Privacy Policy

Published: May 2018

Updated: March 2026

Purpose of This Privacy Policy

The processing of personal data is governed by the General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This legislation gives you rights as an individual and places obligations on organisations that hold your personal data.

One of those rights is the right to be informed, which means we must provide clear information about the way in which we use, share and store your personal data. This policy sets out how we do that.

Who Are We?

Positive Acupuncture is the data controller – Paul Adkins T/A Positive Acupuncture, Room 2, Highgrove House, Truro Business Park, Threemilestone, Truro, Cornwall. TR4 9NH. Tel: 01726 883187.

Positive Acupuncture is registered with the Information Commissioner’s Office. ICO Registration Number: ZB396482

This means we decide how your personal data is processed and for what purposes. The practitioners who treat you at Positive Acupuncture are self-employed and operate under our data governance framework. All patient records remain the responsibility of Positive Acupuncture as the data controller.

Who Does This Privacy Notice Apply To?

This privacy notice applies to the information we collect from:

patients
prospective patients
former patients
people who subscribe to our newsletters
visitors to our website

What Is Personal Data?

Personal data relates to a living individual who can be identified from that data, either alone or in conjunction with other information held by the data controller.

Examples of personal data we may hold about you include your contact details and appointment history.

Special category data is a sub-category of personal data that includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning a person’s sex life or sexual orientation. Your patient notes are an example of special category data.

How Do We Process Your Personal Data?

We comply with our obligations under UK GDPR by keeping personal data up to date, storing and destroying it securely, not collecting or retaining excessive amounts of data, protecting it from loss, misuse, unauthorised access and disclosure, and ensuring appropriate technical measures are in place.

Storage

While you are an active patient, your records (as described in sections 1–15 below, unless otherwise indicated) are stored in your individual paper patient notes held in a locked filing cabinet on the Positive Acupuncture premises. The building is alarmed outside of working hours.

You may also complete an online intake form via Jane, our practice management software. Data entered via Jane is held securely and transferred using 256-bit encryption. All data is stored on servers in London, England. For further details on how Jane processes data, please see Jane’s privacy notice.

Once you are no longer an active patient, your notes are transferred to a locked filing cabinet in the data controller’s secure home office, where they are retained for a minimum of 7 years from your most recent appointment, or until age 25 for patients who were minors at the time of treatment, in accordance with the requirements of our practitioners’ regulatory bodies and insurers.

How We Use Your Information – Patients, Prospective Patients and Clinic Visitors

The following sections (1–16) describe how and why we use the personal data you provide to us.

We use your name, address, telephone number and email address to make and manage appointments. Please be aware that we are unable to send or receive encrypted emails, so any emails we send or receive may not be protected in transit. We monitor emails sent to us, including attachments, for viruses or malicious software.
We use your name, address, telephone number and email address for marketing purposes only where we have your explicit consent. The same email encryption limitations described above apply.
Some patients and prospective patients share medical information with us by email or online enquiry. The same email encryption limitations described above apply.
We maintain a permanent attendance register recording all appointments for tax purposes and to preserve evidence in the event of a legal claim, insurance claim or complaint. This register is held securely within Jane. Paper diaries are kept in a lockable filing cabinet.
We may use your date of birth to distinguish between patients with the same name, to avoid errors in treatment, and for identification purposes when referring you to or corresponding with another health practitioner.
We use your presenting complaint and reported symptoms to make a full traditional diagnosis and formulate a treatment plan.
We use any relevant medical and family history you provide to make a full traditional diagnosis and formulate a treatment plan.
We hold your GP’s name and address in order to contact your GP where clinically appropriate and with your consent, and because it is a requirement of our practitioners’ insurers.
We use our clinical findings about your health and wellbeing to make a full traditional diagnosis and formulate a treatment plan.
We keep a record of all treatments provided and the progress of your case, including reviews of treatment planning, to enable us to review your diagnosis and treatment strategy, and to preserve evidence in the event of legal proceedings, an insurance claim or complaint.
We record any information and advice given, including when referring you to another health professional, to help you receive the most appropriate treatment and to preserve evidence in the event of legal proceedings, an insurance claim or complaint.
We record decisions made in conjunction with you to help ensure you receive appropriate treatment and to preserve evidence in the event of legal proceedings, an insurance claim or complaint.
We keep accident records for patients, visitors or staff involved in accidents at our clinic in accordance with UK Health and Safety legislation including RIDDOR. This record is also stored using Dropbox. Dropbox transfers data to the US, and such transfers are covered by the UK-US Data Bridge. For further information, please see Dropbox’s privacy notice.
In the event of an adverse incident, we report the matter to the relevant practitioner’s insurance company. This record is also stored using Dropbox, subject to the same UK-US Data Bridge provisions described above.
We maintain records of your consent to treatment in order to evidence informed consent in the event of a civil claim, criminal prosecution, insurance claim or complaint.
We may display testimonials from satisfied patients on our website and in print, with your explicit consent, including your name and location. If you wish to update or delete your testimonial, please contact us at enquiries@positiveacupuncture.co.uk.

Complaints About Our Services

When we receive a complaint, we create a file containing the details of the complaint, which will normally include the identity of the complainant and any individuals involved.

We use this information solely to process the complaint and to monitor the level of service we provide. We will usually need to disclose the complainant’s identity to the person the complaint concerns. Where a complainant requests anonymity, we will endeavour to respect this, although it may not always be possible to handle a complaint on an anonymous basis.

We may need to share complaint information with a practitioner’s regulatory body or their insurance company. Complaint records are retained for two years from closure, held securely with access restricted on a need-to-know basis.

Similarly, information submitted via enquiry forms will be used only to respond to the enquiry and to monitor our service levels.

Newsletter Subscribers

We maintain records of newsletter subscribers only with their explicit consent, for marketing purposes. We use Mailerlite to deliver our e-newsletters and gather standard statistics such as open rates and click rates to monitor and improve our communications. Subscribers may unsubscribe at any time via the link in any email footer. For further information, please see Mailerlite’s privacy notice.

Website Users

When someone visits our website, we use Google Analytics to collect standard internet log information and visitor behaviour data in order to understand how the site is used. This information is processed in a way that does not identify individuals. Please see our cookie policy for full details.

We use website cookies to improve the user experience, enabling our website to remember users either for the duration of their visit (session cookies) or for repeat visits (persistent cookies). Please see our cookie policy for full details.

We use Limit Login Attempts to maintain the security and performance of our website. This service processes the IP addresses of visitors.

Our website is hosted on Siteground.co.uk, run by Siteground Hosting Ltd, using WordPress.org. We use Google Analytics to collect anonymous usage data to monitor and improve the site.

Visitors who post comments on our website are required to provide a name and email address. This information is stored in the website database along with an IP address and timestamp, and is used for identification purposes only. Only your name will appear alongside your comment. Please do not include personal identifying information in comments.

To request removal of a comment, please contact us with the email address used to submit it.

Contact forms and email links do not store data on our website; data is transmitted via SMTP. The same email encryption limitations described in section 1 apply.

For information on how Siteground processes data, please see Siteground’s privacy information.

For information on how WordPress processes data, please see WordPress’s privacy notice.

Payments

Payments for treatment are taken independently by each practitioner using their own payment processing provider. Depending on your practitioner, payments may be processed via Square or SumUp. For information on how your payment data is handled, please refer to the privacy notice of the relevant provider: squareup.com or sumup.com. Payment records are retained for 18 months in line with the relevant provider’s terms for legal claims

Sharing Your Personal Data

Your personal data is treated as strictly confidential. We will only share it in the following circumstances:

with named third parties with your explicit consent;
with a relevant authority such as the police or a court, where required by law, for example pursuant to a court order;
with your GP or the emergency services where necessary to protect your life or the life of another person;
with the police or a local authority for the purpose of safeguarding children or vulnerable adults;
with the relevant practitioner’s regulatory body or their insurance company in the event of a complaint or insurance claim; or
with our solicitor in the event of any investigation or legal proceedings.

For further information about when personal data may be shared, please see the Information Commissioner’s website at ico.org.uk.

How Long Do We Keep Your Personal Data?

We keep your personal data for no longer than is reasonably necessary:

Patient records are retained for a minimum of 7 years from your last treatment, or until age 25 for patients who were minors at the time of treatment, in accordance with our practitioners’ insurers’ requirements.
Payment records are retained for 18 months in line with Square’s / SumUp’s terms for legal claims.
A permanent attendance and payment register is maintained for a minimum of 6 years in line with HMRC regulations.
Google Analytics data is automatically deleted after 26 months.
Complaint records are retained for 2 years from closure.

You may request that your contact details are updated at any time.

Your Rights and Your Personal Data

Unless subject to an exemption under UK GDPR, you have the following rights in relation to your personal data:

The right to request a copy of the personal data we hold about you.
The right to request that we correct any inaccurate or out-of-date personal data.
The right to request erasure of your personal data where it is no longer necessary for us to retain it.
The right to withdraw your consent to processing at any time, where processing is based on consent. Please note that this right does not apply where we are processing your data on a different lawful basis, such as a legal obligation – for example, our obligation to retain patient records for a minimum of 7 years.
The right to data portability, where applicable (this applies where processing is based on consent or contract and is carried out by automated means).
The right to request a restriction on further processing where there is a dispute about the accuracy or processing of your data.
The right to object to processing, where applicable (this applies where processing is based on legitimate interests, direct marketing, or scientific/historical research).
The right to be informed in the event of a data breach. We will also notify the Information Commissioner’s Office in accordance with UK GDPR timescales.
The right to lodge a complaint with the Information Commissioner’s Office.

For further information about your rights, please see the Information Commissioner’s website at ico.org.uk.

Further Processing

If we wish to use your personal data for a new purpose not covered by this Privacy Policy, we will provide you with a new notice explaining the new use before commencing processing, and will seek your prior consent where required.

Contact Details

To exercise any of your rights, or to raise a query or complaint, please contact us in the first instance at:

Paul Adkins T/A Positive Acupuncture Room 2, Highgrove House, Truro Business Park, Threemilestone, Truro, Cornwall. TR4 9NH

Tel: 01726 883187 | Email: enquiries@positiveacupuncture.co.uk

Changes to This Privacy Policy

Any changes to this Privacy Policy will be published on this page and, where appropriate, notified to you by email. Please check back periodically to see any updates.

Paul Adkins T/A Positive Acupuncture is registered as a data controller. This policy is reviewed periodically and updated in accordance with current UK data protection legislation.