Last updated: 05th October 2016
Catriona Burns Acupuncture is committed to protecting your privacy and handling your personal information responsibly.
This Privacy Policy explains what personal information I collect, why I collect it, how it is used, how long it is kept and the rights you have in relation to it.
Who I am
Catriona Burns Acupuncture provides acupuncture treatments in Belfast.
For the purposes of data-protection law, I, Catriona Burns, am the data controller responsible for your personal information.
If you have any questions about this Privacy Policy or how your information is handled, please contact me at:
Email: cbacupuncture@catrionaburns.com
Practice: Catriona Burns Acupuncture, Belfast
Information I collect
I may collect and process the following information:
- Your name, telephone number, email address and other contact details.
- Information you provide when you contact me through the website, by email, telephone or social media.
- Appointment and booking information.
- Health information, medical history, symptoms, medication, treatment information, consultation forms and clinical treatment notes.
- Payment and invoice information where relevant.
- Website-use information, where collected through essential website functions or cookies.
Health information is treated as confidential and is given additional protection under UK data-protection law.
Why I use your information
I use your personal information to:
- Respond to enquiries and communicate with you.
- Arrange, manage and remind you about appointments.
- Assess whether acupuncture treatment is appropriate and provide safe, individualised treatment.
- Maintain accurate clinical and treatment records.
- Process payments and maintain financial records.
- Meet professional, legal, insurance and regulatory responsibilities.
- Manage and improve the website and services.
I will only collect information that is relevant and necessary for these purposes.
Legal basis for using information
I use your personal information where it is necessary:
- To take steps at your request before entering into a treatment agreement, and to provide the services you request.
- To comply with legal, professional, insurance and accounting obligations.
- For my legitimate interests in running and protecting my practice, responding to enquiries, arranging appointments and keeping appropriate business records, provided your rights and interests do not override those interests.
Where I collect or use health information, I do so because it is necessary for the provision of healthcare or treatment and for the management of health services. I may also ask for your explicit consent where this is appropriate.
You may withdraw consent at any time where consent is the basis on which your information is being used. This will not affect the lawfulness of any processing carried out before consent was withdrawn.
Who I share information with
Your personal information will be treated as confidential and will normally only be accessed by me.
I may share information where required by law, where necessary to protect someone’s vital interests, or in connection with an insurance, legal or regulatory matter.
I do not sell your personal information or share it with third parties for their marketing purposes.
Keeping information secure
I take appropriate steps to protect personal information from loss, misuse, unauthorised access, alteration or disclosure.
This includes using password-protected devices and accounts, restricting access to client information, keeping paper records secure where used, and using suitable systems to store information.
While I take reasonable measures to protect information, no method of electronic storage or transmission is completely secure.
How long I keep information
I keep personal information only for as long as it is needed for the purpose for which it was collected, including to meet legal, professional, accounting and insurance requirements.
Clinical records, consultation forms and treatment notes are kept securely for at least seven years from the date of your last treatment.
Where treatment is provided to a child or young person, records are kept for at least seven years after the client reaches the age of 18.
Enquiries that do not lead to treatment will be kept only for as long as is reasonably necessary to respond to and follow up the enquiry, after which they will be securely deleted.
Financial and payment records will be kept for the period required by applicable tax and accounting requirements.
After the relevant retention period has ended, records will be securely deleted or destroyed, unless I need to retain them for longer because of a legal, insurance, professional or regulatory requirement.
Your rights
Under UK data-protection law, you may have the right to:
- Ask for access to the personal information I hold about you.
- Ask me to correct inaccurate or incomplete information.
- Ask for your information to be deleted in certain circumstances.
- Ask me to restrict how your information is used in certain circumstances.
- Object to processing based on legitimate interests in certain circumstances.
- Ask for a copy of certain information in a portable format where applicable.
- Withdraw consent at any time where I rely on your consent.
Some rights are not absolute. For example, I may need to retain clinical records where this is necessary to meet legal, professional or insurance obligations.
To make a request or raise a concern, please contact me using the details above.
Cookies and website links
This website may use essential cookies to help it function properly. If non-essential cookies, analytics tools or third-party services are used, you will be given information about these and, where required, asked for your consent.
This website may contain links to other websites. I am not responsible for the privacy practices or content of external websites, and you should read their privacy policies before providing them with personal information.
Making a complaint
If you are unhappy with how I handle your personal information, please contact me first so that I can try to resolve the matter.
You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK’s data-protection regulator.
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk
Changes to this policy
I may update this Privacy Policy from time to time. The latest version will always be available on this website, with the date of the most recent update shown at the top of the page.