Privacy Policy.

1. Who We Are

ScalpLab is a cosmetic scalp-assessment and professional consultation-support platform provided by Japanese Head Spa Co (“ScalpLab”, “we”, “us” or “our”).

Our website address is https://scalplab.ai/.

Contact address:
Camden House
Tunbridge Wells
TN2 3DH
United Kingdom

Email: customerservice@scalplab.ai

2. Scope of This Policy

This Policy applies when you:

• visit or interact with the ScalpLab website;
• create or manage a Single User or Multiple Users account;
• use the ScalpLab iOS or Android application;
• use our dashboards, reports or consultation features;
• purchase or manage a subscription;
• contact Customer Services; or
• have your information entered into ScalpLab by a salon or professional user.

This Policy does not govern an independent salon's use of your information outside ScalpLab. You should also read the privacy information provided by the salon or professional carrying out your consultation.

3. Our Data Protection Roles

Information about account holders, website visitors and purchasers

For account registration, subscriptions, website activity, Customer Service and our own business administration, ScalpLab generally determines why and how personal information is used and acts as a controller under applicable data protection law.

Client data entered by professional users

Where a salon or professional decides to create a client profile, capture images, store consultation notes or generate a report, that salon or professional generally determines the purpose of the processing and acts as the controller. ScalpLab processes the information on its behalf to provide the Platform and generally acts as a processor.

The precise legal role may depend on the particular processing activity and applicable law. Nothing in this Policy removes a professional user's independent obligations under data protection, privacy, professional or consumer law.

4. Information We Collect

Account and business information

• name, email address and telephone number;
• business, salon, branch and trading information;
• job role, team membership and account permissions;
• username, authentication information and account settings; and
• subscription status, plan type and support history.

Technical and usage information

• IP address, device identifier and approximate location derived from IP;
• browser type, operating system, app version and language;
• login records, feature interactions and diagnostic events;
• crash reports, performance data and security logs; and
• cookie, SDK and similar-technology information where permitted.

Communications

We collect information you provide through contact forms, support requests, emails, surveys, feedback and other communications with us.

Information received from third parties

We may receive subscription confirmations, transaction references, authentication data or account status information from Apple, Google, Stripe and other authorised service providers. We do not normally receive complete payment-card details.

5. Client Consultation Information

Professional users may enter or upload information about their clients, including:

• client name and contact details;
• age or date of birth where relevant to the consultation;
• consultation answers and relevant client history;
• scalp and hair observations;
• treatment records and appointment history;
• product, treatment and homecare recommendations;
• notes, progress records and exported reports; and
• consent records or confirmation that consent was obtained.

Professional users should collect only information that is necessary for a lawful and appropriate consultation. They should not enter unrelated medical information or excessive personal details.

6. Scalp Images and Potentially Sensitive Information

ScalpLab may store close-up scalp images, follow-up images, comparisons and information linked to those images. Depending on their content, context and intended use, images or consultation information may reveal or be treated as health-related or other specially protected information.

Where special-category information is processed, the relevant controller must identify both:

• an appropriate lawful basis under Article 6 of the UK GDPR; and
• a valid additional condition under Article 9 where required.

This may require explicit consent in some circumstances, but the correct condition depends on the professional's own service, purpose and legal position. Professional users should obtain independent advice where necessary.

7. How We Use Personal Information

We may use information to:

• create, authenticate and administer accounts;
• provide scalp-consultation, report and progress-tracking features;
• store and retrieve client records on behalf of professional users;
• provide AI-assisted cosmetic observations and recommendations;
• process subscriptions and verify payment status;
• provide Customer Service and respond to enquiries;
• maintain security, prevent fraud and investigate misuse;
• monitor performance, resolve faults and improve usability;
• send essential service and account communications;
• send marketing where permitted and preferences allow;
• comply with legal, regulatory and record-keeping obligations; and
• establish, exercise or defend legal claims.

8. Lawful Bases for Processing

The lawful basis depends on why the information is being used. We may rely on:

For client information processed on behalf of a salon, the salon or professional is responsible for identifying and documenting the applicable lawful basis and any additional condition required for sensitive information.

9. AI Transparency and Automated Processing

Certain ScalpLab features use algorithms, artificial intelligence or machine-learning systems to analyse supplied images and information. These systems may organise visible characteristics, produce cosmetic observations, generate scores or suggest treatments, products, homecare or report wording.

Results may vary according to image quality, lighting, device position, the information provided and the limitations of the relevant technology. Outputs can be incomplete or incorrect.

ScalpLab is designed to support, not replace, meaningful human review. Professional users must assess each output before acting on it or communicating it to a client. We do not intend the Platform to make solely automated decisions that produce legal or similarly significant effects on clients.

Where applicable, individuals may ask for further information about automated processing, contest an outcome or request human review by contacting the relevant salon and, where appropriate, ScalpLab.

10. Cookies, SDKs and Similar Technologies

Our website and apps may use cookies, local storage, software development kits, pixels or similar storage-and-access technologies. These may be used to:

• keep users signed in and remember preferences;
• protect accounts and prevent misuse;
• support essential website and app functions;
• measure performance and diagnose errors; and
• understand usage or support marketing where consent has been obtained.

Strictly necessary technologies may operate without optional consent where permitted by law. Non-essential analytics, advertising or similar technologies will be controlled through the relevant cookie banner, consent tool, app permission or device setting where required.

WordPress may also set temporary, login, preference or administration cookies for authorised website users. Cookie duration depends on the feature and selected preference.

11. Payments and Subscriptions

Subscription payments may be processed by Stripe, Apple App Store, Google Play or another approved payment provider. Those providers process payment information under their own terms and privacy notices.

ScalpLab may receive limited transaction information, such as the payment status, subscription plan, renewal date, currency, transaction identifier and part of the payer's details. We do not normally store complete debit or credit-card numbers.

12. Who We Share Information With

We may share information only where reasonably necessary with:

• cloud-hosting, database, storage and content-delivery providers;
• email, authentication, security and Customer Service providers;
• analytics, crash-reporting and performance-monitoring providers;
• Apple, Google, Stripe and other payment or subscription providers;
• professional advisers, insurers, auditors and accountants;
• a purchaser, investor or successor involved in a legitimate corporate transaction; and
• courts, regulators, law-enforcement bodies or public authorities where required or permitted by law.

Service providers may only use personal information for the contracted purpose and must apply appropriate confidentiality and security protections.

We do not sell personal information.

13. International Data Transfers

Some suppliers or technical infrastructure may be located outside the United Kingdom, meaning personal information may be accessed or processed internationally.

Where required, we use an applicable legal transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or another lawful safeguard. We may also apply supplementary technical and organisational measures where appropriate.

Professional users remain responsible for considering international transfers that they initiate through exports, integrations or external sharing.

14. How Long We Keep Information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including providing the Platform, maintaining records, resolving disputes and meeting legal obligations.

Retention periods may depend on:

• the duration of an account or subscription;
• the salon's instructions and selected retention settings;
• whether information is needed for account recovery, security or dispute resolution;
• applicable tax, accounting, limitation and regulatory requirements; and
• whether deletion is technically possible from active systems or scheduled backups.

When information is no longer required, we will delete, anonymise or securely isolate it in accordance with our retention procedures. Backup copies may remain for a limited period before scheduled deletion.

15. How We Protect Information

We use reasonable and proportionate technical and organisational measures designed to protect personal information. These may include access controls, authentication, encrypted transmission, system monitoring, backups, staff confidentiality controls, supplier assessments and incident-response procedures.

No website, app, transmission or storage system can be guaranteed completely secure. Users are responsible for using strong credentials, protecting devices, managing staff permissions and notifying us promptly of suspected unauthorised access.

Where a personal-data breach occurs, we will assess it and make notifications to affected controllers, individuals or the Information Commissioner's Office where legally required.

16. Your Data Protection Rights

Subject to applicable law and any exemptions, individuals may have the right to:

• be informed about how personal information is used;
• request access to their personal information;
• request correction of inaccurate or incomplete information;
• request deletion in certain circumstances;
• request restriction of processing;
• object to processing based on legitimate interests or direct marketing;
• receive certain information in a portable format;
• withdraw consent where processing relies on consent; and
• raise concerns about qualifying automated decision-making.

Where to send a request

If your information was entered by a salon or therapist, contact that business first because it will normally be responsible for responding as controller. We will assist the business where required.

For information controlled directly by ScalpLab, contact customerservice@scalplab.ai. We may need to verify your identity before completing a request.

Complaints

You may complain to the UK Information Commissioner's Office about the use of your personal information. We would appreciate the opportunity to address your concern first, but this does not affect your right to contact the regulator.

17. Marketing Communications

We may send service communications necessary to operate an account, such as security alerts, subscription notices and important Platform updates.

Promotional emails or messages will be sent only where permitted by applicable law. You can unsubscribe using the link provided in a marketing message or by contacting us. Unsubscribing from marketing will not stop essential account or service messages.

18. Children's Privacy

ScalpLab accounts and professional services are not intended for children under 18. Individuals under 18 must not create a ScalpLab account.

Professional users must not upload information about a child unless they have confirmed that doing so is lawful, appropriate for their professional service and supported by all required parental or guardian permissions and additional safeguards.

19. Comments, Media and Third-Party Content

Comments

If comments are enabled on part of the website, we may collect the information entered into the comment form, together with the IP address and browser user-agent string for moderation and spam prevention. Comments may be checked using an automated spam detection service.

Media uploads

Website users who are permitted to upload publicly accessible media should remove embedded location information, such as EXIF GPS data, before uploading. Visitors may be able to download and extract embedded information from publicly available files.

Embedded content and external links

Pages may contain maps, videos, images or other content embedded from third-party websites. The third party may collect information, use cookies or monitor interaction as though you visited its own service. Its own privacy notice will apply.

20. Changes to This Policy and Contact Details

Changes to this Policy

We may update this Privacy Policy to reflect changes to the Platform, suppliers, legal requirements or our processing activities. The latest version will be published on this page with an updated date. Where appropriate, we will provide additional notice of a material change.

Contact us

Questions, privacy requests or concerns may be sent to:

ScalpLab / Japanese Head Spa Co
Camden House
Tunbridge Wells
TN2 3DH
United Kingdom

Email: customerservice@scalplab.ai