Privacy policy notice from Nest Clinic with green text, icons, and decorative leaves, explaining how they collect, use, secure, share, and allow access to personal information.
A privacy policy webpage for Nest Clinic featuring a white background, green text, decorative leaves, a lit candle in a ceramic holder, a large white vase with green leaves, a beige cloth, and icons representing information collection, security, sharing, options, and updates.

PRIVACY POLICY

Last Updated: 12 August 2026

1. Introduction

Welcome to the privacy policy for Nest Clinic ("we", "us", or "our"). We operate a holistic health clinic and respect your privacy. We are committed to protecting your personal data and processing it in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This privacy policy explains how we collect, use, store, and protect your personal data when you visit our website, use our online booking system (Acuity Scheduling), or receive holistic health treatments from our practitioners.

2. Important Information and Who We Are

Data Controller

Nest Clinic is the data controller and is responsible for your personal data.

Contact Details

If you have any questions about this privacy policy or our data protection practices, please contact us using the details below:

  • Full Name of Legal Entity: Nest Clinic

  • Email Address: Nestacupuncture77@gmail.com

  • Postal Address: 11 Newton Road, Urmston, Manchester M41 5AF

  • Telephone Number: 07803595310

Information Commissioner's Office (ICO)

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

  • Our ICO Registration Number: ZC228543

3. The Data We Collect About You

Personal data means any information about an individual from which that person can be identified. We may collect, use, store, and transfer different kinds of personal data about you, grouped as follows:

  • Identity Data: First name, last name, title, date of birth, and gender.

  • Contact Data: Billing address, home address, email address, and telephone numbers.

  • Financial & Transaction Data: Details about payments from you and other details of treatments, packages, or products you have purchased from us. (Note: Card payments are processed securely via third-party payment processors like Stripe or Square linked to Squarespace/Acuity; we do not store raw card numbers).

  • Technical & Usage Data: Internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types, operating system, and how you use our website.

  • Marketing & Communications Data: Your preferences in receiving marketing from us and your communication preferences.

Special Category Data (Health Records)

Because we provide holistic health services, we must collect "Special Category Data" regarding your physical and mental health. This includes:

  • Medical history, current symptoms, and diagnoses.

  • Lifestyle factors (diet, sleep, stress levels, exercise habits).

  • Treatment notes, supplement recommendations, and progress records compiled by your practitioners during or after your consultations.

4. How Your Personal Data Is Collected

We use different methods to collect data from and about you, including:

  • Direct Interactions: You give us your Identity, Contact, and Health Data by filling out forms on our website or booking system, or by corresponding with us by post, phone, email, or in person during clinical consultations.

  • Our Online Booking System (Acuity Scheduling): When you book an appointment, your booking data and intake form answers are collected and stored securely via Acuity Scheduling (a Squarespace company).

  • Automated Technologies: As you interact with our website, hosted on Squarespace, we automatically collect Technical Data about your equipment and browsing patterns. We collect this personal data by using cookies and similar technologies.

5. How and Why We Use Your Personal Data

We will only use your personal data when the law allows us to. Most commonly, we use your data under the following lawful bases:

  1. Performance of a Contract: To schedule your appointments, manage payments, and provide the holistic health services you have requested.

  2. Legitimate Interests: To properly run and administer our clinic, manage our relationship with you, and optimize our website content.

  3. Legal Obligation: To comply with professional clinical regulations, tax accounting rules, or statutory requests.

Legal Basis for Processing Health Data (Special Category Data)

Under the UK GDPR, we process your health data using the following specific exemptions under Article 9:

  • Explicit Consent (Article 9(2)(a)): By completing our digital intake forms via Acuity Scheduling prior to your first appointment, you provide explicit consent for our practitioners to process your health details to design and deliver your holistic care plan. You may withdraw this consent at any time, though this may mean we can no longer safely treat you.

  • Provision of Health or Social Care (Article 9(2)(h)): Processing is necessary for the management of health or social care systems and services, conducted by bound professional practitioners.

6. Data Sharing and Third-Party Platforms

We do not sell your personal data. We only share your data with trusted third parties necessary to run our clinic and provide your care:

  • Our Clinic Practitioners: The two practitioners operating within our clinic share access to your health files to provide cohesive, holistic treatments, unless you explicitly request otherwise.

  • Squarespace: Our website platform provider, which processes basic analytical and contact form data.

  • Acuity Scheduling: Our secure booking infrastructure, which securely captures, stores, and handles your online appointments and clinical intake forms.

  • Payment Gateways: Third-party providers (e.g., Stripe, PayPal) integrated into our site to manage processing fees securely.

  • Professional Regulators / Insurers: If required by law, professional indemnity insurance guidelines, or clinical regulatory bodies.

7. International Data Transfers (UK-US)

Our website host (Squarespace) and booking system (Acuity Scheduling) are based in the United States. This means your personal data will be transferred and stored outside the United Kingdom.

To ensure your data receives an equivalent level of protection, we ensure that these providers utilise approved legal safeguards. This includes using UK Standard Contractual Clauses (SCCs) / International Data Transfer Addendums, or verifying that the platforms participate in the UK Extension to the EU-US Data Privacy Framework, guaranteeing secure and GDPR-compliant processing of your personal data on overseas servers.

8. Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way.

Access to your highly sensitive Health Data is strictly restricted to the practitioners directly responsible for your care. Your digital intake forms and history files are password-protected, encrypted at rest, and stored inside our secure scheduling environment.

9. Data Retention

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or professional reporting requirements.

By law and professional regulatory guidance in the UK, health and clinical notes must generally be retained for a minimum period of 7 to 8 years following the date of your last treatment (or, if the patient is a child, until their 25th birthday). After this period, your data will be securely and permanently deleted.

10. Your Legal Rights

Under UK data protection laws, you have rights in relation to your personal data, including the right to:

  • Request access to your personal data (a "data subject access request").

  • Request correction of any incomplete or inaccurate data we hold about you.

  • Request erasure of your personal data (subject to legal or regulatory clinical retention requirements).

  • Object to processing or request the restriction of processing of your personal data.

  • Request the transfer of your personal data to you or a third party.

  • Withdraw consent at any time where we are relying on consent to process your health or marketing data.

If you wish to exercise any of these rights, please contact us directly via email.

11. Cookies

Our website uses cookies provided by Squarespace to help our site run effectively and provide a seamless booking experience. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website or the Acuity booking calendar may become inaccessible or not function properly.

For full details, please review our separate Cookie Policy or manage your choices via our website's cookie pop-up banner.