Tula Acupuncture – Privacy Policy
Last updated: August 2026
Tula Acupuncture respects your privacy and is committed to protecting your personal information. This policy explains what information I collect, why I collect it, how it is stored and the circumstances in which it may be shared.
Who I am
Tula Acupuncture
Rachael Harrison
Email: rachael@tula-acupuncture.co.uk
For the purposes of UK data protection law, I am the data controller for your personal information. This means I am responsible for deciding how and why your information is collected and used.
What information I collect
I may collect:
Your name, date of birth and contact details
Appointment and payment information
Information you provide when making an enquiry or booking
Your health information, medical history, medications and symptoms
Clinical findings, treatment plans, treatment provided and your progress
Information relevant to your ongoing care
Health information is considered special category data under UK GDPR and is handled with additional care and protection.
How I use your information
I use your information to:
Arrange and manage appointments
Contact you about your appointments and treatment
Carry out consultations and traditional Chinese medicine diagnosis
Assess whether treatment is appropriate and provide safe, personalised care
Maintain accurate clinical records and monitor your progress
Process payments and deposits
Meet my professional, legal and insurance obligations
Deal with enquiries, complaints or incidents relating to your care
I will not use your health information for marketing purposes.
Lawful basis for processing
I process your personal information where it is necessary to provide and manage your treatment, administer my practice and meet my professional and legal obligations.
Health information is processed under the applicable UK GDPR conditions for special category data, including where necessary for the provision of healthcare and the management of healthcare services.
Where I rely on consent for a particular use of your information, I will ask for your consent separately.
How your information is stored
Your patient and clinical information is stored securely using Cliniko, a professional practice management system used to manage appointments and clinical records.
Cliniko provides security measures and arrangements to support UK GDPR compliance. For UK accounts, Cliniko states that account data is stored in the UK.
I take reasonable steps to protect your information from loss, misuse, unauthorised access or disclosure.
Clinical records are retained for seven years from your last contact with Tula Acupuncture, in accordance with my professional record-keeping requirements. After this period, records will be securely deleted or destroyed unless there is a legitimate reason or legal requirement to retain them for longer.
Third-party services
I use trusted third-party providers to help operate Tula Acupuncture:
Cliniko – appointment management and secure storage of patient and clinical records.
Stripe – secure processing of payments and deposits. Stripe may process information necessary to complete your payment, such as your name, contact details and payment information. I do not store your full card details within my clinical records.
Squarespace – hosting and operating my website. Squarespace may collect information such as your IP address, browser and device information and information about how you use the website.
These providers process information as necessary to provide their services and have their own privacy policies.
Confidentiality and sharing your information
Your personal and clinical information will be treated as confidential.
I will not sell your information or share it with third parties for marketing purposes.
Information may be shared where necessary:
With another healthcare professional involved in your care, where appropriate and with your consent
To protect your health or safety, or the health or safety of another person
Where required by law, a court or other lawful authority
With my professional or regulatory body, such as the British Acupuncture Council, where required in relation to a complaint, investigation or professional matter
With my professional indemnity insurer or relevant legal adviser where necessary in relation to a complaint, claim or legal matter
Only information that is necessary for the relevant purpose will be shared.
Website and cookies
My website is hosted by Squarespace and may use cookies and similar technologies to allow the website to function, improve your experience and understand how visitors use the site.
Some cookies are necessary for the website to operate. Where required, non-essential cookies will only be used in accordance with your cookie preferences.
You can also manage or disable cookies through your browser settings.
Your rights
Under UK data protection law, you have rights relating to your personal information, including the right to:
Request access to the information I hold about you
Ask for inaccurate or incomplete information to be corrected
Request restriction of processing in certain circumstances
Object to certain types of processing
Request deletion of your information where applicable
Some of these rights are subject to legal and professional requirements. For example, I may need to retain clinical records for seven years and therefore cannot necessarily delete them on request.
To exercise your rights or ask any questions about how your information is handled, please contact:
rachael@tula-acupuncture.co.uk
Complaints
If you have any concerns about how your personal information has been handled, please contact me in the first instance so that I can try to resolve your concerns.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.
Changes to this policy
I may update this Privacy Policy from time to time to reflect changes to my practice, services or legal requirements. The latest version will always be available on this website.
Tula Acupuncture
Rachael Harrison