1. Data Controller Information

Han Acuherbs is the data controller for your personal data.

Address: 19B Leicester Road, Blaby, Leicester, LE8 4GR.

Email: hanacuherbs@gmail.com

Telephone: 0116 278 9888

2. Data Categories and Lawful Basis

We process the following data to provide safe clinical care:

Clinical and Health Data: Includes medical history, medications, allergies, symptoms, and treatment progress. We process this under UK GDPR Article 9(2)(h) (provision of health or social care) and Article 6(1)(b) (performance of a contract).

Contact and Booking Data: Includes name, address, email, and phone number for appointment management. We also collect date of birth to verify patient age and satisfy safeguarding obligations under Article 6(1)(c).

Marketing Data: Includes contact details used for health news and clinic offers. This is processed solely via your explicit consent under Article 6(1)(a). Consent may be withdrawn at any time.

Technical Data: Includes IP addresses and browser types collected for website security and analytics under our legitimate interests (Article 6(1)(f)).

3. Communication Security Disclaimer

Standard digital communications, including non-enterprise email (Gmail) and messaging apps (WhatsApp), are not inherently secure for transmitting sensitive medical data. By choosing to share health symptoms or history via these channels prior to your consultation, you acknowledge and accept these security risks. We recommend reserving detailed clinical disclosures for your face-to-face TCM assessment.

4. Cookies and Tracking

Our website uses strictly necessary cookies to function. Optional analytics cookies require your explicit consent via our cookie banner. You may decline these without affecting website accessibility.

5. Data Sharing and Third Parties

We do not sell your data. We only share information with:

Professional Bodies: Such as the ATCM or indemnity insurers in the event of a clinical claim.

Infrastructure Providers: Our website is hosted by Hostinger; their privacy policy applies to data processed on their servers.

Legal Authorities: Only where required by a court order or safeguarding mandate.

We do not share clinical data with third parties for marketing purposes.

6. Data Retention Periods

In accordance with UK clinical standards and insurance requirements:

Adult Clinical Records: Retained for 7 years from the date of last treatment.

Minor Clinical Records: Retained until the patient's 25th birthday (or 7 years after the last treatment if later).

Booking Records: Retained for 2 years from last contact for administrative purposes.

Marketing Records: Retained until consent is withdrawn, plus 1 year for accountability.

After these periods, data is securely destroyed or anonymised.

7. Data Security Measures

We protect your data through password-protected clinical storage, restricted practitioner-only access, and physical security at our Blaby clinic. While we take all reasonable steps, no internet transmission is 100% secure.

8. Your Legal Rights

Under the UK GDPR, you have the right to access your data, request rectification of inaccuracies, and request erasure (subject to our legal retention obligations for medical records). You also have the right to restrict processing, object to legitimate interest processing, and request data portability. We will respond to all requests within one calendar month.

9. Complaints

If you have concerns regarding your data, please contact us directly at hanacuherbs@gmail.com. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk