Scalp Photo Sharing: Privacy Checklist

Before sending scalp photographs to a hair clinic or other provider, confirm who is asking, why the images are needed, how they will be transferred, where they will be stored, who can access them and whether any use beyond the stated purpose is optional. Share only through a confirmed channel and keep a copy of the request and consent information.

Treat a scalp photograph as personal information

A close photograph may appear anonymous, but a face, tattoo, distinctive feature, filename, account name, message history or appointment record may connect the image to you. The Office of the Australian Information Commissioner says a photograph involves personal information when a person is reasonably identifiable. An image collected to provide a health service may also be sensitive information.

Cropping a face may reduce obvious identifiers, but it does not automatically make an image anonymous when the file remains linked to your name, account or appointment.

Confirm the request before uploading anything

• Confirm the provider or organisation collecting the image.
• Ask for the purpose of collection and whether the photograph is optional at this stage.
• Verify the exact upload address or secure channel.
• Ask who will have access and where the image will be stored.
• Check whether another service or overseas recipient is involved.
• Ask how long the image will be retained.
• Find out how to raise a question about access, correction or privacy.

Use contact details from the provider's official website or appointment confirmation. Be cautious when a request arrives from a new mobile number, social account, shortened link or unfamiliar email domain. Do not send identity documents, account passwords or an entire photo library to prove the request is yours.

Verify an unexpected message independently

A display name, logo or familiar-looking message thread is not enough to establish who sent a new photo request. Scamwatch describes impersonation using familiar names and branding, and the Australian Cyber Security Centre recommends checking a doubtful message through a contact channel you find independently. This is a general message-safety step, not a judgement about any particular clinic.

• Pause before opening a link or attachment, replying, or sending a photograph.
• Find the clinic's website or previously confirmed appointment details yourself; do not use the phone number or link supplied only in the unexpected message.
• Contact the clinic through that independent channel and ask whether its team sent the specific request, which team should receive a response, and what transfer channel it confirms.
• If the request cannot be confirmed, leave the image unsent and ask for written clarification through the known channel. A warning sign alone does not prove the message is fraudulent.

If you already opened a suspicious link or supplied information, use the Australian Cyber Security Centre's scam guidance for next steps. This checklist does not replace a clinic's own privacy notice or the need to confirm the precise request.

Read the privacy notice and consent wording

The OAIC explains that when a health service provider collects health information, the person should understand why it is collected, how it will be stored and protected, and whether it may be disclosed. A health service provider must also have a privacy policy explaining how it handles health information.

Look for wording that separates different purposes. A photograph kept in a private record is not the same as an image used in a presentation, on a website, in advertising or on social media. If several purposes are combined, ask which are necessary and which are optional before agreeing.

Use a confirmed transfer channel

• Open the link from an official source rather than a forwarded message.
• Check the website address carefully and confirm it uses an encrypted connection.
• Avoid public Wi-Fi where practical.
• Remove unrelated images and documents from the upload selection.
• Sign out when using a shared device.

Ordinary social-media messages and personal messaging accounts can make purpose, access and retention difficult to understand. Ask whether an official patient portal or another confirmed channel is available.

Limit what appears in the frame

Include only the area and context requested. Check the background for mail, screens, identity cards, family photographs, location clues or other people. Keep the original private. If you make a cropped sharing copy, use a neutral filename that does not include your full name, date of birth or account number.

Keep a small sharing record

• What you sent and when you sent it.
• The organisation and confirmed recipient.
• The stated purpose and transfer channel.
• The consent or privacy notice you received.
• Any response or reference number.

This is simply an audit trail that helps you remember where a copy went and which explanation applied. It is not a clinical record or assessment.

Use a final six-question check

• Do I know who is collecting this image?
• Do I understand the specific purpose?
• Have I read the privacy and consent information?
• Is this the provider's confirmed channel?
• Have I removed unrelated identifiers and files?
• Have I kept a record of what I shared?

• Ask about the clinic's contact and secure-sharing process first
• Keep progress photographs consistent and private
• Keep a private hair-loss timeline
• Read the Hair Loss Access privacy policy
• See how our guides are researched and validated

If one answer is unclear, pause the upload and ask the provider to clarify it in writing. Hair Loss Access does not require photographs, medical records or a detailed medical history in its preliminary enquiry form.