Privacy Policy
Amber Wyles Acupuncture
www.amberwylesacupuncture.co.uk
Last updated: April 2026
1. Who we are
Amber Wyles Acupuncture is run by Amber Wyles, a qualified acupuncturist. I am the “data controller” for the personal information described in this policy, which means I decide how and why it is used. I comply with the UK GDPR and the Data Protection Act 2018.
Contact: [amber@amberwylesacupuncture.co.uk] | [+44 (0) 7702 834 363 | [Manor Farm, Wiltshire, BA15 2QF]
2. What information I collect
From patients:
• Contact details (name, address, phone number, email, date of birth)
• Health information: medical history, current conditions, medication, lifestyle information, treatment notes and progress
• Your GP’s details, if you choose to provide them
• Your signed consent form
• Appointment and payment records, including missed or late-cancelled appointments
From website visitors:
• Anything you send through a contact or booking form or by email
Health information is “special category data” under UK GDPR and is treated with extra care.
3. How and why I use your information
I use your information only to:
• Assess, plan and deliver your treatment safely
• Keep accurate clinical records
• Contact you about your appointments, including reminders, changes and follow-up
• Manage bookings, payments and cancellations
• Meet my legal and professional obligations
• Respond to your enquiries
I do not use your information for marketing by third parties, and I never sell it.
4. Legal basis for using your information
• Contract and legitimate interests: I need your details to provide your treatment and to contact you about it. I have a legitimate interest in doing so, and in keeping records and managing my practice.
• Health data: I process this because it is necessary for providing health care, and because you give your explicit consent when you sign the consent form on arrival.
• Legal obligation: where the law requires me to keep records or share information.
You can withdraw your consent at any time (see section 9). Withdrawing does not affect anything done before you withdrew.
5. Confidentiality and sharing your information
Everything you tell me is held in strict professional confidence. I will only share it in these situations:
• Your GP: with your consent, I may share relevant information with your GP.
• Welfare concerns: if I believe your welfare, or someone else’s, is at serious risk, I may contact your GP or another appropriate authority without your consent.
• Referral: if I believe your condition needs referral, I may need to share relevant details with the professional I refer you to (with your agreement where possible).
• Legal requirements: if required by law, a court or a regulator.
• Service providers: [e.g. secure practice-management software, email or payment providers], who process data only on my instructions and under appropriate safeguards.
• Research or case studies: if your case is ever used for research or teaching, all personal identifiers are removed first.
6. How I keep your information safe
Patient records are stored only digitally and securely, using password protection. Only I have access to your records. Information is not kept on paper, and I do not use it for anything beyond the purposes in this policy.
7. How long I keep your information
I keep clinical records for seven years after your last treatment, or until age 25 for children, whichever is longer. After that, they are securely deleted. Financial records are kept as required by tax law.
8. Website, cookies and third parties
I do not use cookies on the website and will not use your information for marketing purposes with third party organisations
9. Your rights
Under UK GDPR you have the right to:
• Be informed about how your data is used
• Access a copy of your data
• Have inaccurate data corrected
• Have your data erased, where the law allows (some clinical records must be kept for the retention period)
• Restrict or object to certain uses of your data
• Data portability, in some circumstances
• Withdraw your consent at any time
To exercise any of these rights, contact me using the details above. I will respond within one month.
10. Missed and late-cancelled appointments
If you miss an appointment or cancel within 24 hours, you are expected to pay the appointment fee. I keep a record of this for booking and payment purposes.
11. Complaints
If you are unhappy with how I have handled your data, please contact me first. You also have the right to complain to the Information Commissioner’s Office (ICO): www.ico.org.uk, 0303 123 1113.
12. Changes to this policy
I may update this policy from time to time. The latest version will always be on this website, with the date at the top.