Privacy Policy

Duckworth Naturopathic Practice Ltd ("we", "us", "our") is committed to protecting the privacy and confidentiality of every person who visits this website or engages with our clinical services.

This Privacy Policy explains what personal information we collect, why we collect it, how we use it, who we share it with, and the rights you have under UK data protection law — including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Because we provide naturopathic healthcare, some of the information we handle is classified under UK GDPR as special category data (data concerning health). We take this seriously and apply the additional protections required by Article 9 of the UK GDPR throughout our processes.

1. Who we are

Data controller: Duckworth Naturopathic Practice Ltd

Registered address: 12 Morton Avenue, Horsham, West Sussex, RH12 1HS, England

ICO registration number: [To be inserted by Inna]

Contact for privacy queries: office@innaduckworth.com

If you have any questions about this policy or about how we handle your personal data, please contact us at the email address above. We aim to respond to all queries within seven working days.

2. What information we collect

We collect different categories of personal information depending on how you engage with us.

2.1 Information you give us directly

• Your name, email address and telephone number when you make an enquiry or book a consultation.
• Your postal address, date of birth and gender when this is needed for clinical record-keeping or laboratory testing.
• Detailed health information that you share during consultations, including symptoms, medical history, fertility history, medications, supplements, lifestyle, family history and laboratory results. This is special category data under UK GDPR.
• Information about your partner where you have asked us to work with you as a couple. We collect this with the partner's knowledge and consent.
• Payment information processed by our payment provider. We do not store full card numbers on our own systems.
• Any correspondence you send us by email, through our website forms or through our booking system.

2.2 Information collected automatically

• Technical data when you visit our website — your IP address, browser type, device type, operating system, the pages you visit and the time you spend on each page.
• Basic analytics data through our website hosting platform (Vercel). This data is aggregated and helps us understand how the site is used.
• Cookies and similar technologies — see Section 9 below for full details.

2.3 Information from third parties

• Laboratory test results that you have authorised the laboratory to share with us as part of your clinical care.
• Information from healthcare practitioners who have referred you to us, where you have consented to that referral.

3. Why we use your information

We use your personal data for the following purposes, each with a specific lawful basis under UK GDPR.

3.1 To provide clinical care

Lawful basis: Contract (the agreement to provide naturopathic services to you) and, for special category health data, your explicit consent and Article 9(2)(h) — the provision of health care by a health professional.

This includes taking case histories, recommending and interpreting laboratory tests, formulating naturopathic and nutritional protocols, monitoring your progress, communicating with you between consultations, and keeping the clinical records that the General Naturopathic Council and our professional indemnity insurer require us to keep.

3.2 To manage bookings and payments

Lawful basis: Contract and legitimate interest in running our practice efficiently.

We process bookings through Practice Better, a specialised practice management platform for healthcare practitioners. Payment processing is handled by their PCI-compliant payment partners.

3.3 To send you information you have asked for

Lawful basis: Consent.

If you have downloaded a guide from our website or subscribed to our email list, we will send you the requested material and a small number of related educational emails. You can withdraw consent at any time by clicking unsubscribe in any email or by writing to us. Withdrawal does not affect any processing that took place before you withdrew.

3.4 To respond to your enquiries

Lawful basis: Legitimate interest in answering people who contact us.

When you email us or fill in a contact form, we keep that correspondence for as long as is reasonable to respond properly and to maintain a record of what was discussed.

3.5 To improve our website and services

Lawful basis: Legitimate interest in understanding and improving how our website and practice work.

We look at aggregated, non-identifying analytics data to understand which pages people find useful and where the website could be clearer.

3.6 To comply with our legal and professional obligations

Lawful basis: Legal obligation and, for clinical records, Article 9(2)(h) and (i) of UK GDPR.

We are required to keep clinical records, financial records and certain communications for defined periods. These obligations come from HMRC, our professional body and our insurer.

4. Special category data — health information

Information about your health, fertility, mental wellbeing, family history and lifestyle is classified as special category data under UK GDPR. Special category data receives stronger legal protection than ordinary personal data.

We process special category data only when one of the conditions in Article 9 of UK GDPR is met. In our practice, the two conditions that apply are:

• Your explicit consent, given when you register as a client and confirmed at the start of each consultation.
• Article 9(2)(h) — necessary for the provision of health care by a health professional bound by an obligation of professional secrecy.

As a Registered Naturopath, Inna Duckworth is bound by the Code of Ethics of the General Naturopathic Council, which includes a strict duty of confidentiality. All clinical records are kept confidential and are not shared without your specific consent except where required by law (for example, a court order or a serious safeguarding concern).

5. Who we share your information with

We do not sell your personal data. We do not share it with anyone for marketing purposes other than our own. We share information only with the third parties listed below and only for the specific purpose described.

5.1 Practice management platform

Practice Better. We use Practice Better (operated by Optimantra, Inc.) to manage client records, bookings, secure messaging and clinical documentation. Practice Better is HIPAA-compliant and uses bank-grade encryption. It is based in the United States. Data transferred to Practice Better is protected under appropriate safeguards (see Section 7).

5.2 Website hosting and infrastructure

Vercel Inc. Our website is hosted on Vercel, a US-based hosting platform. Vercel processes technical data (IP addresses, request logs) on our behalf as a data processor.

GitHub Inc. The source code for our website is stored on GitHub, a US-based platform. GitHub does not process visitor data — only website code.

5.3 Email and marketing communications

SendPulse. We use SendPulse to send educational emails to subscribers who have given consent. SendPulse processes your email address, your subscription preferences and your interactions with our emails (opens, clicks) on our behalf. SendPulse operates internationally; appropriate safeguards are in place for international transfers.

Google Workspace. Our business email accounts are operated through Google Workspace. Google processes the contents of email correspondence as a data processor.

5.4 Laboratory services

Where your clinical care involves laboratory testing, we will share with the relevant laboratory the information they need to perform the tests you have authorised. Laboratories we work with include but are not limited to those based in the UK, the European Union and the United States. We will tell you which laboratory will receive your sample and any associated information before any test is ordered.

5.5 Other healthcare practitioners

Where you have asked us to do so — for example to coordinate care with your GP, fertility clinic or another practitioner — we will share relevant clinical information with them. We will not do this without your written authorisation.

5.6 Professional advisers and regulators

We may share information with our professional indemnity insurer, our accountants and our solicitors where this is reasonably necessary, and with regulatory bodies (the General Naturopathic Council, the Information Commissioner's Office, HMRC) where we are required to do so by law or by our professional obligations.

6. How long we keep your information

We keep your personal data only as long as we need to for the purpose for which we collected it, and to meet our legal and professional obligations.

Clinical records
In line with the General Naturopathic Council's guidance and standard UK healthcare practice, we keep adult clinical records for a minimum of seven years after the last clinical contact, or longer where there is a clinical reason to do so. For records relating to a pregnancy, we keep them for at least twenty-five years.

Marketing communications
If you have subscribed to our email list, we keep your contact details for as long as you remain subscribed. If you unsubscribe, we keep a suppression record so we do not contact you again unintentionally, but we delete the active record from our marketing platform.

Website enquiries
We keep general email correspondence for up to three years from the date of the last exchange, unless there is a reason to keep it longer.

Financial records
We keep financial records for at least six full tax years, in line with HMRC requirements.

7. International data transfers

Several of the services we use are based outside the UK — including Practice Better (United States), Vercel (United States), GitHub (United States), SendPulse (operates internationally) and Google Workspace (United States and other locations).

When personal data is transferred outside the UK, we rely on one or more of the safeguards permitted under UK GDPR:

• UK adequacy decisions, where the recipient country has been recognised by the UK government as offering an adequate level of protection.
• Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement, where the recipient country has not received an adequacy decision.
• Additional supplementary measures, such as encryption, contractual restrictions and access controls.

If you would like more detail about the safeguards used for any specific transfer, please contact us at office@innaduckworth.com.

8. Your rights under UK GDPR

You have the following rights in relation to your personal data. We will respond to any rights request within one calendar month, although complex requests may take longer (we will tell you if so).

8.1 Right of access

You can ask for a copy of the personal data we hold about you, including your clinical records.

8.2 Right to rectification

You can ask us to correct information that is inaccurate or incomplete.

8.3 Right to erasure

You can ask us to delete your personal data in certain circumstances. Please note that we are required by law and by our professional obligations to retain clinical records for a defined period (see Section 6), and we cannot erase them earlier than that.

8.4 Right to restriction

You can ask us to limit how we use your personal data while a dispute or query is being resolved.

8.5 Right to data portability

Where we process your data based on consent or contract and by automated means, you can ask for a copy in a structured, machine-readable format.

8.6 Right to object

You can object to our processing of your data for direct marketing — we will stop immediately — and to processing based on legitimate interests.

8.7 Right to withdraw consent

Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

8.8 Rights related to automated decision-making

We do not make any decisions about your care or eligibility for our services using automated processing or profiling.

To exercise any of these rights, please email office@innaduckworth.com. We may need to ask you for proof of identity before we can act on your request.

9. Cookies and similar technologies

Our website uses a small number of cookies and similar technologies. We categorise them as follows.

9.1 Essential cookies

These cookies are required for the website to function correctly. They are set automatically and do not require your consent under the Privacy and Electronic Communications Regulations (PECR).

9.2 Analytics cookies

These cookies help us understand how visitors use our website, in aggregate. We use these only with your consent, which we ask for via a cookie banner when you first visit. You can change your preferences at any time.

9.3 Third-party cookies

Some third-party services we use (for example, the embedded booking system from Practice Better) may set their own cookies. We list the providers we use in Section 5; please refer to each provider's own privacy policy for detail on their cookie practices.

10. How we protect your information

We take the security of your personal data seriously. The measures we have in place include:

• All clinical records are stored on Practice Better, a HIPAA-compliant medical records platform with end-to-end encryption.
• Our website is served over HTTPS with TLS encryption.
• Access to client records is restricted to authorised personnel only.
• All staff who handle personal data are trained on confidentiality and data protection.
• Marketing data is held on platforms that comply with UK GDPR and have appropriate technical and organisational measures in place.

If a data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and will tell you directly if the risk to you is high.

11. Children

Our services are intended for adults — typically adults considering, undergoing or recovering from fertility treatment. We do not knowingly collect personal data from children under 18. If we become aware that we have inadvertently collected data from a child, we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practice, the services we use, or applicable law. The date at the top of this document shows when it was last updated.

If we make a significant change — for example, adding a new category of data or a new third-party processor — we will inform you directly where we have your contact details, and we will publish a clear notice on our website.

13. How to complain

If you have any concern about how we handle your personal data, please contact us first at office@innaduckworth.com. We take complaints seriously and will do our best to resolve the matter.

If you remain unhappy, you have the right to complain to the Information Commissioner's Office, the UK's data protection regulator.

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF