Privacy Notice

1. Who we are

James Pegg is a self-employed acupuncturist and the data controller responsible for the personal information collected through this website and during your clinical treatment.

James Pegg processes clinical information under strict professional duties of confidentiality and in accordance with applicable British Acupuncture Council (BAcC) professional requirements. The BAcC is not the data controller for this website or clinical practice, and they do not routinely receive website form submissions.

2. Information we collect

We collect different types of information depending on how you interact with us:

A. Website and analytics information

• Pages visited and engagement information.
• Approximate location.
• Browser and device information.
• Your analytics consent preference.

B. Enquiry information

• Your name, email address, and telephone number.
• Selected physical and emotional experiences submitted via the clinical intake form.

C. Clinical records

If you become a patient, we will retain further information necessary for your care, which may include:

• Consultation information and health history.
• Treatment notes and correspondence.
• Appointment and payment records.

3. Our lawful basis for processing

Under data protection law, we require a lawful basis to process your personal information. We process your ordinary contact information under Article 6(1)(f) of the UK GDPR (Legitimate Interests) in order to respond to your clinical enquiry and manage our clinic schedule.

Health-related information is considered "special-category data," requiring an additional condition to process it legally. We process your submitted health information under Article 9(2)(h) of the UK GDPR and Schedule 1, Part 1, condition 2 of the Data Protection Act 2018 (the provision of health care or treatment).

4. How we store and protect your data

We take appropriate technical and organisational measures to protect personal information.

This website uses Netlify to provide website hosting and form processing. When you submit an enquiry, the form submission is stored in the Netlify Forms dashboard and may also be delivered to the clinic via notification email (Google Workspace/Gmail). Access to these systems is restricted to authorised individuals.

5. Data retention

We only keep your personal information for as long as necessary. The duration depends on the nature of the data:

• Unsuccessful Enquiries & Netlify Dashboard: Retained for 30 days.
• Email Communications: Enquiry emails are moved to Gmail Trash during the clinic’s 30-day deletion review. Gmail ordinarily deletes messages from Trash after 30 days. Residual copies may remain temporarily within Google’s secured deletion and backup processes in accordance with Google’s published retention practices.
• Clinical Records: Retained for 7 years from the date of the last treatment. For patients under 18, records are retained until their 25th birthday.
• Analytics Consent Data: Your Analytics preference and the date of your choice are stored in your browser for six months.

6. Your data protection rights

You have rights regarding your personal information, which apply under specific circumstances:

• The right to be informed: You have the right to be told how your data is used.
• The right of access: You can request copies of your personal information.
• The right to rectification: You can ask us to rectify inaccurate information.
• The right to erasure: You may request the erasure of your personal information where the right applies. Please note that some clinical information may need to be retained for professional, insurance, or legal reasons.
• The right to restriction of processing: You can ask us to restrict the processing of your data.
• The right to object to processing: You can object to the processing of your personal data in certain circumstances.
• The right to data portability: You can ask that we transfer the information you gave us to another organisation, or to you.
• Rights concerning automated decision-making: We do not use automated profiling to make decisions that legally affect you.

7. Third-Party Services & International Transfers

Google Fonts: We use Google Fonts to display the typography on this website. When you visit our site, your browser makes a direct request to Google’s servers, which may log your IP address. This functionality operates strictly to serve web fonts and is independent of Google Analytics.

Google Analytics: We use optional Google Analytics to understand aggregate or pseudonymous website use and technical performance. This service will only load after you actively accept analytics via our preference panel. If you accept, analytics cookies may be placed on your device. Advertising and remarketing tracking features remain permanently denied. We do not send any clinical-form content, names, or contact details to Google Analytics.

Google may process Analytics information in the United States and other countries. Where personal information is transferred outside the UK, Google states that it uses recognised transfer mechanisms, which may include participation in the UK Extension to the EU-US Data Privacy Framework and contractual safeguards, as applicable.

You can reject analytics without losing any website functionality, and you can change your choice at any time by clicking "Manage analytics preferences" in the footer of this website.

8. Contact and complaints

If you have questions, concerns or complaints about how we use your personal information, please communicate directly to James Pegg via email: data@jamespeggacupuncture.com.

We will acknowledge any complaint within 30 days, make appropriate enquiries without undue delay, and keep you informed where appropriate. The final outcome will be communicated without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO) if you are unhappy with how we have used your data. You can contact the ICO via their website: www.ico.org.uk.