Privacy Protocol
1. Data Controller
James Pegg is a self-employed acupuncturist and the data controller responsible for the personal information collected through this website and during clinical treatment.
James Pegg processes clinical information under strict professional duties of confidentiality and in accordance with applicable British Acupuncture Council (BAcC) professional requirements.
2. Information Captured
A. Telemetry & Analytics: Pages visited, approximate location, browser data, and analytics consent preference.
B. Intake Data: Your name, email address, telephone number, and the clinical condition categories selected on the evidence intake form.
C. Clinical Records: If you proceed to a consultation, health history, treatment notes, and appointment records are retained securely.
3. Lawful Basis for Processing
Ordinary contact information is processed under Article 6(1)(f) of the UK GDPR (Legitimate Interests) to respond to your clinical enquiry.
Health-related information is processed under Article 9(2)(h) of the UK GDPR and Schedule 1, Part 1, condition 2 of the Data Protection Act 2018 (the provision of health care or treatment).
4. Data Retention Architecture
- Unsuccessful Enquiries & Netlify Dashboard: Retained for 30 days prior to manual deletion review.
- Email Communications: Enquiry emails are moved to Gmail Trash during the clinic’s 30-day deletion review. Gmail ordinarily deletes messages from Trash after 30 days. Residual copies may remain temporarily within Google’s secured deletion and backup processes.
- Clinical Records: Retained for 7 years from the date of the last treatment (or until age 25 for minors).
- Analytics Consent Data: Stored locally in your browser for six months.
5. Google Analytics & Telemetry
We use optional Google Analytics to measure site telemetry. This service will only load after you actively authorize it via our preference panel. Advertising and remarketing tracking features remain permanently denied. We do not send any clinical-form variables to Google Analytics.
Google states that it uses recognised transfer mechanisms for international processing, which may include the UK Extension to the EU-US Data Privacy Framework.
6. Contact & Data Rights
You maintain the right to access, rectify, or request erasure of your data (subject to legal and professional retention requirements). Direct all data enquiries to: data@jamespeggacupuncture.com.
You also maintain the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk.