Privacy Policy
SewHolistics is committed to protecting your privacy and keeping your personal information safe. This Privacy Policy explains how I collect, use, store and protect your personal information when you visit my website, contact me, make an appointment or receive acupuncture treatment from me.
I am committed to complying with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended from time to time.
1. Who is responsible for your personal information?
For the purposes of UK data protection law, I am the data controller responsible for your personal information.
Business name: SewHolistics
Email: stacey@sewholistics.com
Website: www.sewholistics.com
If you have any questions about how your personal information is handled, or wish to exercise any of your data protection rights, please contact me using the email address above.
2. What personal information do I collect?
Depending on how you interact with SewHolistics, I may collect and process the following information:
Contact and identification information
Your name
Date of birth
Address
Telephone number
Email address
Other information you provide to help identify you and communicate with you
Appointment and treatment information
Appointment dates and times
Information relating to your reason for seeking treatment
Symptoms and presenting complaints
Relevant medical and family history
Medication and other relevant health information you provide
Information about your previous and current treatment
Clinical observations and treatment notes
Treatment provided and your progress
Relevant information relating to your consent to treatment
Information you provide when communicating with me about your treatment or appointments
Health information is considered special category data under the UK GDPR and is subject to additional protection.
Payment information
When you make a booking, I may collect information necessary to process your deposit or payment. Payments are processed using third-party payment providers. I do not routinely retain complete card details.
Website and technical information
When you visit my website, certain technical information may be collected automatically, such as your IP address, browser type, device information and information about how you use the website.
I may use services including Google Analytics and Google Ads to understand website usage and the effectiveness of advertising. The use of cookies and similar technologies is explained separately in my Cookie Policy.
Communications
If you contact me by email, telephone or WhatsApp Business, I may retain relevant information from those communications where it is necessary for providing treatment, managing your appointment or maintaining appropriate clinical records.
3. Where do I collect your information from?
Most of the personal information I process is provided directly by you when you:
Make an enquiry
Complete an appointment booking
Complete a consultation or health questionnaire
Attend an appointment
Contact me by email, telephone or WhatsApp
Make a payment
Provide information during or following treatment
I may also receive limited information from third-party services that you use to interact with SewHolistics, such as my online booking system or payment providers.
4. Why do I use your personal information?
I use your personal information where it is necessary to:
Respond to enquiries
Arrange, manage and rearrange appointments
Send appointment confirmations, reminders and other necessary appointment communications
Provide acupuncture and related services safely and appropriately
Understand your health concerns, symptoms and medical history
Make a traditional acupuncture/TCM assessment and formulate an appropriate treatment strategy
Keep accurate clinical records
Monitor your treatment and progress
Communicate with you about your treatment
Process deposits and payments
Deal with complaints, incidents, insurance matters or legal claims
Comply with professional, legal and regulatory obligations
Maintain the security and proper functioning of my website and systems
Understand how visitors use my website and measure the effectiveness of my advertising, where the relevant technologies are permitted to operate
I only collect and use information that is relevant and necessary for these purposes.
5. What is my lawful basis for using your information?
Under UK data protection law, I must have a lawful basis for collecting and using personal information. Depending on the circumstances, I may rely on one or more of the following:
Contract
I may process your personal information where this is necessary to provide the services you have requested, including arranging appointments and providing treatment.
Legitimate interests
I may process information where it is necessary for my legitimate interests as a self-employed healthcare practitioner, provided those interests are not overridden by your rights and interests.
This may include managing my practice, maintaining appropriate records, dealing with enquiries, protecting my business and responding to complaints or legal claims.
Legal obligation
I may process information where this is necessary for me to comply with a legal or regulatory obligation.
Vital interests
In limited circumstances, I may process or disclose information where this is necessary to protect someone's vital interests, for example in an emergency.
Health and special category data
Information concerning your health is special category data and requires an additional condition for processing under Article 9 of the UK GDPR.
Where I process health information as part of providing healthcare or treatment, I rely on the applicable health or social care condition under Article 9(2)(h) of the UK GDPR, together with the relevant provisions of the Data Protection Act 2018.
This allows healthcare professionals to process health information where necessary for the provision of healthcare or treatment, subject to the applicable safeguards and confidentiality requirements.
Your consent to receive acupuncture treatment is separate from the lawful basis used for processing your personal data. The ICO specifically recognises that consent to treatment and UK GDPR consent are not the same thing.
6. Appointment booking and Cliniko
Appointments are booked through my website and are linked to Cliniko, my practice management and booking system.
Cliniko may process information such as your name, contact details, appointment information and other information required to manage your booking and treatment.
Information entered into Cliniko is handled in accordance with its own privacy and security arrangements.
I only provide and use information that is necessary for the management and provision of your appointments and treatment.
7. Communications by WhatsApp
I may communicate with you using WhatsApp Business where you choose to contact me or where this is an appropriate way of communicating about your appointment.
Please be aware that ordinary electronic communications, including email and messaging services, may carry risks when information is transmitted over the internet.
I will take reasonable steps to protect your information and will avoid sharing more personal or clinical information through messaging services than is reasonably necessary.
Where possible, detailed clinical information will be recorded within your clinical records rather than relying on messaging conversations as the primary clinical record.
8. Payments
Deposits may be taken online when you make an appointment.
The remaining balance may be paid at the clinic by card.
Payment information is processed by the relevant payment provider. I do not routinely store complete payment card details.
Payment and transaction records may be retained where necessary for accounting, tax, legal or business purposes.
9. Sharing your personal information
I treat your personal information as confidential.
I will only share your information where there is a lawful and appropriate reason to do so.
This may include sharing information:
With service providers who help me operate my practice, such as my booking system, website provider, payment providers and other essential business service providers
With another healthcare professional where this is necessary for your care and there is an appropriate lawful basis for doing so
With your GP or another healthcare professional where this is necessary and appropriate, including where there is a concern about your safety or health
With my professional body, the Association of Traditional Chinese Medicine (ATCM) where this is required or appropriate in relation to professional standards, complaints or professional matters
With my insurance provider where this is necessary in relation to an incident, complaint or potential claim
With professional advisers, such as legal or accounting advisers, where necessary
Where I am legally required to do so, for example in response to a court order or other lawful request
Where disclosure is necessary to protect someone's vital interests or for safeguarding purposes
I will not sell your personal information to third parties.
10. Clinical records and confidentiality
As an acupuncture practitioner, I maintain appropriate clinical records relating to your treatment.
These records may contain sensitive information about your health and wellbeing. I take confidentiality and the security of these records seriously.
Clinical information will only be accessed, used or disclosed where this is necessary for your treatment, the proper management of my practice, professional or legal obligations, or another lawful purpose.
11. How long do I keep your information?
I will retain your personal information only for as long as it is reasonably necessary for the purposes for which it was collected, taking into account my legal, professional, insurance, accounting and record-keeping obligations.
Clinical records may need to be retained for a longer period than ordinary contact information because of professional, insurance and legal requirements.
When information is no longer required, I will take reasonable steps to securely delete or dispose of it.
Different types of information may therefore be retained for different periods.
12. How do I protect your information?
I take reasonable and appropriate technical and organisational measures to protect your personal information against:
Loss or accidental destruction
Unauthorised access
Unauthorised disclosure
Misuse or alteration
This includes appropriate password protection, secure systems and limiting access to personal information to what is reasonably necessary.
However, no method of transmitting or storing information electronically can be guaranteed to be completely secure.
13. Your data protection rights
Under UK data protection law, you have a number of rights in relation to your personal information, subject to certain legal exemptions.
These may include the right to:
Ask for a copy of the personal information I hold about you
Ask me to correct inaccurate or incomplete information
Ask for your information to be deleted where there is no lawful reason for me to continue holding it
Ask me to restrict how I use your information in certain circumstances
Object to certain types of processing
Request the transfer of certain personal information to you or another organisation where the right to data portability applies
Withdraw consent where I am relying on consent as the lawful basis for a particular processing activity
Some of these rights are not absolute and may not apply in every circumstance. For example, I may need to retain clinical or financial records where there is a legal, professional or legitimate reason to do so.
If you would like to exercise any of your rights, please contact me at:
Email: stacey@sewholistics.com
I may need to ask you for information to verify your identity before responding to a request.
14. Complaints
If you have any concerns about how I have handled your personal information, please contact me in the first instance at:
I will do my best to resolve your concerns.
You also have the right to make a complaint to the Information Commissioner's Office (ICO), which is the UK's independent data protection regulator.
You can contact the ICO through its website:
Information Commissioner's Office (ICO)
15. Cookies and website tracking
My website uses cookies and similar technologies.
Some technologies are necessary for the website to function, while others may be used for analytics, advertising and measuring the effectiveness of my marketing.
Information about the cookies and similar technologies used on my website, including how to manage your preferences, is provided separately in my Cookie Policy.
16. Third-party websites and services
My website may contain links to, or integrations with, third-party websites and services, including services such as Google, Cliniko and other providers used to operate my business.
Once you leave my website or interact directly with a third-party service, that organisation's own privacy policy and terms may apply.
I recommend reviewing the privacy information provided by any third-party service before providing them with personal information.
17. Changes to this Privacy Policy
I may update this Privacy Policy from time to time to reflect changes in legislation, regulatory guidance, technology or the way SewHolistics operates.
The latest version will always be published on this page, with the date of the most recent update shown at the top.
If I make significant changes to the way I use your personal information, I will take appropriate steps to bring those changes to your attention.
Last updated: 20 August 2026