through EmailJS's infrastructure under appropriate data processing agreements.

Google (GA4): Website usage data is collected via Google Analytics 4 subject to your cookie consent. Google processes this data in accordance with its Privacy Policy and UK GDPR transfer safeguards.

Microsoft (Clarity): Session recording and heatmap data is collected via Microsoft Clarity subject to your cookie consent.

Stripe: Payment processing for product orders. Stripe is PCI-DSS compliant and processes payment data under its own privacy policy and data processing agreement.

Supabase: Our enquiry and booking record system. Enquiry details, assessment answers and any photographs you send are stored here.

Cloudflare: Hosts this website, provides security and bot protection (including Turnstile on our forms), and measures aggregate website usage and real-user performance so we can find and fix problems with the site. That performance measurement uses no cookies and stores nothing on your device: no advertising identifier, no persistent visitor ID, no session recording, and it is never used to make decisions about you individually or to match you to an assessment result. It collects technical page timing and page speed information only, sent to our own domain. You can object to it by turning off Analytics and measurement in Cookie Preferences, or by choosing Reject all. See our Cookies Policy, section 3.4.

Resend: Sends internal notifications to our team when an enquiry arrives.

Cal.com: Powers the booking calendar where you choose an appointment time. It loads only when you open it.

Twilio: Sends SMS and WhatsApp messages where you have asked us to contact you that way.

We put a written data processing agreement in place with each processor we engage. If you want to know the status of a specific processor, ask us at privacy@vertexmedic.com.

9. INTERNATIONAL DATA TRANSFERS

Some of our service providers (including Google and Microsoft) may transfer data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, including:

• UK International Data Transfer Agreements (IDTAs)
• Standard Contractual Clauses approved by the ICO
• Adequacy decisions recognised under UK law

10. DATA RETENTION

We retain your personal data for the following periods:

Data type	Retention period
Enquiries that do not become treatment	12 months from last contact
Patient records, where you go on to be treated	7 years from last contact
Medical/health records	8 years from last treatment (NHS standard)
Blood test results	8 years
Product purchase records	7 years (legal/financial requirement)
Marketing consent records	Until consent withdrawn + 3 years
Cookie consent records	3 years
Website analytics data	26 months (GA4 default)

After these periods, data is securely deleted or anonymised.

The two enquiry periods above are the reason our forms tell you that enquiry data is kept for 12 months unless you become a patient. If your enquiry does not lead to treatment, 12 months is the whole of it. If it does, your record becomes a patient record and the longer period applies, because we are then keeping the history of your care.

11. YOUR RIGHTS UNDER UK GDPR

You have the following rights regarding your personal data:

Right of access: Request a copy of the personal data we hold about you. Right to rectification: Request correction of inaccurate or incomplete data. Right to erasure: Request deletion of your data where no longer necessary. Right to restriction: Request we limit processing of your data. Right to portability: Receive your data in a structured, machine-readable format. Right to object: Object to processing based on legitimate interests. Right to withdraw consent: Withdraw consent at any time where processing is consent-based. Rights regarding automated decision-making: We do not make solely automated decisions with legal or significant effects.

To exercise any right, contact us at: Email: privacy@vertexmedic.com Post: Vertex Medic

We will respond within one calendar month. We may need to verify your identity before processing your request.

12. DATA PROTECTION COMPLAINTS PROCEDURE

Vertex Medic has a formal data protection complaints procedure in compliance with the Data (Use and Access) Act 2025, in force from 5 February 2026.

How to raise a complaint:

Step 1. Contact us directly: Email: privacy@vertexmedic.com Subject line: "Data Protection Complaint" Include: your name, contact details, description of the complaint, and what resolution you are seeking.

Step 2. We will:

• Acknowledge your complaint within 5 working days
• Investigate and respond fully within 30 calendar days
• Maintain a written record of the complaint, investigation, and outcome
• Escalate internally if the complaint involves sensitive matters

Step 3. If unresolved: If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

ICO website: https://ico.org.uk/make-a-complaint ICO helpline: 0303 123 1113 ICO address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

All complaints are logged with: date received, nature of complaint, investigation steps taken, outcome, and date resolved. This audit trail is retained for 3 years.

13. DATA SECURITY

We implement appropriate technical and organisational measures to protect your personal data, including:

• SSL/TLS encryption for all data in transit
• Access controls limiting data access to authorised personnel only
• Regular security reviews of our systems and third-party processors
• Secure deletion procedures for data no longer required

In the event of a personal data breach likely to result in risk to individuals, we will notify the ICO within 72 hours and affected individuals without undue delay.

14. CHILDREN

Our services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from anyone under 18. If you believe we have collected data from a minor, please contact us immediately at privacy@vertexmedic.com.

15. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. The date at the top of this page shows when it was last updated. Material changes will be communicated by email where we hold your contact details.

16. CONTACT US

For any questions about this Privacy Policy or your personal data:

Vertex Medic

Email: privacy@vertexmedic.com Website: https://vertexmedic.com

CALDRENOR LTD has applied to the Information Commissioner's Office and paid the fee; the final registration reference is still pending.