Privacy Policy
This policy explains how BlueMagic Group Clinic ("we", "us"), acting as data controller, collects and uses personal data through this website. We have written it in plain language because a privacy policy you cannot understand protects no one. Last updated: 17 July 2026.
What we collect
When you submit a consultation or assessment form, we collect the details you provide: your name, phone number, email address, country, your hair or treatment concern, your preferred timing, and any free-text information you choose to share about your health history. If you upload photographs of your scalp, hair or treatment area, those photographs are health data, a special category of personal data under European data protection law, and we process them only with your explicit consent, which the form asks for before submission.
We also collect limited technical data (such as pages visited and approximate region) through cookies and similar technologies, but only according to the choices you make in our consent banner. See the cookie policy for details.
Why we use your data
- To carry out the preliminary medical review you requested and respond with a personal treatment plan and quote.
- To communicate with you about your enquiry, booking, treatment and aftercare, by email, phone or WhatsApp, according to your stated preference.
- To send marketing communications, only if you have separately and explicitly opted in, and only until you withdraw that consent.
- To meet legal and medical record-keeping obligations where treatment takes place.
- To improve this website, based only on analytics you have consented to.
Legal bases
We rely on your explicit consent for processing health data (including photos) and for marketing; on steps taken at your request prior to entering a contract for handling your enquiry and quote; on the contract itself once you book; and on legitimate interests for basic site security and fraud prevention.
Who sees your data
Your enquiry and photos are accessed by the BlueMagic Group Clinic medical and coordination teams who need them to review your case. We use carefully selected service providers (such as secure hosting and communication platforms) under data processing agreements. We never sell your personal data, and we never publish patient photographs without separate, documented consent.
How long we keep it
Enquiry data that does not lead to treatment is retained for up to 24 months from last contact, then deleted or anonymised. If you become a patient, medical records are retained for the periods required by applicable healthcare law. Marketing data is kept until you withdraw consent. You can request earlier deletion at any time, subject to legal retention duties.
Your rights
- Access: ask for a copy of the personal data we hold about you.
- Rectification: have inaccurate data corrected.
- Erasure: ask us to delete your data ("right to be forgotten"), subject to legal retention duties.
- Restriction and objection: limit or object to certain processing.
- Portability: receive your data in a structured, machine-readable format.
- Withdrawal: withdraw any consent at any time, without affecting prior lawful processing.
- Complaint: lodge a complaint with your local data protection authority.
Contact
To exercise any right or ask a privacy question, email enquiries@bluemagiclinic.com with the subject line "Privacy request", or write to BlueMagic Group Clinic, 3 Kullat, Kulla Nr.1, Rruga Dervish Hima, Tirana 1001, Albania. We respond to rights requests within one month.