At Innr Wellness, your privacy and data security are a priority. This notice outlines how we collect, store, and use your information in accordance with the UK General Data Protection Regulation (UK GDPR) and other applicable laws.

What Information We Hold

We may collect and retain the following:

• Personal Data: such as your name, contact details, date of birth, and appointment history.
• Health Information: patient notes, symptom details, treatment history, and other information relevant to your care (classified as ‘special category data’ under UK GDPR).

This policy applies to all individuals who use our services — including current, prospective, and former patients, as well as visitors to our website.

How Your Data Is Stored

• We ensure all data is stored and destroyed securely and only retain information that is relevant.
• All personal and health-related data is stored electronically in secure, password-protected systems.
• No third parties have access to your information, and we do not share, sell, or disclose your data without your explicit consent, unless required by law.

Use of Information

• Your personal data is used solely for the purpose of delivering safe and effective treatment.
• Your name, phone number, and email may be used to book and manage appointments, send treatment-related updates, and communicate policy or pricing changes.
• Please note that appointment confirmation emails are not encrypted. By contacting us via email, you accept responsibility for the lawful use of email communications.

We also maintain a permanent appointment log for tax purposes, legal record-keeping, and in the case of insurance claims or complaints.

Retention of Records

• Patient records are retained for eight years following your last appointment, or until a child patient reaches age 26, whichever is longer.
• In the event of referral to another healthcare provider, your data may be shared with your consent to support your ongoing care.
• In the event of a formal complaint or adverse incident, relevant information (including personal data) may be shared with the British Acupuncture Council and our professional insurers to facilitate proper handling of the matter. Your consent will be sought; however, refusal to provide consent may prevent the issue from being addressed anonymously. Complaint records are retained for two years after resolution.