Last updated 16 October 2026

This policy explains how I collect, use and protect personal information when you visit my website, contact me or become a client.

1. About this policy

I am Danielle Abramov, BSc MARH, Registered Homeopath, trading as Heath Homeopath. I am the data controller for the personal information described in this policy.

Contact: danielle@theheathhomeopath.co.uk

2. Information collected

Depending on your contact with me, I may collect:

• your name, date of birth, contact details and appointment information;
• information you include in an enquiry or correspondence;
• health history, symptoms, medication, allergies, family history and other information relevant to your care;
• consultation notes, questionnaires, remedies supplied and progress information;
• parent or guardian and GP details where relevant; and
• payment and administrative records, but not full payment-card details.

Health information is special-category personal data and receives additional protection under data-protection law.

3. How information is obtained and used

Most information comes directly from you through email, Microsoft Forms, Picktime, WhatsApp, telephone calls or consultations. It may also come from a parent, guardian or healthcare professional where you have authorised this or where the law permits it.

I use personal information to:

• respond to enquiries and arrange appointments;
• provide and administer consultations and programmes;
• maintain accurate professional records and communicate about your care;
• supply remedies and manage payments; and
• meet professional, insurance, safeguarding, tax and legal responsibilities and protect the practice and website.

The main lawful bases I use are taking steps before entering into a contract, performing a contract, complying with legal obligations and my legitimate interests in running and protecting the practice. I rely on your explicit consent to process health information for your care. Where necessary, records may also be used or retained for establishing, exercising or defending legal claims.

If I introduce a newsletter, it will be optional and based on separate consent. I do not sell personal information or use health information for advertising.

4. Storage, protection and sharing

Client records are stored locally on my password-protected Mac and, where used, in locked paper files. Patient records are not stored in OneDrive.

Microsoft Forms may be used to collect a patient questionnaire. I download, transfer or print the information needed for the client record, then delete the Forms response and unnecessary download or email copies.

I use passwords, device security, access controls, screen locks and two-step verification where available. Access is limited to me and anyone specifically authorised for a necessary business purpose. No email, messaging or internet service can be guaranteed completely secure, but I take reasonable precautions appropriate to the sensitivity of the information.

I share only the minimum information necessary. This may include sharing with service providers used for email, Microsoft Forms, Picktime, website hosting, communications, IT support or accounting. Information may also be shared with a healthcare professional with your permission, or with my professional association, insurer, legal adviser, safeguarding authority, emergency service, court, HMRC or regulator where necessary or required by law.

Some providers, including Microsoft, Google, Picktime and WhatsApp, may process information outside the UK. I use established providers and rely on the appropriate legal safeguards they put in place for international transfers.

5. How long information is kept

• Adult client records are normally kept for at least seven years after the last consultation.
• Records created while a client is a child are normally kept until age 25, or for at least seven years after the latest consultation if care continues after age 18.
• Financial and tax records are kept for the period required by law.
• Enquiries that do not lead to a client relationship are deleted when no longer needed.

Records may be kept longer where a complaint, legal claim, safeguarding matter, insurance requirement or other justified obligation applies. Information is securely deleted or destroyed when it is no longer required.

6. Children and young people

For clients under 16, information and consent are usually provided by a parent or guardian, while the child is involved according to their age and understanding. A young person aged 16 or 17 will normally provide their own consent. Parent or guardian involvement and communications will be agreed as appropriate, subject to confidentiality, safeguarding and safety responsibilities.

7. Website information, cookies and marketing

The website host may process limited technical information, such as IP address, browser information, pages requested and security logs, to operate and protect the website. The website currently uses Statify for cookieless page-view counting and does not use Google Analytics, embedded maps, videos, social-media feeds or an embedded mailing-list form.

Picktime is reached through an external link. Its own privacy and cookie terms apply when you use that service. If the website later introduces non-essential cookies or tracking, this policy and the website’s cookie information will be updated and consent requested where required.

8. Your rights and complaints

Depending on the circumstances, you may ask to access, correct, delete, restrict or receive a copy of your personal information. You may withdraw consent at any time. Withdrawal does not affect earlier lawful processing and I may still need to retain some records for a lawful and justified reason.

You may object to processing based on legitimate interests and you always have the right to object to direct marketing.

To exercise a right or raise a concern, email danielle@theheathhomeopath.co.uk. I may need to confirm your identity and will normally respond within one month.

If your concern is not resolved, you may complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or 0303 123 1113. I will update this policy when the practice, website services or legal requirements change.