Patient Privacy & Clinical Data Policy
Last reviewed: September 4, 2026·Clinical Practice: New York
At Creste Hair Restoration, we hold patient confidentiality and medical privacy to the highest clinical standards. This policy transparently explains how your personal data, medical assessment answers, diagnostic hairline photographs, and browsing parameters are gathered, processed, and strictly guarded.
1. Information We Collect
- Personal Identification: Full name, email address, phone number, and location (city/state) provided when requesting a clinical evaluation or contacting our clinic.
- Clinical Intake Data: Information submitted through our hair analysis questionnaires, including estimated Norwood classification, family hair loss history, prior surgical or non-surgical treatments, allergies, and relevant medical conditions.
- Diagnostic Scalp Photography: High-resolution photographs of your frontal hairline, crown, and donor area submitted for remote trichological evaluation by our clinical team.
- Digital & Browsing Information: IP address, device type, browser specifications, and referral UTM/ad campaign parameters collected in compliance with your explicit cookie preferences.
2. Purpose and Legal Basis for Processing
- Trichological Case Review: To enable our clinical specialists to evaluate follicular density, calculate estimated graft targets, and prepare a written surgical or medical treatment plan.
- Patient Communication: To follow up on your assessment request via phone, email, or encrypted WhatsApp messaging to answer questions and schedule clinical consultations.
- Operational Security: To verify submission legitimacy, prevent spam, and maintain end-to-end security across our diagnostic portals.
- Digital Analytics: To monitor site performance, understand patient navigation journeys, and improve our medical educational content (only when analytics consent is granted).
3. Diagnostic Photo Protection & Strict Non-Disclosure
- Zero Marketing Use Without Written Consent: Your submitted diagnostic scalp photographs are strictly classified as confidential clinical assessment records. We will NEVER publish, share, sell, or utilize your images for marketing, advertising, or public before/after showcases without your prior explicit, separate written authorization.
- Restricted Clinical Access: Access to patient photographs is restricted exclusively to certified physicians, trichology coordinators, and clinical case managers directly assigned to your evaluation.
- Encrypted Storage: Uploaded images are transmitted using TLS 1.3 encryption and stored in encrypted HIPAA-compliant and AES-256 cloud repositories.
5. Patient Rights & Data Erasure
- Right of Access & Portability: You may request a complete copy of any personal and medical intake data stored with our clinic.
- Right to Rectification: You may update or correct any inaccuracies in your contact details or consultation record.
- Right to Immediate Erasure (Right to be Forgotten): If you choose not to proceed with treatment, you may request permanent deletion of your intake record, consultation notes, and uploaded photographs at any time by emailing privacy@crestehair.com.
- Response Timeline: All data subject access requests are verified and processed within thirty (30) calendar days.
6. Data Protection Officer & Inquiries
- Legal Data Controller: CRESTE SOLUTIONS LLC
- Location: New York
- Data Protection Inquiries: privacy@crestehair.com
- WhatsApp Support: +1 (718) 717-5216