GDPR Policy & Procedure

Introduction

This policy explains how Arcturus Clinic (“we”, “us”, “our”) collects, uses, stores, shares, and protects your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We respect your privacy and are committed to handling your information fairly, lawfully, and transparently. This policy applies to all personal data processed by the clinic, including through our website, booking systems, clinical records, and communications.

Who We Are

Arcturus Clinicis the data controller of the personal information we collect.
Our contact details:
Arcturus Clinic, 47 Fore Street, Totnes, Devon, TQ9 5NJ, UK
Clinic email: reception@arcturusclinic.co.uk

If you have questions about this policy or how we use your data, you can contact our Data Protection Lead at the above address or by email.

What Personal Information We Collect

We may collect and hold:

• Contact details (name, address, phone, email)
• Appointment and treatment information
• Medical and health history provided by you or a      referring professional
• Billing and payment details
• Communications you send to us
• Website usage data such as IP address and cookies (where applicable)

This may include special category data such as details about your health, medical history, or therapies you receive.

How and Why We Use Your Data (Purposes)

We collect and use your personal data for the following purposes:

Healthcare Services

To provide, manage, and coordinate your clinical consultations and treatments.

Communication

To contact you regarding appointments, test results, reminders, or information you have requested.

Administration

To manage records, billing, payments, complaints, or queries.

Legal Requirements

To comply with legal, regulatory, or professional obligations that we are subject to.

Your data will only be used where there is a lawful basis under UK GDPR, including:

• Performance of a contract (e.g., providing healthcare services)
• Legal compliance
• Legitimate interests where appropriate
• Necessary for healthcare provision (including therapy and clinical assessment)

Special Category Data

Health information is treated as special category data under UK GDPR and is processed only where necessary for healthcare provision, diagnosis, or treatment, with appropriate safeguards in place.

How We Share Your Data

We do not share your personal data with third parties unless:

• You have given explicit consent
• We are required to by law
• It is necessary to provide healthcare (e.g., with      other practitioners involved in your care)
• We use trusted service providers for administrative      purposes (e.g., booking systems) with data-processing agreements in place

We will never sell your personal data.

How Long We Keep Your Data

We retain personal data only as long as necessary for the purposes we collected it, in line with legal, professional, and clinical requirements. This typically includes retention of clinical records and communications for a defined period after the end of treatment.

Your Rights Under UK GDPR

You have the right to:

• Access your personal data (Subject Access Request)
• Correct inaccurate information
• Request erasure where there is no lawful basis to retain it
• Restrict or object to processing
• Request data portability
• Withdraw consent where processing is based on it

To exercise your rights, contact us using the details above.

You also have the right to complain to the Information Commissioner’s Office (ICO) if you believe your data rights have been breached.

ICO Contact:
Phone: 0303 123 1113
Website: https://ico.org.uk/

Data Security

We use appropriate physical and technical measures to protect your data from unauthorised access, loss, or misuse. This includes secure record storage, controlled access for staff, and regular review of security practices.

Changes to This Policy

We may update this policy from time to time in response to changes in legislation or how we process data. The date of the most recent update will be shown at the top of this document.

How to Contact Us

If you have any questions about this policy or want to exercise your rights, please contact:

Data Protection Lead
Arcturus Clinic
47 Fore Street, Totnes, Devon, TQ9 5NJ, UK
reception@arcturusclinic.co.uk

Telephone: 01803868282