Legal

Privacy Policy

Last updated: [add date before publishing]

This is a draft policy prepared as a starting point. Because HI Shifa Clinic collects health information as part of consultations (a "special category" of data under UK GDPR), please have this reviewed by a qualified legal professional before publishing.

Who we are

HI Shifa Clinic ("we", "us", "our") provides Traditional Chinese Medicine consultations and personalised herbal medicine. This policy explains how we collect, use and protect your personal information when you use our website or our services. We are the data controller for the information described below.

Information we collect

Contact details you provide when you get in touch — name, email address, phone number.
Health information you share with us as part of a pre-consultation health summary and during consultations — including your medical history, symptoms, medications, lifestyle and, where provided, a photograph. This is "special category data" under UK GDPR and is treated with extra care.
Delivery information — your address, if herbal medicine is posted to you.
Communications you send us by email or WhatsApp.

How and why we use your information

To provide your consultation, prepare your personalised treatment plan, and post your herbal medicine — on the basis of your explicit consent for health information, and to perform our contract with you for other details.
To respond to your enquiries.
To meet our legal and professional obligations as practitioners.

We do not use your health information for marketing, and we do not sell your personal information to third parties.

Sharing your information

We only share your information where necessary — for example, with a courier to deliver your herbal medicine, or where we are required to by law. We do not share your health information with third parties for their own purposes.

How long we keep your information

We keep consultation and health records for as long as necessary to provide your care and to meet our professional and legal record-keeping obligations, after which it is securely deleted.

Children's information

Where we support a child's care, information is provided to us by, and communicated with, a parent or guardian.

Cookies and third-party services

Our website uses Google Fonts to display text correctly. Loading a font may share your IP address with Google's servers. We also use Google Tag Manager to manage optional analytics and advertising cookies, which only load after you accept them via our cookie banner. See our Cookie Policy for more detail.

Your rights

Under UK GDPR, you have the right to access, correct, delete, or restrict the use of your personal information, to object to certain processing, and to request that we transfer your data. To exercise any of these rights, contact us at Contact@hishifa.com. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Security

We take reasonable technical and organisational steps to protect your information against unauthorised access, loss or misuse.

Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page.

Contact us

If you have any questions about this policy or how we handle your information, contact us at Contact@hishifa.com.