Privacy Policy

The information I collect

The information I collect depends on how you interact with my business.

Patients

If you receive herbal medicine consultations or treatment, I may collect:

• Full name
• Postal address
• Email address
• Telephone number
• Date of birth
• Occupation (where relevant)
• Emergency contact details (where appropriate)
• Medical history
• Family medical history
• Current symptoms
• Lifestyle information
• Dietary information
• Allergies
• Current medications
• Supplements
• Medical test results or reports that you provide
• Consultation notes
• Treatment plans
• Details of herbal prescriptions supplied
• Correspondence relating to your care

This information includes special category personal data, specifically information relating to your physical and mental health. I only collect information that is relevant to providing safe, appropriate and effective treatment.

Customers purchasing products

If you purchase products without becoming a patient, I may collect:

• Name
• Billing address
• Delivery address (where applicable)
• Email address
• Telephone number
• Details of products purchased
• Payment confirmation
• Correspondence relating to your order

Payment card details are processed securely by my payment provider and are not stored by me.

Website visitors and enquiries

If you visit my website or contact me with an enquiry, I may collect:

• Your name
• Email address
• Telephone number (if provided)
• The information you choose to include in your enquiry

If your enquiry does not result in treatment or a purchase, I will only retain your information for as long as reasonably necessary to respond to your enquiry.

Product reviews

If you leave a review of one of my products on my website, I collect the name you choose to show, your star rating, your review, the product it is about and, if you give them, your email address and order number. With your consent, your name, rating and review are published on that product’s page. Your email address and order number are never published; I use your email address only if I need to contact you about your review, and your order number only to check your order so that your review can be marked as a verified purchase. I read every review before it is published. You can ask me to remove your review at any time.

How I collect your information

I collect personal information directly from you when you:

• complete a consultation form;
• attend a consultation;
• contact me by telephone or email;
• submit an enquiry through my website;
• leave a product review on my website;
• book an appointment;
• purchase a product;
• correspond with me regarding your treatment or an order.

When you purchase products through my website, I collect the personal information necessary to process your order, take payment, arrange delivery where applicable, communicate with you about your purchase, and comply with my legal and accounting obligations.

I do not buy personal information from third parties.

How I use your information

I use personal information only where it is necessary for legitimate business, healthcare or legal purposes. These purposes include:

• responding to enquiries;
• arranging appointments;
• providing herbal medicine consultations and treatment;
• creating personalised treatment plans;
• dispensing herbal medicines;
• maintaining accurate clinical records;
• processing payments;
• supplying products that you have ordered;
• arranging collection or delivery of products;
• responding to questions about products or services;
• maintaining business accounts and financial records;
• complying with legal, regulatory and professional obligations;
• protecting my legal rights where necessary.

I do not sell or rent your personal information to third parties.

Lawful basis for processing

UK GDPR requires me to identify the lawful basis for processing personal information.

General personal information

Depending on the circumstances, I process personal information because:

• it is necessary to perform a contract with you, such as providing consultations or supplying products;
• it is necessary to comply with legal obligations;
• it is necessary for my legitimate interests in running my business, provided these interests do not override your rights;
• you have given your consent, where consent is required.

Health information

Information relating to your health is classified as special category personal data. I process this information because it is necessary for the provision of healthcare and treatment by a healthcare professional, together with the relevant conditions under Article 9 of the UK GDPR and Schedule 1 of the Data Protection Act 2018.

Where consent is relied upon, you may withdraw it at any time. However, withdrawing consent will not affect the lawfulness of processing that took place before consent was withdrawn and may affect my ability to continue providing treatment safely.

Sharing your information

Your personal information is treated as confidential. I will only share your information where it is necessary and appropriate to do so. This may include:

• your GP or another healthcare professional, with your explicit consent;
• your GP or appropriate authorities without consent where I believe there is a serious risk to your health or safety, or that of another person, or where I am legally required to disclose information;
• my professional indemnity insurer or legal advisers where necessary;
• regulatory or law enforcement authorities where disclosure is required by law;
• trusted service providers who process information on my behalf in order to operate my business.

I only use service providers that I believe maintain appropriate standards of security and data protection.

Third-party service providers

In order to provide my services, I use carefully selected third-party providers. These currently include:

Google Calendar

Google Calendar is used to manage appointments and my clinic schedule. Appointment information is only recorded to the extent necessary to organise consultations.

Tyl by NatWest

Payments made by card are securely processed using Tyl by NatWest. I do not store your full payment card details.

Snipcart

My online shop’s basket and checkout are provided by Snipcart. When you place an order through my website, Snipcart processes the information needed to complete it: your name, email address, billing and delivery addresses, and the details of your order. Snipcart also sends the order emails you receive from me, such as your receipt and your dispatch notice.

Square

Card payments made through my online shop are processed by Square. Your card details are sent directly to Square and are entered on a secure payment form; I never see or store your full card number.

Microsoft OneDrive

Patient records and other business information are securely backed up using Microsoft OneDrive. Where personal information is stored electronically, reasonable measures are taken to ensure it remains secure.

Website hosting

My website is hosted by Netlify, who may process limited technical information necessary for the operation and security of the website.

Fathom Analytics

I use Fathom Analytics to understand how my website is used (for example, which pages are viewed). Fathom is a privacy-focused analytics service: it does not use cookies, does not collect or store personal information, and does not track or identify individual visitors. The information it provides is aggregated and anonymous.

Google Analytics and Google Ads

I use Google Analytics to understand how visitors find and use my website, and Google Ads to measure how well my online adverts work. If you accept cookies, Google uses them to record visits and actions such as booking an appointment, sending me a message or completing an order (including the order’s value and the products in it). I do not use this information to show you adverts on other websites. If you do not accept, Google receives only limited information without cookies, as described under “Website cookies” below. Google may process this information outside the United Kingdom, including in the United States.

Each of these providers has its own privacy policy explaining how personal information is processed.

Website cookies

Cookies are small files that a website stores on your device. My website uses the following.

Strictly necessary cookies

These are needed for the website to work, so they do not require your consent.

• uh_consent remembers whether you accepted or rejected Google cookies, so that you are not asked again on every page. It lasts six months.
• snipcart-cart remembers what is in your basket as you move between pages. Without it the basket could not work.

When you go to the checkout, my payment provider may also set cookies that are necessary to process the payment securely and to prevent fraud. Some essential technical functions provided by my website hosting provider may use temporary technologies that are necessary for the secure operation of the website. None of these track your browsing for marketing purposes.

Advertising and analytics cookies (only with your consent)

The first time you visit, my website asks whether you accept Google cookies. If you accept, Google Analytics and Google Ads may set cookies such as _ga and _ga_… (Google Analytics, lasting up to two years) and _gcl_au (Google Ads, lasting up to 90 days). These help me see how visitors find and use my website, including from my online adverts, and whether they go on to book, get in touch or place an order.

If you reject them, or have not yet made a choice, no Google cookies are set. Google still receives limited information without cookies, for example that a page was viewed or an order completed, along with the time and the type of browser and device. Nothing is stored on your device and no cookie identifier is attached. Google uses this only to produce overall, estimated figures.

You can change your choice at any time using the “Cookie settings” link at the foot of every page. If you reject Google cookies after accepting them, the Google cookies already set are deleted.

Fathom Analytics, which I also use, does not use cookies.

Data security

Protecting the confidentiality of your personal information is extremely important to me, particularly because I provide healthcare services. I take appropriate technical and organisational measures to safeguard the information I hold. These measures include:

• password-protected computers and devices;
• encrypted storage where appropriate;
• secure backup of electronic records using Microsoft OneDrive;
• up-to-date antivirus and security software;
• regular software and security updates;
• strong, unique passwords and multi-factor authentication where available;
• restricting access to personal information so that only I can access it;
• storing any paper records securely in locked storage when not in use;
• securely disposing of confidential documents when they are no longer required.

While I take reasonable steps to protect your information, no method of transmitting information over the internet or storing electronic data can ever be guaranteed to be completely secure.

International transfers

Some of the third-party service providers I use may store or process personal information outside the United Kingdom. Where this happens, I will only use organisations that provide appropriate safeguards for personal information in accordance with UK data protection law, such as the use of approved contractual clauses or transfers to countries that have been recognised as providing an adequate level of data protection.

How long I keep your information

I only keep personal information for as long as it is necessary for the purpose for which it was collected, or where I have a legal or professional obligation to retain it. The retention periods I normally apply are:

Clinical records

Clinical records are retained for seven years after your last consultation, unless a longer retention period is required by law or professional guidance.

Customer orders and financial records

Information relating to product purchases, invoices and financial transactions is retained for six years to comply with UK tax and accounting requirements.

General enquiries

If you contact me with an enquiry but do not become a patient or customer, your correspondence will normally be retained for 24 months after the last communication before being securely deleted, unless there is a legitimate reason to retain it for longer.

Appointment information

Appointment records that do not form part of a clinical record are retained only for as long as reasonably necessary for administrative purposes.

When information is no longer required, it is securely deleted or confidentially destroyed.

Your rights

Under the UK General Data Protection Regulation, you have the right to:

• be informed about how your personal information is used;
• request access to the personal information I hold about you;
• request that inaccurate or incomplete information is corrected;
• request the deletion of your personal information where applicable;
• request that the processing of your information is restricted;
• object to certain types of processing;
• request a copy of your personal information in a portable format where applicable;
• withdraw your consent at any time where processing is based on your consent.

These rights are not absolute and may be limited where I have legal or professional obligations to retain healthcare records or where other exemptions under data protection law apply.

If you wish to exercise any of these rights, please contact me using the details at the end of this Privacy Policy. I will respond to your request within the timescales required by UK data protection legislation.

Accuracy of information

It is important that the personal information I hold about you is accurate and up to date. Please let me know if your contact details or any other personal information changes so that I can update my records.

Links to other websites

My website may contain links to other websites for your convenience or information. Once you leave my website, I have no control over the content, privacy practices or security of those websites. I encourage you to read the privacy policies of any websites you visit.

Changes to this Privacy Policy

I may update this Privacy Policy from time to time to reflect changes in legislation, professional guidance, technology or the way my business operates. The most recent version will always be published on my website, together with the date it was last updated.