Your privacy

Privacy Policy

Last updated: 2 July 2026

Introduction

At Urtica Herbal, I am committed to protecting your privacy and handling your personal information fairly, lawfully and transparently. I am Ellie Rose Grimsdale, a qualified medical herbalist, emergency medical technician and sole practitioner. I provide herbal medicine consultations, personalised herbal prescriptions, dietary and lifestyle advice, and general wellbeing support. I also sell herbal products and other health-related products in person and, in the future, through my website.

This Privacy Policy explains how I collect, use, store and protect your personal information when you:

visit my website;
contact me by telephone, email or through my website;
book an appointment;
purchase products from me;
receive herbal medicine consultations or treatment.

As a healthcare practitioner, I collect and process personal information to provide safe and effective care. Where this includes information about your health, it is treated as special category personal data under the UK General Data Protection Regulation (UK GDPR) and is handled with an additional level of protection.

I will only collect and use your personal information where it is necessary to provide my services, meet my legal and professional obligations, fulfil contracts with you, or where you have given your consent.

Data Controller

The Data Controller responsible for your personal information is:

Ellie Rose Grimsdale
Address: 69 High Street, Berkhamsted, Hertfordshire, HP4 2DE
Email: ellie@urticaherbal.co.uk
Telephone: 07903 590912
Website: www.urticaherbal.co.uk

If you have any questions about this Privacy Policy or how your information is processed, please contact me using the details above.

The information I collect

The information I collect depends on how you interact with my business.

Patients

If you receive herbal medicine consultations or treatment, I may collect:

Full name
Postal address
Email address
Telephone number
Date of birth
Occupation (where relevant)
Emergency contact details (where appropriate)
Medical history
Family medical history
Current symptoms
Lifestyle information
Dietary information
Allergies
Current medications
Supplements
Medical test results or reports that you provide
Consultation notes
Treatment plans
Details of herbal prescriptions supplied
Correspondence relating to your care

This information includes special category personal data, specifically information relating to your physical and mental health. I only collect information that is relevant to providing safe, appropriate and effective treatment.

Customers purchasing products

If you purchase products without becoming a patient, I may collect:

Name
Billing address
Delivery address (where applicable)
Email address
Telephone number
Details of products purchased
Payment confirmation
Correspondence relating to your order

Payment card details are processed securely by my payment provider and are not stored by me.

Website visitors and enquiries

If you visit my website or contact me with an enquiry, I may collect:

Your name
Email address
Telephone number (if provided)
The information you choose to include in your enquiry

If your enquiry does not result in treatment or a purchase, I will only retain your information for as long as reasonably necessary to respond to your enquiry.

How I collect your information

I collect personal information directly from you when you:

complete a consultation form;
attend a consultation;
contact me by telephone or email;
submit an enquiry through my website;
book an appointment;
purchase a product;
correspond with me regarding your treatment or an order.

When you purchase products through my website, I collect the personal information necessary to process your order, take payment, arrange delivery where applicable, communicate with you about your purchase, and comply with my legal and accounting obligations.

I do not buy personal information from third parties.

How I use your information

I use personal information only where it is necessary for legitimate business, healthcare or legal purposes. These purposes include:

responding to enquiries;
arranging appointments;
providing herbal medicine consultations and treatment;
creating personalised treatment plans;
dispensing herbal medicines;
maintaining accurate clinical records;
processing payments;
supplying products that you have ordered;
arranging collection or delivery of products;
responding to questions about products or services;
maintaining business accounts and financial records;
complying with legal, regulatory and professional obligations;
protecting my legal rights where necessary.

I do not sell or rent your personal information to third parties.

Lawful basis for processing

UK GDPR requires me to identify the lawful basis for processing personal information.

General personal information

Depending on the circumstances, I process personal information because:

it is necessary to perform a contract with you, such as providing consultations or supplying products;
it is necessary to comply with legal obligations;
it is necessary for my legitimate interests in running my business, provided these interests do not override your rights;
you have given your consent, where consent is required.

Health information

Information relating to your health is classified as special category personal data. I process this information because it is necessary for the provision of healthcare and treatment by a healthcare professional, together with the relevant conditions under Article 9 of the UK GDPR and Schedule 1 of the Data Protection Act 2018.

Where consent is relied upon, you may withdraw it at any time. However, withdrawing consent will not affect the lawfulness of processing that took place before consent was withdrawn and may affect my ability to continue providing treatment safely.

Sharing your information

Your personal information is treated as confidential. I will only share your information where it is necessary and appropriate to do so. This may include:

your GP or another healthcare professional, with your explicit consent;
your GP or appropriate authorities without consent where I believe there is a serious risk to your health or safety, or that of another person, or where I am legally required to disclose information;
my professional indemnity insurer or legal advisers where necessary;
regulatory or law enforcement authorities where disclosure is required by law;
trusted service providers who process information on my behalf in order to operate my business.

I only use service providers that I believe maintain appropriate standards of security and data protection.

Third-party service providers

In order to provide my services, I use carefully selected third-party providers. These currently include:

Google Calendar

Google Calendar is used to manage appointments and my clinic schedule. Appointment information is only recorded to the extent necessary to organise consultations.

Tyl by NatWest

Payments made by card are securely processed using Tyl by NatWest. I do not store your full payment card details.

Microsoft OneDrive

Patient records and other business information are securely backed up using Microsoft OneDrive. Where personal information is stored electronically, reasonable measures are taken to ensure it remains secure.

Website hosting

My website is hosted by Netlify, who may process limited technical information necessary for the operation and security of the website.

Fathom Analytics

I use Fathom Analytics to understand how my website is used (for example, which pages are viewed). Fathom is a privacy-focused analytics service: it does not use cookies, does not collect or store personal information, and does not track or identify individual visitors. The information it provides is aggregated and anonymous.

Each of these providers has its own privacy policy explaining how personal information is processed.

Website cookies

My website is designed to operate without the use of non-essential cookies. I do not use cookies for advertising, marketing or visitor tracking. The website analytics I use (Fathom Analytics) is cookieless and does not track or identify individual visitors.

Some essential technical functions provided by my website hosting provider may use temporary technologies that are necessary for the secure operation of the website. These do not track your browsing behaviour for marketing purposes.

If I introduce new website features in the future, such as an online shop, embedded content or website analytics that require the use of cookies, this Privacy Policy will be updated and, where required by law, your consent will be obtained before any non-essential cookies are used.

Data security

Protecting the confidentiality of your personal information is extremely important to me, particularly because I provide healthcare services. I take appropriate technical and organisational measures to safeguard the information I hold. These measures include:

password-protected computers and devices;
encrypted storage where appropriate;
secure backup of electronic records using Microsoft OneDrive;
up-to-date antivirus and security software;
regular software and security updates;
strong, unique passwords and multi-factor authentication where available;
restricting access to personal information so that only I can access it;
storing any paper records securely in locked storage when not in use;
securely disposing of confidential documents when they are no longer required.

While I take reasonable steps to protect your information, no method of transmitting information over the internet or storing electronic data can ever be guaranteed to be completely secure.

International transfers

Some of the third-party service providers I use may store or process personal information outside the United Kingdom. Where this happens, I will only use organisations that provide appropriate safeguards for personal information in accordance with UK data protection law, such as the use of approved contractual clauses or transfers to countries that have been recognised as providing an adequate level of data protection.

How long I keep your information

I only keep personal information for as long as it is necessary for the purpose for which it was collected, or where I have a legal or professional obligation to retain it. The retention periods I normally apply are:

Clinical records

Clinical records are retained for seven years after your last consultation, unless a longer retention period is required by law or professional guidance.

Customer orders and financial records

Information relating to product purchases, invoices and financial transactions is retained for six years to comply with UK tax and accounting requirements.

General enquiries

If you contact me with an enquiry but do not become a patient or customer, your correspondence will normally be retained for 24 months after the last communication before being securely deleted, unless there is a legitimate reason to retain it for longer.

Appointment information

Appointment records that do not form part of a clinical record are retained only for as long as reasonably necessary for administrative purposes.

When information is no longer required, it is securely deleted or confidentially destroyed.

Your rights

Under the UK General Data Protection Regulation, you have the right to:

be informed about how your personal information is used;
request access to the personal information I hold about you;
request that inaccurate or incomplete information is corrected;
request the deletion of your personal information where applicable;
request that the processing of your information is restricted;
object to certain types of processing;
request a copy of your personal information in a portable format where applicable;
withdraw your consent at any time where processing is based on your consent.

These rights are not absolute and may be limited where I have legal or professional obligations to retain healthcare records or where other exemptions under data protection law apply.

If you wish to exercise any of these rights, please contact me using the details at the end of this Privacy Policy. I will respond to your request within the timescales required by UK data protection legislation.

Accuracy of information

It is important that the personal information I hold about you is accurate and up to date. Please let me know if your contact details or any other personal information changes so that I can update my records.

Links to other websites

My website may contain links to other websites for your convenience or information. Once you leave my website, I have no control over the content, privacy practices or security of those websites. I encourage you to read the privacy policies of any websites you visit.

Changes to this Privacy Policy

I may update this Privacy Policy from time to time to reflect changes in legislation, professional guidance, technology or the way my business operates. The most recent version will always be published on my website, together with the date it was last updated.

Complaints

If you have any questions or concerns about how I collect, use or protect your personal information, please contact me in the first instance. I will do my best to resolve your concerns promptly and fairly.

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s independent authority responsible for upholding information rights.

Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

Contact

If you have any questions about this Privacy Policy or how your personal information is handled, please contact:

Ellie Rose Grimsdale
69 High Street, Berkhamsted, Hertfordshire, HP4 2DE
ellie@urticaherbal.co.uk
07903 590912