Privacy Notice

Who is responsible

Vidya Colon Clinic is the data controller: we decide what is collected and why. We practise at Littlehampton Natural Health Centre and at the Angmering yurt in West Sussex. If you want to talk to someone about your data, write to us at the address at the bottom of this page and it will reach the practitioner directly, not a call centre.

What we collect

Depending on how you use the clinic, we may hold:

• Your name, email address, telephone number, postal address, date of birth and occupation.
• The name of your GP, where you give it.
• Your health history — the conditions, medications, symptoms and surgeries you tell us about on the intake form, and anything you tell us at a session.
• A record of what you consented to, when, in which language, and the exact wording you were shown.
• Your signature, captured when you sign a consent form.
• Your appointments: what was booked, when, with whom, whether it took place, and any notes made about the session.
• Messages you send us through the website's enquiry forms.
• Basic technical information your browser sends when you visit, such as your IP address.

Health information, and why we are allowed to hold it

Most of what we hold is health data, which the law treats as a special category needing extra protection. We rely on Article 9(2)(h) of the UK GDPR: this information is necessary for us to provide you with treatment and to assess whether a treatment is safe for you. Some of the questions on the intake form exist precisely so we can decline to treat you when a therapy would not be safe — that is the whole point of asking. We also rely on your explicit consent, recorded when you sign the form, and you can withdraw it at any time.

What we use it for

We use your information to:

• Decide whether a treatment is safe for you before it happens.
• Carry out and record your treatments.
• Arrange, confirm and remind you about appointments.
• Answer your enquiries.
• Keep the records our professional body and our insurer require us to keep.
• Send you marketing, but only on the channels you have specifically agreed to, and never automatically because you became a client.

Who else can see it

We do not sell your information and we do not share it for anyone else's marketing. It is handled on our behalf by a small number of service providers, each bound to process it only on our instructions:

• Clerk — runs the sign-in for your portal account. Holds your name and email, not your health record.
• Neon — the database where everything else is stored. Hosted in London.
• Cloudflare R2 — stores the signature images from your consent forms, in a private area with no public address.
• AhaSend — sends the emails we send you, such as appointment confirmations.
• Vercel — serves this website.

We will also disclose information where the law requires it, or where there is a serious risk to someone's safety. If you ask us to write to your GP we will do so, but only with your agreement.

Where it is kept

Your records are stored in London. Some of the services that act for us, listed above, may process data outside the United Kingdom; where they do, they are contractually bound to protect it to the standard UK law requires.

How long we keep it

We keep health records for as long as professional guidance and our insurers require, and no longer. That period is longer than most people expect: a record of what was done, and what you agreed to, has to remain answerable for years after your last visit. Enquiries that do not become appointments are kept only as long as we need them to reply to you.

What you can ask us to do

You have the right to:

• See a copy of everything we hold about you.
• Have anything inaccurate corrected.
• Ask us to erase your data.
• Object to how we use it, or ask us to restrict it.
• Withdraw a consent you previously gave, including marketing, at any time.

If you have a portal account, you do not have to write to us for the first two: sign in and go to Your details, where you can download everything we hold in one file, and submit an erasure request. An erasure request is exactly that — a request, not an instant deletion. We will always act on it within one month, but we will usually not be able to erase a health record that we are still required to keep, and we will tell you plainly which parts we removed and which we kept and why.

How it is protected

Access to the clinic's system requires a personal login. Health records can only be opened by the practitioner, and every single time a health record or a signature is opened, the system records who opened it and when. Signature images are held privately, with no public address that could be guessed or shared. All traffic to this site is encrypted.

If you are unhappy

Please tell us first — most things are quicker to put right directly. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection authority, at ico.org.uk.

Contact us

For anything in this notice, including a request to see or erase your data, email us at hello@coloniclinic.co.uk.