Acupoint ensures that all your personal details provided at Acupoint are stored and processed for four reasons in line with the General Data Protection Regulation (the GDPR) requirements:

1. Personal information will need to be collected about your health to provide the best possible treatment.
2. Acupoint has a “legitimate interest” in collecting your personal information so we can provide safe and effective treatment.
3. It’s important we can contact you via email or phone to arrange and confirm your appointments. This constitutes as your “legitimate interest”.
4. Providing I have your verbal consent, I may occasionally send you individualised health advice or articles by email. You may withdraw this consent at anytime. 

• Acupoint has a legal obligation to retain your records for 8 years after your most recent treatment (or after you have reached 25 years old, if this is longer). Providing the minimum legal period has elapsed, you can ask Acupoint to delete your personal data. 
• Your clinical records will be stored on paper in a secure cabinet in the clinic, which is alarmed. 
• We will never share your personal details with anyone who does not need access without your written consent. 
• You have a right to see what personal data of yours we hold, and you can ask Acupoint to correct any factual errors. Provided the legal minimum period has not elapsed.

If you feel that Acupoint are mishandling your personal data, you have the right to complain. Please raise your uncertainties with me first, so I can hope to deal with any concerns. You can raise your concerns directly to the Information Commissioner’s Office on http://ico.org.uk/concerns/.