Danielle Abramov, BSc MARH, Registered Homeopath

Last updated: 14 August 2026

1. About this policy

This Privacy Policy explains how Danielle Abramov, BSc MARH, Registered Homeopath, trading as Heath Homeopath, collects, uses, stores and protects personal information. It applies to website visitors, people who make an enquiry, clients, prospective clients and, where relevant, parents or guardians of younger clients.

Danielle Abramov is the data controller responsible for the personal information described in this policy. This means that she decides why and how that information is used.

Contact details

Business: Heath Homeopath

Data controller: Danielle Abramov, BSc MARH, Registered Homeopath

Email: danielle@theheathhomeopath.co.uk

2. Information collected

The information collected depends on how a person interacts with Heath Homeopath.

Enquiries and appointment bookings

• name and contact details, including email address and telephone number;
• the content of an enquiry and any information volunteered;
• appointment details and booking history; and
• records of relevant correspondence.

Client and clinical records

• name, date of birth, address and contact details;
• parent or guardian details where the client is under 18;
• GP and other healthcare-professional details where relevant;
• health history, symptoms, current concerns, medication, allergies, lifestyle information and family medical history;
• consultation notes, care recommendations, remedies supplied and progress information;
• completed questionnaires, including MYMOP forms;
• information about accessibility, communication or other support needs; and
• consent and agreement records.

Health information is special-category personal data and receives additional protection under data-protection law.

Payments and administration

• programme and consultation payment records;
• amounts paid, dates and payment method; and
• limited transaction information needed for bookkeeping, accounting, tax and resolving payment queries.

Heath Homeopath does not collect or retain complete payment-card details. Payments are currently made by bank transfer or cash.

Website information

The website may generate limited technical information, such as server logs, IP address, browser or device information, requested pages and the date and time of a visit. Hosting and security providers may process this information to operate and protect the website.

The website currently uses Statify to count page views without using cookies or creating profiles of individual visitors. It does not use Google Analytics, embedded maps, embedded videos, social-media feeds or an embedded mailing-list form at the date shown above.

3. How information is obtained

Most information is provided directly by the person concerned, for example when they email, book an appointment, complete a form, attend a consultation, send a message or make a payment.

Information may also be provided by a parent or guardian, or by another person or healthcare professional where the client has authorised this or where the law permits or requires it.

4. Why information is used and the lawful basis

UK data-protection law requires a lawful basis for using personal information. Where health or other special-category information is used, an additional condition is also required.

Purpose	Article 6 lawful basis	Special-category condition
Responding to enquiries, arranging appointments and taking steps requested before a client relationship begins.	Steps before entering into a contract and legitimate interests.	Explicit consent where health information is volunteered.
Providing homeopathic care, maintaining clinical records, communicating about care and administering a programme.	Performance of a contract.	Explicit consent for processing health information.
Keeping appropriate records, handling complaints, safeguarding rights and establishing, exercising or defending legal claims.	Legal obligation and legitimate interests.	Establishment, exercise or defence of legal claims where applicable.
Bookkeeping, tax, payment administration and business records.	Legal obligation and legitimate interests.	Normally not applicable; health details are not used for this purpose unless necessary.
Operating, maintaining and securing the website, email, devices and business systems.	Legitimate interests in running and protecting the practice.	Normally not applicable.
Sending newsletters or marketing emails after this service is introduced.	Consent.	Health information will not be used for marketing.

Consent and withdrawal

Where processing relies on consent, consent may be withdrawn at any time by contacting Danielle. Withdrawing consent does not make earlier processing unlawful. It may mean that Danielle cannot continue providing care if the information is necessary for safe and appropriate professional practice. Some records may still need to be retained where another lawful basis and special-category condition applies, including the establishment, exercise or defence of legal claims.

5. How information is used

• to respond to enquiries and provide information about services;
• to book, provide and manage consultations and programmes;
• to understand the client’s circumstances and maintain accurate professional records;
• to communicate about appointments, care, remedies and relevant administration;
• to process payments and maintain accounting and tax records;
• to meet professional, insurance, safeguarding and legal responsibilities;
• to protect the security and proper operation of the practice and website; and
• to send newsletters only where separate consent has been given, once a mailing list is introduced.

Personal information is not sold. Health information is not used for advertising or unrelated marketing.

6. Who information may be shared with

Information is shared only where necessary and proportionate. Depending on the circumstances, recipients may include:

• service providers used to operate the practice, including website hosting, secure cloud storage, email, appointment booking, communications, IT support and accounting services;
• a client’s GP or another healthcare professional, normally with the client’s permission;
• professional advisers, insurers, regulators or Danielle’s professional association where necessary;
• safeguarding organisations, emergency services, courts or public authorities where disclosure is required by law or necessary to address a serious safety or safeguarding concern; and
• a parent, guardian or person authorised by the client, where appropriate.

The services currently used may include Microsoft OneDrive and Outlook, Google email services, Picktime and WhatsApp. Each provider processes information under its own privacy terms. Only the information needed for the particular service is used. Clinical information is not routinely sent to every provider listed above.

Anyone engaged to provide administrative or technical support is permitted to access personal information only where necessary and is expected to keep it confidential.

7. International transfers

Some service providers may store or process information outside the United Kingdom. Where this occurs, Danielle takes reasonable steps to use providers that apply an appropriate UK data-transfer safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful mechanism.

Because WhatsApp and some cloud or email services operate internationally, information sent through them may be processed in other countries. Clients should avoid sending detailed or highly sensitive health information through WhatsApp unless Danielle has asked them to do so and the communication is necessary.

8. How information is protected

Danielle uses reasonable technical and organisational measures designed to protect personal information from loss, misuse, unauthorised access, alteration or disclosure. These measures include password-protected devices and accounts, screen locks, access controls, secure cloud services and two-step verification where available.

Access is limited to Danielle and any authorised person who genuinely needs it for an agreed business purpose. No internet, email or messaging system can be guaranteed completely secure, but reasonable precautions are taken according to the sensitivity of the information.

9. How long information is kept

Records are kept only for as long as reasonably necessary for professional practice, insurance, legal, accounting and safeguarding purposes.

• Adult client records are normally retained for at least seven years after the last consultation.
• Records created while a client is a child are normally retained until the client reaches age 25, meaning seven years after their 18th birthday.
• If a client continues after turning 18, records are normally retained for at least seven years after the most recent consultation.
• Financial and tax records are normally retained for the period required by applicable tax and accounting rules.
• Enquiries that do not lead to a client relationship are reviewed and deleted when no longer needed.
• Website security logs are retained according to the hosting provider’s operational and security requirements.

A record may be retained for longer where necessary because of a complaint, legal claim, safeguarding matter, insurer requirement or other legal or professional obligation. At the end of the relevant period, information is securely deleted or anonymised unless there is a justified reason to retain it.

10. Children and young people

For a child under 16, information is usually provided and consent given by a parent or guardian. Danielle will involve the child in decisions and explanations according to their age and understanding. A young person aged 16 or 17 will normally provide their own consent, although a parent or guardian may remain involved where appropriate and agreed.

Information about a child or young person is treated with particular care. Danielle will explain who will receive appointment and care-related communications and will respect confidentiality subject to legal, safeguarding and safety responsibilities.

11. Individual rights

Depending on the circumstances, individuals may have the right to:

• be informed about how their personal information is used;
• request access to their personal information;
• ask for inaccurate or incomplete information to be corrected;
• ask for information to be deleted in certain circumstances;
• ask for the use of information to be restricted;
• receive certain information in a portable format;
• object to processing based on legitimate interests or to direct marketing;
• withdraw consent where consent is the lawful basis; and
• complain to the Information Commissioner’s Office.

These rights are not absolute. For example, Danielle may need to retain clinical records despite a request for deletion where there is a lawful and justified reason to do so.

To exercise a right, contact Danielle using the details in section 1. Danielle may need to confirm the requester’s identity. Requests are normally answered within one month, although the law allows more time in certain circumstances.

12. Automated decision-making

Heath Homeopath does not use personal information to make solely automated decisions that have legal or similarly significant effects on individuals.

13. Cookies and website measurement

At the date of this policy, the website uses Statify for cookieless page-view counting and does not intentionally place non-essential analytics or advertising cookies. Essential technical cookies may be used if they are required for security or the operation of a requested website feature.

The website’s cookie use will be checked after launch. If non-essential cookies, Google Analytics, embedded content or an embedded mailing-list form are introduced, this policy and the website’s cookie information will be updated, and consent will be requested before non-essential cookies are set where required.

Picktime is accessed through an external link rather than being embedded in the website. Picktime’s own privacy and cookie information applies when a visitor uses that service.

14. Newsletter and marketing

Heath Homeopath does not currently operate a website mailing-list form. If newsletters are introduced, subscription will be optional and based on separate consent. Subscribers will be able to unsubscribe at any time by using the link in an email or contacting Danielle. Client care will not depend on agreeing to receive marketing.

15. Complaints

Questions or concerns about personal information should first be sent to Danielle using the contact details in section 1 so that she has an opportunity to respond.

Individuals also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection:

Website: https://ico.org.uk/make-a-complaint/

Telephone: 0303 123 1113

Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

16. Changes to this policy

This policy will be reviewed when the practice changes how it collects or uses personal information, introduces new website services or where legal or regulatory requirements change. The current version will be published on the website with its updated date.