Privacy Policy

1. Who we are

WMG Meds is the customer-facing brand for our private hair loss treatment service. Two registered companies sit behind it:

• Westminster Medical Group (Company No. 11237471) holds the Care Quality Commission (CQC) registration and is responsible for all clinical services, including clinical review, prescribing, oversight of dispensing under clinical supervision, and ongoing review. Westminster Medical Group is the data controller for your clinical and health information.
• WMG Health Ltd (Company No. 17127236) provides the booking, payment, and customer-facing commercial services. WMG Health Ltd is the data controller for your enquiry and payment information.

Both companies are registered in England and Wales at 134 Harley Street, London W1G 7JY. An intercompany data sharing arrangement is in place to allow your enquiry information to flow to the clinical team and your prescription, dispensing, and review records to flow back to you securely.

We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For any privacy matters, you can contact us at: health@wmglondon.com or by post to our clinic address.

2. What data we collect

We may collect and process the following categories of personal data:

• Identity data: your name, date of birth, NHS number (if provided)
• Contact data: email address, telephone number, postal address (where delivery of medication is arranged)
• Health data: clinical history, hair loss assessment, presenting symptoms, current medications, allergies, bloodwork results (where requested), clinician notes, prescriptions, dispensing records, and progress notes from ongoing reviews (this is special category data under UK GDPR)
• Payment data: billing address and payment confirmation (card details are processed by our payment provider and never stored by us)
• Technical data: IP address, browser type and version, pages visited, time and date of visits (collected via server logs)
• Communications: questionnaire submissions, enquiry form submissions, emails and call records

3. How we collect your data

• When you complete our online assessment questionnaire, enquiry form, or any subsequent registration or consent form
• When you call or email us directly
• Through any follow-up correspondence with the GMC-registered doctor reviewing your case
• From WMG Healthcare or other accredited laboratories, where bloodwork is arranged as part of your treatment plan
• From dispensing records when medication is supplied to you
• When you access our website (technical data via server logs)

4. Legal basis for processing

We rely on the following lawful bases under UK GDPR:

• Contract performance, to deliver the clinical review, prescription, dispensing, and ongoing review services you have engaged us for
• Legal obligation, to comply with CQC, GMC, Human Medicines Regulations, and HMRC requirements
• Vital interests, in an emergency, to protect your life or that of another person
• Legitimate interests, to improve our services, prevent fraud, and maintain clinic security
• Explicit consent, for health (special category) data, we obtain your explicit consent at registration and at clinical review. You may withdraw consent at any time, although doing so may end our ability to continue prescribing for you.

5. How we use your data

• To respond to your enquiry and review your case
• To conduct your clinical review and prepare your treatment plan
• To prescribe medication where clinically appropriate
• To arrange dispensing of your medication under clinical supervision
• To arrange any bloodwork via WMG Healthcare (with your consent)
• To contact you about ongoing reviews, plan adjustments, or any clinical concerns
• To arrange delivery of your medication
• To maintain clinical records in accordance with our CQC registration obligations
• To process your payment
• To send marketing communications only with your explicit opt-in consent

6. Sharing your data

We do not sell your personal data. We share it only where necessary:

• WMG Group clinicians and clinical staff, GMC-registered doctors and other healthcare professionals involved in your care
• WMG Healthcare, our sister diagnostics service, where bloodwork is arranged for you as part of treatment planning
• Payment processors, to process your payment securely (PCI-DSS compliant)
• Delivery providers, where you have opted for medication to be delivered to you, limited to name and delivery address only. Delivery packaging is discreet and contains no medication information on the outside
• IT infrastructure providers, hosting and security services operating under strict data processing agreements
• Legal or regulatory authorities, where required by law (CQC inspection, MHRA enquiry, court order, etc.)
• Your GP or other clinicians, only with your explicit written consent

All third parties are required to process your data securely and only for the specified purpose.

7. International transfers

We do not routinely transfer your personal data outside the UK. If any transfer is required, we ensure it is protected by UK GDPR-compliant safeguards (e.g. standard contractual clauses or adequacy decisions).

8. Data retention

We retain your health records, prescribing records, and dispensing records for a minimum of 8 years from your last clinical contact, in accordance with NHS and CQC guidance for private healthcare providers.

Assessment data (where no prescription was dispensed) is retained for 12 months.

Payment records are retained for 7 years for HMRC compliance.

9. Your rights

Under UK GDPR, you have the right to:

• Access, request a copy of the personal data we hold about you (Subject Access Request)
• Rectification, ask us to correct inaccurate data
• Erasure, ask us to delete your data, subject to our retention obligations for clinical records
• Restriction, ask us to limit how we use your data
• Portability, receive your data in a machine-readable format
• Object, object to processing based on legitimate interests or for direct marketing
• Withdraw consent, at any time, where processing is based on consent. Note: withdrawing consent for clinical data processing may end our ability to continue treating you safely.

To exercise any of these rights, contact us at health@wmglondon.com. We will respond within one calendar month.

10. Cookies and website analytics

Essential storage. Our site stores a small piece of data in your browser (using local storage) to remember your cookie preference, so we do not show you the consent banner on every page load. This is operationally necessary, contains no personal information, and is not used for tracking. Our server also keeps standard logs (IP address, page requests, timestamps) for security and uptime monitoring.

Optional analytics cookies. If you accept via our cookie banner, we may use Google Analytics to understand which pages are most useful to visitors and to improve the site. Analytics cookies are set in your browser and process anonymised usage data on our behalf. IP addresses are anonymised before storage. We do not link analytics data to your identity or your clinical record.

If you decline, no analytics cookies are set and no usage data is collected. You can change your choice at any time by clearing your browser's site data for this domain, which will re-show the banner.

We do not use advertising cookies, retargeting pixels, or social media tracking pixels (no Meta Pixel, no LinkedIn Insight Tag, no advertising trackers of any kind).

11. Security

We implement appropriate technical and organisational measures to protect your data, including:

• TLS encryption for all data in transit
• Encrypted storage for health and prescribing records
• Role-based access controls and staff training
• Regular security reviews

In the event of a data breach that is likely to affect your rights, we will notify you and the Information Commissioner's Office (ICO) within 72 hours as required by law.

12. Complaints

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

We would, however, appreciate the opportunity to address your concerns directly first. Please contact us at health@wmglondon.com.

13. Changes to this policy

We may update this Privacy Policy from time to time. The date at the top of this page reflects the most recent revision. Significant changes will be communicated to active patients by email.