Last updated: 11 September 2026
This policy explains what personal information The Tonic Hair & Scalp Clinic collects, why we collect it, what we do with it and what rights you have over it. It covers our website, our online shop, enquiries you send us and the records we keep when you attend the clinic.
We have tried to write it in plain English rather than legal boilerplate. If anything here is unclear, please ask us — our details are at the end.
Who we are
The Tonic Clinic Ltd, trading as The Tonic Hair & Scalp Clinic, is the “data controller” for the information described in this policy. That means we decide what is collected and what happens to it.
The Tonic Clinic Ltd
17 The Courtyard, Bawtry, Doncaster, DN10 6JG
Email: admin@thetonicclinic.com
Telephone: 07990 367561
We are not required to appoint a Data Protection Officer. Data protection questions are handled directly by the clinic at the address above.
The information we collect
Information you give us
- When you enquire — your name, email address, telephone number and whatever you tell us in your message.
- When you book a consultation or treatment — your name, contact details and appointment details.
- When you buy from our shop — your name, billing and delivery address, email address, telephone number and order details.
- When you attend the clinic — the health information described below.
- When you contact us on WhatsApp, Messenger, by phone or by email — the contents of that conversation.
Health information
Because we are a hair and scalp clinic, some of what we hold is information about your health. Data protection law treats this as “special category” information and gives it extra protection. Depending on why you come to us, this can include:
- your presenting concern and how long you have had it
- relevant medical history, diagnoses, medication and supplements you are taking
- allergies and previous reactions to treatments
- scalp and hair assessment findings, including trichoscope images
- photographs taken to record your starting point and track progress
- notes on the treatment you receive and how you respond to it
We collect this because we cannot assess you safely or recommend a suitable treatment without it. We only collect what is relevant to your care.
Photographs. We take clinical photographs only with your agreement, and we ask separately before any image is used for anything other than your own records. Agreeing to clinical photographs for your file does not give us permission to use your image in marketing or on social media — that is always a separate conversation, and you can say no, or change your mind later, without it affecting your care.
Information collected automatically
When you use the website, some information is collected by the website itself and by the services we use to run it:
- your IP address, browser type and version, operating system and device type
- the pages you visit, how long you spend on them and the links you follow
- the website or advert that brought you to us, and any campaign details attached to that link
- cookies and similar technologies, as described in our Cookie Policy
Analytics and advertising information is only collected if you agree to it in the cookie banner. If you decline, those services are not loaded.
Why we use your information, and our lawful basis
Data protection law requires us to have a valid reason — a “lawful basis” — for everything we do with your information. Here is the full picture:
| What we do | Why | Lawful basis |
|---|---|---|
| Answer your enquiry | To respond to you and give you the information you asked for | Legitimate interests — responding to someone who has contacted us |
| Arrange and manage your appointment | To book you in, confirm the time and remind you | Contract — taking steps to provide the service you asked for |
| Assess you and provide treatment | To decide what is suitable and deliver it safely | Contract, and explicit consent for the health information involved |
| Keep clinical records | So there is an accurate account of your care, and to protect both of us if a question arises later | Legal obligation and legitimate interests, with explicit consent for health information |
| Take and store clinical photographs | To record your starting point and track how you respond | Explicit consent, which you can withdraw |
| Sell and deliver shop orders | To take payment, send your order and handle returns | Contract |
| Keep accounting records | Because tax law requires it | Legal obligation |
| Send marketing emails or messages | To tell you about treatments, offers and clinic news | Consent — and only if you have opted in |
| Measure how the website is used | To understand what people look for and improve the site | Consent, given through the cookie banner |
| Measure our advertising | To see which adverts lead to enquiries and avoid wasting money | Consent, given through the cookie banner |
| Show reviews on the site | To display our Google reviews | Legitimate interests |
| Keep the website secure and working | To prevent abuse, spam and fraud | Legitimate interests |
Where we rely on legitimate interests, we have considered whether our reason is fair to you and whether you would reasonably expect it. You can object to any of it — see Your rights below.
A note on consent for health information
For the health information we hold, we rely on your explicit consent. In practice that means we explain what we are recording and why, and you agree to it before we proceed. You can withdraw that consent at any time. If you do, we will stop using your health information for your care — though we may need to keep the existing record for the period described below, because deleting a clinical record we have already acted on would leave us unable to account for treatment we have given.
Who we share your information with
We do not sell your information, and we never share it with anyone for their own marketing. We do use a small number of trusted suppliers to run the clinic and the website. Each of them only gets what they need to do their job:
| Who | What for | What they receive |
|---|---|---|
| Setmore | Online appointment booking | Your name, contact details and appointment details |
| Stripe | Card payments in the shop | Your payment details and order amount — card numbers go straight to Stripe and are never stored by us |
| Klarna | Pay-later checkout, if you choose it | The details Klarna needs for its own checks. Klarna decides how it uses that information and has its own privacy policy |
| Google (Analytics & Ads) | Website statistics and advertising measurement | Cookie and usage data, only if you consent |
| Trustindex | Displaying our Google reviews | No information about you — it displays reviews already public on Google |
| CookieYes | Recording your cookie choice | Your consent preferences |
| Our website host | Running and backing up the website | Anything stored on the website, including form submissions and orders |
| Our email provider | Sending and receiving email | The contents of emails between us |
| Our accountant | Bookkeeping and tax | Transaction records, not clinical records |
We may also share information where we are legally required to — for example with HMRC, in response to a valid court order, or where there is a serious risk to someone’s safety. If you ask us to refer you to a GP, dermatologist or other practitioner, we will share only what is relevant, and only with your agreement.
Information sent outside the UK
Some of our suppliers — Google and Stripe in particular — are based outside the UK or store information on servers abroad. Where information is transferred outside the UK, we rely on the safeguards recognised by UK law, such as UK adequacy regulations or the International Data Transfer Agreement, so that your information keeps an equivalent level of protection.
Your clinical records are held in the UK.
How long we keep your information
We keep information only as long as we have a reason to:
| Information | How long |
|---|---|
| Clinical records, including consultation notes and clinical photographs | 8 years after your last appointment, in line with accepted practice for adult health records |
| Enquiries that do not lead to an appointment | 2 years from your last contact with us |
| Shop orders and payment records | 7 years, as required for tax purposes |
| Marketing consents and opt-outs | Until you withdraw consent, plus a record of the opt-out so we do not contact you again by mistake |
| Website analytics | Up to 14 months |
| Cookie consent record | 12 months, after which you will be asked again |
When the period ends we delete the information or anonymise it so it can no longer identify you.
How we protect your information
- The website runs over an encrypted connection (HTTPS) and is kept updated.
- Access to clinical records is limited to the clinic staff who need it.
- Card details are handled entirely by Stripe — we never see or store your full card number.
- Paper records, where we hold them, are kept locked away on the premises.
- We keep backups so that information is not lost.
No system is completely secure, and no one can promise otherwise. If a breach occurs that is likely to put your rights at risk, we will tell you and report it to the Information Commissioner’s Office as the law requires.
Marketing
We will only send you marketing if you have asked us to. Every marketing message includes a way to unsubscribe, and you can also just tell us — by email, on the phone or at the clinic — and we will stop. Opting out of marketing does not affect messages about an appointment you have booked or an order you have placed, which we need to send you either way.
Your rights
You have the following rights over your information, free of charge in almost all cases:
- To be told what we hold and what we do with it — which is what this policy is for.
- To get a copy of the information we hold about you.
- To have mistakes corrected.
- To have information deleted, where we no longer have a good reason to keep it.
- To restrict what we do with it while a question about it is resolved.
- To object to us using it, including for marketing — for marketing there is no exception, we must stop.
- To have it transferred to you or another provider in a portable format.
- To withdraw consent at any time, where we relied on consent.
- Not to be subject to automated decision-making. We do not make any decisions about you by automated means.
To exercise any of these, email admin@thetonicclinic.com or write to us at the address above. We may ask you to confirm your identity before we release records — that is to protect you. We will respond within one month, and will tell you if we need longer because the request is complex.
Cookies
The website uses cookies. The necessary ones make the site work — remembering your basket, keeping you logged in, and recording your cookie choice. The rest, which cover analytics and advertising, are only set if you agree.
You can change your mind at any time using the cookie settings link on the site, or by clearing cookies in your browser. Full details are in our Cookie Policy.
Children
We treat anyone under 18 as a child for data protection purposes. We do not knowingly collect information from children through the website, and the online shop is intended for adults. Where we see a child at the clinic, we do so with the agreement of a parent or guardian, who is present for the appointment.
Complaints
If you are unhappy with how we have handled your information, please tell us first — we would rather put it right. Email admin@thetonicclinic.com and we will look into it.
You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk, on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You do not have to come to us first, though we would appreciate the chance.
Changes to this policy
We may update this policy from time to time — if we change how we work, or if the law changes. The current version is always on this page, with the date it was last updated at the top. If we make a change that significantly affects how we use your information, we will tell you directly rather than relying on you noticing.