Privacy Policy

Last updated: 25 September 2026

About this privacy notice

Restore Acupuncture is committed to protecting your privacy and handling your personal information responsibly. This privacy notice explains what personal information I collect, why I collect it, how I use and protect it, who I may share it with, and your rights in relation to your information. I process personal information in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who am I?

Restore Acupuncture is the trading name of Meg Lucas Lic.Ac. MBAcC, an independent acupuncture practitioner based in Woodbridge, Suffolk. I am the data controller for the personal information I collect and process in connection with my practice.

You can contact me at: hello@restoreacupuncture.co.uk

Who does this privacy notice apply to?

This privacy notice applies to:

  • current, former and prospective patients

  • people who contact me with enquiries

  • people who book appointments

  • visitors to my website

  • people who provide information in connection with a complaint or other communication with my practice

What information do I collect?

Depending on how you interact with Restore Acupuncture, I may collect:

Contact and booking information, such as your name, email address, telephone number, address and appointment details.

Health and treatment information, such as your presenting symptoms, medical history, medication, relevant family history, lifestyle information, treatment notes, clinical observations, treatment provided and progress.

Administrative information, such as payment records, appointment records, consent records, correspondence and information relating to complaints or incidents.

Website information, such as technical information about your device and how you use the website, where this is collected through cookies or similar technologies.

Health information is considered special category data under UK data protection law and is subject to additional safeguards.

How do I use your information?

I only collect and use information that is relevant and necessary for the purposes described below.

Providing acupuncture treatment

I use your personal and health information to:

  • understand your reasons for seeking treatment and assess your health and wellbeing

  • carry out a Traditional Chinese Medicine diagnosis and formulate an appropriate treatment plan

  • provide and monitor acupuncture and any additional treatments or modalities

  • keep accurate clinical records

  • communicate with you about your treatment

  • identify circumstances where treatment may need to be adapted, postponed or referred to another healthcare professional

  • maintain appropriate records of consent and treatment.

Health information is processed as necessary for the provision and management of healthcare and in accordance with the additional requirements that apply to special category data.

Appointments and administration

I use your contact details to:

  • arrange, confirm and rearrange appointments

  • send appointment reminders and relevant information about your appointment

  • respond to enquiries

  • maintain appropriate business and financial records

  • communicate with you about your treatment or appointment.

Appointments are managed through the Acuity Scheduling system provided by the clinic where I practise. Information you provide when booking an appointment is processed through the clinic’s booking system. The clinic is responsible for the management of its Acuity account and associated data processing arrangements.

Payments

I use SumUp to process contactless card payments. I do not have access to or store your full card details. Payment information is processed by SumUp in accordance with its own privacy and security policies.

Legal, regulatory and insurance purposes

I may use and retain your information where necessary to:

  • comply with legal or regulatory obligations

  • demonstrate that appropriate professional standards and consent procedures have been followed

  • respond to complaints

  • deal with insurance claims or legal proceedings

  • protect the health, safety and wellbeing of patients or others.

I may also provide relevant information to my professional body, the British Acupuncture Council (BAcC), insurers, legal advisers or relevant authorities where this is necessary and lawful.

Marketing

I will only use your personal information for marketing communications where I have a lawful basis to do so, including your consent where consent is required. You can unsubscribe from marketing communications at any time. Choosing not to receive marketing communications will not affect your treatment.

Information you provide by email or online forms

You may provide personal or health information when contacting me by email or completing an online form. Please be aware that ordinary email is not necessarily encrypted while in transit. If you choose to send health or other sensitive information by email, you do so with this understanding. I will take appropriate measures to protect information once it is received and will only retain information that is necessary for the purposes described in this notice.

How are my clinical records stored?

Clinical records are stored digitally in an encrypted system and protected by appropriate access controls. I take reasonable and appropriate technical and organisational measures to protect your information against loss, misuse, unauthorised access, alteration or disclosure. Access to clinical information is restricted to what is necessary for legitimate clinical, professional, legal and administrative purposes.

Who do I share your information with?

I treat your personal information as confidential. I may share relevant information with third parties where this is necessary for the purposes described in this privacy notice, including:

  • the clinic where I practise and its booking system, where necessary to manage your appointment

  • service providers who process information on my behalf

  • SumUp, where necessary to process payments

  • my professional body, insurers or professional and legal advisers

  • healthcare professionals involved in your care, where appropriate and lawful

  • the police, courts or other authorities where I am legally required to do so

  • another person or organisation where necessary to protect your vital interests or the vital interests of another person.

I will not sell your personal information. Where I use third-party service providers to process personal information on my behalf, I take reasonable steps to ensure that appropriate data protection and security arrangements are in place.

Website and cookies

My website is hosted by Squarespace. Like most websites, it may collect certain technical information about visitors, such as IP address, browser type and device information, in order to operate, secure and improve the website. The website may also use cookies or similar technologies. Some cookies are necessary for the website to function, while others may be used for analytics or other purposes. Where consent is required for non-essential cookies, I will ask for your consent before using them.

How long do I keep your information?

I will not keep your personal information for longer than is reasonably necessary. I retain patient clinical records for 8 years in accordance with my professional record-keeping obligations and relevant British Acupuncture Council guidance. Some information, such as financial records, may need to be retained for a different period to meet legal or accounting requirements. When information is no longer required, I will securely delete or dispose of it.

Your rights

Under UK data protection law, you have rights in relation to your personal information. Depending on the circumstances, these include:

  • The right to be informed about how your information is used.

  • The right of access to the personal information I hold about you.

  • The right to rectification if your information is inaccurate or incomplete.

  • The right to erasure of your information in certain circumstances.

  • The right to restrict processing in certain circumstances.

  • The right to object to certain types of processing.

  • The right to data portability in certain circumstances.

  • The right to withdraw consent where I am relying on consent as the lawful basis for processing.

These rights are not absolute and some exemptions may apply, particularly where information needs to be retained for legal, professional or healthcare purposes.

Complaints

If you have any questions or concerns about how I handle your personal information, please contact me in the first instance: hello@restoreacupuncture.co.uk

I will do my best to resolve your concern. You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's independent data protection regulator. You can find information about contacting the ICO at ico.org.uk.

Changes to this privacy notice

I may update this privacy notice from time to time to reflect changes to my practice, the services I use or applicable data protection law. The latest version will always be available on the Restore Acupuncture website.