Privacy policy

AcuZen London ("we", "us") is an acupuncture and traditional Chinese medicine clinic based at London, UK. We are the data controller for the personal information described in this policy. You can reach us at hello@acuzenlondon.co.uk or 020 0000 0000.

• Contact details — your name, email address, phone number, postal address and emergency contact.
• Health information — your medical history, symptoms, medication, allergies, pregnancy status, treatment notes and consent records collected through our new patient form and during appointments. This is "special category" data under UK GDPR.
• Appointment and billing records — bookings, attendance, treatment packages, invoices and payment status. We do not store card details.
• Enquiries and messages — anything you send us via the contact form, the online booking assistant, email, phone or SMS.
• Website and device data — pages viewed, referring source and similar analytics data collected via cookies and tags (see below).

• To provide safe, appropriate treatment and keep clinical records — legal basis: contract, and Article 9(2)(h) UK GDPR (health care provided by professionals under a duty of confidentiality).
• To manage appointments, reminders, invoices and payments — legal basis: contract and our legitimate interest in running the clinic.
• To reply to enquiries and requests — legal basis: legitimate interest.
• To send marketing or review requests — legal basis: your consent, which you can withdraw at any time.
• To meet legal, insurance and professional obligations — legal basis: legal obligation.

We never sell your data. We share it only where necessary with: our practitioners and clinic staff; our secure booking, records, messaging and analytics providers acting as processors on our behalf; your GP or another healthcare professional where you ask us to or where there is a serious risk to someone's safety; and regulators, insurers or legal advisers where the law requires. Some providers may process data outside the UK, in which case we rely on UK-approved safeguards such as the International Data Transfer Addendum.

Adult clinical records are retained for at least 8 years after your last appointment, and records for patients under 18 until their 25th birthday, in line with professional and insurance requirements. Enquiries that don't become appointments are deleted within 24 months. Accounting records are kept for 6 years. Clinical records are archived rather than deleted, so we can meet these obligations.

Patient records are held in an access-controlled system. Only authorised clinic staff can sign in, access is role-based, every change is written to an audit log, inactive sessions time out automatically, and data is encrypted in transit and at rest.

We use Google Tag Manager, Google Analytics and Google Ads tags to understand how the website is used and to measure the performance of our advertising. These set cookies on your device. You can block or delete cookies in your browser settings; essential cookies that make the site and booking work cannot be switched off.

Under UK GDPR you can ask us to give you a copy of your data, correct it, delete it (where we are not legally required to keep it), restrict or object to how we use it, transfer it to another provider, or withdraw consent you previously gave. Contact us at hello@acuzenlondon.co.uk and we will respond within one month. If you're unhappy with our response you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

We treat patients under 18 only with the consent of a parent or guardian, who must complete the new patient form on their behalf and may be asked to attend the appointment.

We may update this policy from time to time. The current version is always published on this page. Questions? Please get in touch.