Privacy Policy

Revised to include Health Information and Confidentiality in the same policy

Important: approval required

Working draft - do not publish unchanged. Confirm legal controller identity and address, providers, UK GDPR lawful bases (including the Article 9 condition for health data), retention periods, hosting locations, cookies, and international transfers. Seek qualified UK data protection/legal review.

Contact: [email protected] (verify active mailbox) | Telephone: 07597 315832 | Effective date: [TO CONFIRM].

1. Who is responsible for your information

Inner Civilisations is operated by [LEGAL ENTITY / SOLE TRADER NAME AND POSTAL ADDRESS TO CONFIRM], the data controller for information described here. Contact [email protected] for privacy enquiries.

2. Information collected

We may collect contact details, appointment and payment references, enquiries, account and newsletter preferences, and information you provide in secure consultation or Marma forms. Health and lifestyle details may include symptoms, diagnosed conditions, medications, allergies, treatment history, digestion, sleep, diet and emotional wellbeing. We aim to collect only information relevant to the service.

3. How information is used

We use information to respond to enquiries, manage and provide services, confirm bookings, administer client records, process payments, send essential service messages, maintain security and comply with legal obligations. Marketing is managed separately and includes an unsubscribe mechanism where applicable.

4. Legal grounds for processing

For ordinary personal information, we must identify an appropriate UK GDPR Article 6 lawful basis for each purpose, such as performance of a contract or a legal obligation where applicable. For health information, an additional valid Article 9 condition and any necessary safeguards are required. Final lawful bases and conditions: [CONFIRM WITH QUALIFIED ADVISER]. A checkbox acknowledging this notice does not itself establish a lawful basis or valid explicit consent.

5. Health Information and Confidentiality

Ayurveda consultation questionnaires and relevant treatment-screening forms may request sensitive health and lifestyle details so the practitioner can prepare for and deliver the requested service, assess suitability and maintain appropriate records.

This information should be collected through secure, verified forms and stored in restricted clinical records linked to the correct client. Only authorised practitioners or personnel with a legitimate need should access it. Clinical information should not be included in ordinary confirmation emails, newsletter systems or AI assistant access by default.

Clients can discuss questions they are uncomfortable answering during the consultation, subject to information necessary for safe and appropriate service delivery. Any separate treatment consent or legally required explicit data-processing consent must be obtained using an appropriate distinct process where applicable.

Retention of clinical records: [CONFIRM PERIOD AND JUSTIFICATION]. Health-data Article 9 condition and any consent process: [CONFIRM].

6. Sharing and service providers

We may use authorised hosting, email, booking, calendar, video meeting and payment providers. The actual providers and processor agreements must be verified before publication: [HOST], [PAYMENT], [EMAIL], [CALENDAR/VIDEO], [OTHER]. We do not give advertisers access to confidential clinical records.

7. Accounts and marketing

Newsletter subscription does not require an account. Guest bookings may be linked to a verified client profile. Marketing preferences are separate from acceptance of booking terms or acknowledgement of this Privacy Policy.

8. Security and retention

Appropriate safeguards should include encrypted connections, access permissions, backups, logging, secure account authentication and staff confidentiality procedures. Information is retained only for justified periods. Retention schedule by record type: [CONFIRM].

9. International transfers

If a provider stores or accesses data outside the UK, the relevant transfer details and safeguards must be identified and documented. [CONFIRM ACTUAL TRANSFERS].

10. Cookies and analytics

Essential cookies may support website security, checkout and sign-in. Where required, non-essential analytics or marketing cookies must be subject to an appropriate consent mechanism. [CONFIRM ACTUAL COOKIES, PROVIDERS AND PREFERENCE CONTROLS].

11. Your rights

Depending on the circumstances, you may have rights to access, rectify, erase, restrict or object to processing, data portability, and withdrawal of consent where processing is based on consent. Contact [email protected]. You may also complain to the UK Information Commissioner's Office (ICO).

12. Updates and contact

[CONFIRM AGE / CHILDREN POLICY]. We may update this notice as our services and systems change. Contact: [email protected] | 07597 315832.