Updated: 15 October 2026

A. Who We Are

HRBR is a registered business name of Hair Restoration Limited. Our registered office is at Samson House, Sweetman’s Avenue, Blackrock, Co. Dublin, Ireland, A94 R599. For the purposes of applicable data protection law, Hair Restoration Limited is the controller of the personal data described in this Privacy Statement.

Privacy contact: info@hrbr.ie. Telephone: +353 (0) 1 209 1000.

B. Scope of this Privacy Statement

This Privacy Statement explains how HRBR collects, uses, discloses, stores and protects personal data relating to website visitors, people who make enquiries, prospective patients, patients and other individuals who interact with us. It applies to information collected through hrbr.ie, hrbr.co.uk, online enquiry and consultation forms, telephone, email, in person, referrals, and lead forms or advertisements on Facebook and Instagram.

C. Personal Data We Collect

Depending on how you interact with HRBR, we may collect your name, postal address, email address, telephone number, age, date of birth, enquiry and appointment information, correspondence and call notes, financial and transaction information, website and cookie information, photographs, medical history, conditions, medications, treatment information, clinical records, test results, prescriptions and other health information where relevant to care. In some consultations, information discussed during the appointment may also be processed through the Heidi AI medical scribe to assist with preparing clinical notes.

We ask that you do not provide health information through a Facebook or Instagram lead form. Health-related information can be provided securely when a HRBR team member follows up.

D. How We Collect Personal Data

We collect personal data directly from you when you contact us, complete a form, book or attend an appointment, receive treatment, make a payment or communicate with us. In some consultations, a clinician may use the Heidi AI medical scribe to process the conversation and generate a draft clinical note. We may also receive personal data from a person acting on your behalf, a referring healthcare professional, laboratories, cardiologists or other healthcare providers involved in your care, payment providers, and our service providers.

Where you submit a Facebook or Instagram lead form, Meta collects the information entered in the form and makes it available to HRBR. A lead form may request your name, email address, telephone number and age range. The particular form will state the fields required. Meta processes information under its own privacy terms as well as making the lead available to HRBR.

E. Purposes and Legal Bases

We process personal data only where we have a lawful basis. We use personal data to respond to and assess enquiries and consultation requests; contact prospective patients; arrange, confirm and remind patients about appointments; provide service updates and clinical or surgical care; maintain patient records; prepare prescriptions and, where requested and appropriately consented to, referral letters; arrange tests, laboratory analysis and specialist reviews; and use approved documentation tools, including the Heidi AI medical scribe in some consultations, to assist clinicians in preparing clinical notes. We also use personal data to manage accounts and payments, obtain feedback, handle complaints, audit clinical and operational processes, maintain accreditation and standards, protect our systems and premises, comply with legal, regulatory, insurance and professional obligations, and prepare appropriately protected reports and management information.

F. Use of Heidi AI Medical Scribe

HRBR may use Heidi AI medical scribe in some consultations to generate a draft clinical note. The clinician reviews and approves the note and remains responsible for all clinical decisions. Patients will be informed and may ask for Heidi not to be used without affecting their care.

G. Enquiries, Lead Forms and Follow-Up

When you submit an enquiry, including through a Facebook or Instagram lead form, HRBR uses the details provided to respond to and follow up that enquiry. The form may include a statement such as: “I consent to my submitted data being processed so that HRBR can contact me about this enquiry.”

Campaign, market and source identifiers may be associated with a lead so that HRBR can identify the advertisement or campaign from which the enquiry arose and measure campaign performance.

H. Disclosure and Service Providers

HRBR may disclose personal data only where necessary to healthcare professionals and providers involved in care, including laboratories and cardiologists, and to service providers supporting our operations, including Heidi Health as the provider of the Heidi AI medical scribe, payment providers, hosting, website, communications, email, analytics and advertising providers, professional advisers, insurers, auditors and accreditation bodies, and public authorities or regulators where required by law.

Our agents, contractors and service providers may use personal data only for the agreed services and are required to protect it under appropriate contractual, confidentiality and security obligations. HRBR does not sell personal data.

I. Meta Platforms

Meta Platforms Ireland Limited and its related entities process information when you use Facebook or Instagram and when you submit a lead form. Meta’s processing is governed by Meta’s own privacy policy. HRBR is responsible for its own use of the information after it is received. Meta states that lead data is available for download from its platform for a limited period, currently up to 90 days. HRBR may download or securely transfer a lead to its systems before that platform period ends. Meta’s privacy policy is available at https://www.facebook.com/privacy/policy/.

J. Retention

HRBR keeps personal data only for as long as necessary for the purposes for which it was collected and to meet legal, professional, insurance, regulatory and operational requirements. We apply retention periods by record category and review them periodically.

Where a person has not become a patient and HRBR has had no further contact with that person for 36 months, HRBR will normally delete the enquiry and contact details, unless a shorter period is appropriate or continued retention is required or justified.

Patient medical records are retained in accordance with applicable legal and professional requirements. The right to erasure does not apply where continued retention is necessary for reasons permitted by Article 17(3) GDPR.

K. Security

HRBR uses appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. Access is limited according to role and need. Security measures are reviewed regularly, but no method of transmission or storage can be guaranteed to be completely secure.

L. Your Data Protection Rights

Subject to applicable law, you may have the right to obtain confirmation that HRBR processes your personal data and access a copy, correct inaccurate or incomplete information, request erasure, restrict processing, object to processing based on legitimate interests and object at any time to direct marketing and withdraw consent at any time where possible and where processing is based on consent.

These rights are not absolute. HRBR may need to retain or continue processing information where permitted or required by law, including in relation to medical records, legal claims and regulatory obligations. To exercise a right, contact info@hrbr.ie. HRBR may request information needed to verify identity before responding.

M. Cookies and Similar Technologies

HRBR uses cookies and similar technologies as described in its Cookie Statement and cookie controls. This may include essential cookies and, where permitted by your choices, analytics and advertising technologies such as the Meta Pixel. Non-essential cookies will not be used unless the required consent has been obtained. You can review or change available choices through the website’s cookie controls.

N. Accuracy and Data Minimisation

Please tell HRBR if your personal data changes or is inaccurate. HRBR seeks to keep personal data accurate, complete and up to date and to collect only data that is adequate, relevant and limited to what is necessary. Please do not provide information that HRBR has not requested.

O. Complaints

If you have a concern about HRBR’s processing of personal data, contact info@hrbr.ie first so that we can try to resolve it. You also have the right to complain to the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland, at www.dataprotection.ie. If you are in another EEA country, you may also contact your local supervisory authority.

P. Changes to this Statement

HRBR may update this Privacy Statement to reflect changes in its services, technology, legal obligations or processing. The latest version will be published on the website with an updated review date.