Data Protection Notice and Privacy Policy

This privacy policy explains how RED Reflexology collects, stores, and handles your personal and health data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data (Use and Access) Act. 

 

I am Shona Rathore, a sole trader and registered Reflexologist. I operate a fully digital clinic. I am a full member of the Association of Reflexologists (AoR) and am registered with the Information Commissioner’s Office (ICO) under registration number A8503562. 

 

The Data I Collect & Why:

 

To provide safe, effective, and tailored reflexology treatments, I must collect:

 

Personal Data: Your name, date of birth, contact numbers, and email address. 

 

Special Category Data: Your physical health history, lifestyle habits, current symptoms, medications, and digital session notes. 

 

Lawful Basis for Processing

 

Legitimate Interests: Processing your personal data is necessary to manage your appointments, handle billing, and run my business safely. 

 

Explicit Consent: By signing my intake form, you provide explicit consent for me to document and process your sensitive health information. 

 

How Your Data is Secured 

 

Digital- First I maintain a strictly paperless, digital practice. 

 

To safeguard your information: All intake forms and treatment notes are stored on encrypted cloud systems. 

 

Devices accessing your records are protected by biometric locks and multi-factor authentication (MFA). 

 

Group emails or updates are sent exclusively via BCC to shield your private email address from other clients. 

 

Data Retention 

 

Adults:Records are legally held for 7 years after your last appointment. 

 

Children/Minors: Treatment logs are permanently retained until the individual reaches age 25 or 26, satisfying strict medical insurance directives. 

 

Your Rights 

 

You have the right to request a copy of your records (Subject Access Request). Under the Data (Use and Access) Act, if your request is broad, I reserve the right to pause the response timer while clarifying the specific files you require. 

 

How to Make a Data Protection Complaint 

 

If your data is not handled in line with UK regulations, please contact me directly at redreflexology.health@gmail.com

or 1B The Green, Flore, Northamptonshire, NN7 4LG so I can swiftly investigate. 

 

Step 1: Submit your written complaint to me. I will acknowledge receipt within 30 days and provide a formal, written response without undue delay. 

 

Step 2: If you remain unsatisfied with my resolution, you maintain the legal right to escalate your complaint directly to the Information Commissioner’s Office (ICO) via www.ico.org.uk or by calling 0303 123 1113.