When you supply your personal details to this clinic they are stored and processed for 4 reasons (for your info, the words in bold are the relevant terms used in the General Data Protection Regulation):

1.    I need to collect personal information about your health in order to provide you with the best possible treatment.  Your requesting treatment and our agreement to provide that care constitutes a contract.  You can, of course, refuse to provide the information, but if you were to do that I would not be able to provide treatment.

2.    I have a ‘legitimate interest’ in collecting that information because, without it, it would not be possible to treat you effectively and safely.

3.    It is also important that I can contact you in order to confirm or change your appointment; this again constitutes ‘legitimate interest’ but this time it is your legitimate interest.

4.    Provided I have your consent, I may occasionally send you health information in the form of advice or articles.  You may withdraw this consent at any time; just let me know by any convenient method.

I have a legal obligation to retain your records for a minimum of 7 years in accordance with the British Acupuncture (BAcC) Code of Practice (or age 25, if this is longer); after this period, you can ask to have your records deleted, in you wish.  Otherwise, I may retain your records indefinitely in case you wish to see me at some future date, in case of any legal claims/complaints or for safeguarding purposes.  Your records are stored on paper and in locked filing cabinets. Some records are also stored electronically; access to this data is password protected with the passwords changed regularly.

I use your presenting complaint and symptoms reported by you for the purposes of making a full traditional diagnosis, formulating treatment strategy and treatment planning. I use any relevant medical and family history you have shared together with my clinical findings about your health and wellbeing to enable me to make a full traditional diagnosis, formulating both treatment strategy and planning.  

I will never share your data with anyone who does not need access without your written consent. Your personal data will be treated as strictly confidential and may be shared:

  • with named third parties with your explicit consent;
  • with the relevant authority such as the police or a court, if necessary, for compliance with a legal obligation to which I am subject, eg, a Court Order;  
  • with your doctor or the police, if necessary, to protect yours or another person’s life;
  • with the police or a local authority for the purpose of safeguarding children or vulnerable adults;
  • with my regulatory body, the BAcC in the event of a complaint or insurance claim being brought against me;
  • my solicitor in the event of any investigation or legal proceedings being brought against me.

To find out when information about you might be shared please see the Information Commissioner’s website at:

In the event of an adverse incident occurring to any patient, I will report the matter to the BAcC to enable their insurance company to deal with any potential claims and to help the BAcC develop its safe practice guidelines, as well as providing research data and information for the BAcC’s insurers and other interested parties.  You have the right to see what personal data of yours I hold and can also ask me to correct any factual errors.  

I want you to be absolutely confident that I am treating your personal data responsibly.  If you feel that I am mishandling your personal data in some way, you have the right to complain.  If you are not satisfied with my response, you have the right to raise the matter with the Information Commissioner’s Office.  Further details about your rights can be accessed via: