Privacy Policy

Last updated: July 2026

At Halo Studio, your privacy is taken seriously. Due to the nature of our skin, hair loss, wig and treatment services, we may collect and process personal information, including sensitive health and medical information.

This Privacy Policy explains what information we collect, why we collect it, how it is used and stored, who it may be shared with, and your rights under the General Data Protection Regulation (GDPR), the Data Protection Act 2018 and other applicable Irish and European Union data protection law.

1. Who We Are

For the purposes of data protection law, the data controller is:

Business name: Halo Studio
Trading as: Halo Studio / Haló Luxury Lace Wigs
Address: Unit 12 Zone B Mullingar Business Park, Mullingar, Westmeath, N91DE22
Email: info@halostudio.ie
Telephone: 0852502310

If you have any questions about this Privacy Policy or how your personal information is handled, please contact us using the details above.

2. Personal Information We May Collect

Depending on how you interact with us, we may collect the following information:

Personal and Contact Information

This may include:

• Full name

• Date of birth

• Address

• Email address

• Telephone number

• Emergency contact details where relevant

• Appointment and booking information

• Order and purchase history

• Payment and transaction information

• Communication preferences

• Correspondence by email, telephone, text message, social media or other communication channels

Consultation and Treatment Information

Where you attend for a consultation, treatment or related service, we may collect information including:

• Consultation forms

• Treatment consent forms

• Medical history

• Current and previous health conditions

• Allergies and sensitivities

• Current and previous medications

• Pregnancy or breastfeeding information where relevant to treatment safety

• Previous procedures or treatments

• Skin concerns and skin history

• Hair loss history

• Scalp concerns and scalp history

• Relevant family history

• Lifestyle information where relevant to your consultation or treatment

• Contraindications and treatment suitability information

• Treatment plans

• Products used or recommended

• Treatment settings and treatment records

• Patch test information

• Aftercare information

• Treatment outcomes

• Adverse reactions or complications

• Notes made during or following consultations, appointments or treatments

• Other information you voluntarily provide where relevant to the service being requested

Some of this information may constitute health data or other special-category personal data and is treated with additional care.

Wig and Hair Loss Consultation Information

Where you attend for a wig or hair loss consultation, we may collect information including:

• Hair loss history

• Relevant medical conditions

• Relevant medication information

• Information relating to chemotherapy or other medical treatment where voluntarily disclosed and relevant

• Alopecia or other hair loss information

• Scalp condition

• Head measurements

• Wig size and fit information

• Colour, density, length and cap preferences

• Consultation notes

• Wig specifications and order history

• Grant-related information where relevant

• Supporting documentation provided for grant or reimbursement purposes

We will only request information that is reasonably relevant to the service being provided.

3. Before and After Photographs

We may take photographs or videos before, during or after consultations or treatments for purposes such as:

• Recording your baseline condition

• Monitoring treatment progress

• Comparing treatment outcomes

• Supporting continuity of care

• Maintaining an accurate client record

• Assessing skin, scalp, hair loss or treatment response

Where photographs are taken as part of your confidential client or treatment record, they will be treated as personal data and stored securely.

Where a photograph reveals or is directly connected with information about your health, skin condition, hair loss, medical history or treatment, it may also be treated as sensitive health-related information.

Marketing and Social Media Use

We will not use identifiable before and after photographs, videos or other client images for marketing, advertising, website content, social media, educational promotional content or similar public-facing purposes without an appropriate basis and, where required, your specific consent.

Where consent is requested for marketing use of images:

• Consent will be separate from treatment consent

• You may refuse marketing consent without affecting your ability to receive services

• We will explain the intended use of the images

• You may withdraw your consent for future use at any time

Withdrawal of consent will not make previous lawful use automatically unlawful. We will take reasonable steps to stop future use within our control. However, where content has already been published, shared, downloaded, copied or redistributed by third parties, complete removal from the internet may not always be possible.

Where reasonably possible, we may use cropped, de-identified or less identifiable images. However, this does not automatically mean that an image is anonymous if you could still reasonably be identified.

4. Why We Use Your Personal Information

We may process personal information for purposes including:

• Booking and managing appointments

• Providing skin consultations

• Providing hair loss consultations

• Providing wig consultations

• Assessing suitability for treatments or services

• Identifying contraindications

• Providing treatments safely

• Creating personalised treatment or skincare plans

• Monitoring treatment progress

• Maintaining accurate consultation and treatment records

• Providing aftercare and follow-up support

• Responding to enquiries

• Processing orders and payments

• Supplying products and wigs

• Managing custom wig orders

• Processing grant-related administration where applicable

• Managing complaints or disputes

• Meeting insurance requirements

• Maintaining business and financial records

• Complying with legal and regulatory obligations

• Establishing, exercising or defending legal claims

• Protecting the safety of clients and the business

• Sending marketing communications where permitted

• Using photographs or testimonials for marketing where appropriate consent has been obtained

We will not use personal information for purposes that are incompatible with the reason it was originally collected unless permitted or required by law.

5. Our Legal Bases for Processing Personal Information

Under GDPR, we must have a lawful basis for processing personal information.

Depending on the circumstances, we may rely on:

Contract

Where processing is necessary to:

• Provide a service you have booked

• Manage your appointment

• Process an order

• Supply a wig or product

• Take payment

• Communicate with you about a purchase or service

Legal Obligation

Where we are required to process or retain information to comply with legal obligations.

Legitimate Interests

Where processing is reasonably necessary for legitimate business purposes and those interests are not overridden by your rights and freedoms.

This may include:

• Managing and improving our services

• Maintaining appropriate business records

• Preventing fraud or misuse

• Protecting and defending legal claims

• Maintaining the security of our systems and business

Consent

We may rely on your consent in certain circumstances, including where appropriate for:

• Certain marketing communications

• Public use of identifiable before and after photographs

• Testimonials

• Specific optional uses of your personal information

Where we rely on consent, you may withdraw that consent at any time for future processing.

6. Health and Medical Information

Information concerning your health is given additional protection under data protection law.

Because our services include skin consultations, hair loss consultations, scalp assessments, treatment suitability assessments and other services where health information may be relevant, we may need to process health-related information.

Depending on the circumstances and the nature of the service, such information will only be processed where we have both:

• An appropriate lawful basis under Article 6 GDPR; and

• An appropriate condition for processing special-category data under Article 9 GDPR or other applicable law

Where appropriate, this may include your explicit consent.

We aim to collect only health information that is relevant and reasonably necessary for:

• Assessing treatment suitability

• Identifying contraindications

• Reducing risk

• Providing requested services

• Recording treatment history

• Monitoring outcomes

• Responding appropriately to adverse reactions

• Protecting clients and the business

• Establishing, exercising or defending legal claims where necessary

You should provide accurate and up-to-date information where it is relevant to treatment safety. If important medical or medication information changes, you should inform us before receiving further treatment.

7. How Your Information Is Stored and Protected

We take reasonable technical and organisational measures to protect personal information against unauthorised access, accidental loss, misuse, alteration or disclosure.

Client information may be stored electronically.

Our current security measures include:

• Storage on a password-protected laptop

• Additional password protection within the software used to manage client information

• Layered access controls

• Restricted access to client records

• Password protection for systems containing consultation and treatment information

• Reasonable steps to keep software and systems secure and up to date

• Limiting access to personal information to those who genuinely require it

• Secure handling of consultation forms, treatment notes and client photographs

This means that access to the laptop alone does not automatically provide unrestricted access to client records held within separately password-protected software.

Where third-party software or cloud-based services are used, we take reasonable steps to select providers that offer appropriate security and data-protection safeguards.

No electronic storage or transmission system can be guaranteed to be completely secure. However, we take reasonable and proportionate steps to protect the information entrusted to us.

8. Who May Have Access to Your Information

Access to personal information is restricted as far as reasonably possible.

We may share limited personal information with trusted third parties where necessary, including:

• Appointment booking providers

• Website and e-commerce providers

• Payment processors

• Secure client management or consultation software providers

• Email and communications providers

• IT and technical support providers

• Accountants, bookkeepers or professional advisers

• Insurers

• Delivery and courier providers

• Wig suppliers or manufacturers where necessary to fulfil an order

• Grant or reimbursement bodies where relevant and authorised

• Legal advisers

• Regulatory authorities or law enforcement where legally required

We do not sell your personal or medical information.

Where information is shared with a third-party service provider, we aim to limit the information shared to what is reasonably necessary for the relevant purpose.

9. Wig Suppliers and Custom Orders

Where you place a custom wig order, it may be necessary to share limited information with a supplier or manufacturer in order to fulfil your order.

This may include:

• Head measurements

• Cap size

• Wig specifications

• Colour requirements

• Density

• Length

• Construction requirements

• Other customisation instructions

Where possible, we aim not to provide unnecessary medical information to wig suppliers or manufacturers.

If a supplier is located outside the European Economic Area, personal information will only be transferred where an appropriate legal mechanism or safeguard is available under applicable data protection law.

10. International Data Transfers

Some of the third-party services or software providers we use may process information outside Ireland or outside the European Economic Area.

Where personal information is transferred internationally, we will take reasonable steps to ensure that an appropriate lawful transfer mechanism is in place where required, such as:

• An adequacy decision

• Standard Contractual Clauses

• Another legally recognised transfer safeguard

11. How Long We Keep Your Information

We will not keep personal information for longer than reasonably necessary for the purposes for which it was collected, subject to legal, insurance, professional and business requirements.

Different categories of information may be retained for different periods.

When deciding how long to retain information, we may consider:

• The nature of the service or treatment provided

• The sensitivity of the information

• Treatment safety and continuity

• The possibility of delayed complications or queries

• Legal limitation periods

• Insurance requirements

• Tax and accounting obligations

• Complaint or dispute handling

• The need to establish, exercise or defend legal claims

Consultation forms, treatment records, consent forms, relevant health information and treatment photographs may be retained for an appropriate period after your last interaction with us where necessary for legitimate, legal, insurance, safety or record-keeping purposes.

Where information is no longer required, it will be securely deleted, anonymised or otherwise disposed of where reasonably practicable.

12. Children and Young People

Where services are provided to a person under 18, we may collect information about the young person and, where appropriate, their parent or legal guardian.

Depending on the service and circumstances, we may require:

• Parent or guardian details

• Parent or guardian consent

• Relevant medical information

• Consultation records

• Treatment records

We take additional care when handling the personal information of children and young people.

13. Marketing Communications

We may send marketing communications where:

• You have consented to receive them; or

• Another lawful basis permits us to do so

You may unsubscribe from marketing communications at any time by:

• Using the unsubscribe option provided

• Contacting us directly

Opting out of marketing will not prevent us from contacting you where necessary about appointments, orders, treatments, safety information or other service-related matters.

14. Cookies and Website Information

Our website may use cookies and similar technologies to:

• Operate the website

• Remember preferences

• Understand website usage

• Improve performance

• Support analytics

• Support marketing or advertising where consent is required

Where required by law, non-essential cookies will only be used with your consent.

Further information should be provided through our Cookie Policy or cookie consent tool.

15. Your Data Protection Rights

Depending on the circumstances, you may have rights including:

• The right to be informed about how your data is used

• The right to access your personal data

• The right to request correction of inaccurate or incomplete data

• The right to request deletion of personal data in certain circumstances

• The right to restrict processing in certain circumstances

• The right to object to certain processing

• The right to data portability in certain circumstances

• The right to withdraw consent where processing is based on consent

• Rights relating to certain automated decision-making and profiling

These rights are not absolute and may be subject to legal exceptions.

For example, we may be entitled or required to retain certain information despite a deletion request where it remains necessary to comply with a legal obligation, deal with an ongoing matter, or establish, exercise or defend legal claims.

16. Access Requests

You may request a copy of the personal information we hold about you.

To protect confidentiality, we may need to verify your identity before releasing personal information.

We will respond within the timeframe required by applicable data protection law.

17. Data Breaches

If a personal data breach occurs, we will assess the nature and potential risk of the breach and take appropriate action.

Where legally required, this may include notifying the Data Protection Commission and, in certain circumstances, affected individuals.

18. Complaints

If you have concerns about how your personal information has been handled, please contact us first so that we have an opportunity to address the issue.

You also have the right to make a complaint to the Irish Data Protection Commission.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes in our services

• Changes in how we process personal information

• Changes in technology or service providers

• Changes in legal or regulatory requirements

The most recent version will be made available on our website, with the date of the latest update shown at the top of the policy.

20. Contact Us

For questions, requests or concerns relating to privacy or personal information, please contact:

Business: Halo Studio
Email: info@halostudio.ie
Address: Unit 12 Zone B, Mullingar Business Park, Mullingar, Co. Westmeath, Ireland. N91DE22
Telephone: 00353852502310