Privacy Policy

At Ki Acupuncture, we are committed to protecting your personal information and privacy in compliance with the UK General Data Protection Regulation (GDPR) and Data Protection Act 2018. This policy outlines how we collect, use, and protect your data.

Information We Collect
We collect and process the following types of personal data:

Personal Information: Name, contact details (address, phone number, and email), date of birth, gender, and occupation.
Emergency Contact Details: Name, relationship, and phone number.
Medical Information: Health history, treatment records, prescriptions, and details of your GP and surgery, if relevant.
Payment Information: For billing and invoicing purposes.

How We Collect Your Data

Directly from you: Through consultation forms, verbal communications, or when you contact us via phone, email, or the website contact form.
We only collect data that is necessary for providing safe and effective treatments. This includes any relevant cautions or contraindications to treatment, and details you provide regarding your symptoms or diagnoses from other healthcare professionals.

How We Use Your Data
Your personal and medical information is used to:

Provide safe and effective acupuncture treatments.
Maintain accurate clinical records.
Communicate regarding appointments and relevant information.
Process payments and issue invoices.

How We Store Your Data

Paper records: Securely stored in a locked environment with restricted access.
Digital records: Stored in WriteUpp, an ISO27001-certified, cloud-based clinical management software, which uses two-factor authentication and encrypted data replication to ensure security.

Sharing Your Data
We do not share your personal data with third parties unless required by law or with your explicit consent (e.g., referral to another healthcare provider).
Exceptions:

If there is a serious or imminent danger to yourself or others.
If you have a Notifiable Infectious Disease and have not informed your GP, we may be legally obliged to take action.
In the event of an adverse incident, we report it to the British Acupuncture Council (BAcC) and our insurance company for safety and research purposes.

Retention of Data
We retain your data for as long as necessary, including for legal and regulatory purposes:

Medical records: Kept for a minimum of 8 years after your last treatment.
For minors: Records are kept until the age of 25 or 8 years after turning 18, whichever is longer.
Financial records: Kept for 6 years to comply with tax obligations.
Accident records are retained as required by UK Health & Safety law (RIDDOR).
After the retention period, data is securely destroyed or anonymised.

Communications

We are unable to send or receive encrypted emails, so email communications may not be fully secure in transit.
We do not include sensitive medical information in emails.
Emails and attachments are monitored for viruses and malicious software.

Your Rights
You have the right to: