Privacy Policy

Last updated: 30 March 2026

This policy explains what personal data The Cupping Clinic Blackburn collects, why we collect it, and what your rights are under UK GDPR and the Data Protection Act 2018.

1. Who We Are

The data controller is The Cupping Clinic Blackburn, a health and wellbeing clinic based in Blackburn, Lancashire.

2. What Data We Collect

2.1 Booking requests (contact form)

When you submit a booking request via our contact form we collect:

  • Full name, email address, phone number
  • Preferred treatment, preferred date and time
  • Any notes you provide about your health goals or concerns
  • Whether this is your first visit

2.2 Online bookings (booking system)

When you complete an online booking we additionally collect:

  • Booking reference number, service chosen, appointment date and time
  • Agreement to our cancellation policy

2.3 Intake forms

New clients complete a health intake form before treatment. This collects:

  • Full name, date of birth, gender, contact details, address
  • Emergency contact name and phone number
  • Reason for seeking treatment, previous treatment history
  • Medical contraindications, current medications, allergies
  • Consents to treatment, data processing, and marketing (separately)
  • A digital signature confirming the above

This is special category health data under UK GDPR and is handled with a higher level of care.

2.4 Analytics cookies

We use privacy-first, cookie-less analytics (based on referrer and page-view data) to understand how our website is used. No personal identifiers are stored. Analytics data is retained in your browser's localStorage only and is never shared with third parties.

3. Legal Basis for Processing

Data type Legal basis
Booking requests & appointments Performance of a contract (Article 6(1)(b) UK GDPR)
Health / intake form data Explicit consent (Article 9(2)(a)) and provision of healthcare (Article 9(2)(h))
Marketing communications Consent (you may opt in on the intake form and withdraw at any time)
Website analytics Legitimate interests (Article 6(1)(f)) — non-identifying, privacy-preserving

4. How We Use Your Data

  • To confirm and manage your appointments
  • To send appointment reminders (email)
  • To assess your suitability for treatment and provide safe, effective care
  • To respond to enquiries and booking requests
  • To send marketing communications (only where you have consented)
  • To improve our website and services (analytics only)

5. How We Store Your Data

Booking and intake data submitted through this website is stored in the following ways:

  • Browser localStorage: A local copy of your booking reference is stored in your browser so you can manage or cancel your appointment. This data stays on your device and is never transmitted unless you use the manage-booking feature.
  • Email (clinic inbox): When you submit a booking or intake form, the details are sent to our secure clinic email address via an encrypted email delivery service (EmailJS). This copy is retained in our inbox and used to provide your care.

We do not operate a cloud database at this time. All intake records are maintained securely in our clinic email system and any local paper/digital records held at the clinic.

6. Retention Periods

Record type Retention period Reason
Health / intake records 7 years from last treatment (adults); until age 25 for minors UK clinical records guidance & potential medico-legal obligations
Booking and contact records 2 years from appointment date Business administration and follow-up care
Marketing consent records Until consent is withdrawn Demonstrating consent under UK GDPR
Analytics (localStorage) 30 days (browser-controlled) Session-level website improvement only

7. Sharing Your Data

We do not sell, rent, or share your personal data with third parties for their own purposes. We only share data in the following limited circumstances:

  • EmailJS (email delivery service) — used to transmit booking and intake notification emails to our clinic inbox. Your data passes through their servers transiently to deliver the message. See EmailJS Privacy Policy.
  • Legal obligation — if we are required to disclose information by law or a court order.
  • Protection of vital interests — in a medical emergency where sharing information is necessary to protect your life or the life of another person.

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

  • Right of access — to request a copy of the personal data we hold about you
  • Right to rectification — to correct inaccurate or incomplete data
  • Right to erasure — to request deletion of your data (subject to our legal retention obligations)
  • Right to restrict processing — to limit how we use your data in certain circumstances
  • Right to data portability — to receive your data in a structured, machine-readable format
  • Right to withdraw consent — at any time, for processing based on consent (e.g. marketing emails)
  • Right to object — to processing based on legitimate interests

To exercise any of these rights, please contact us at hello@thecuppingclinic.uk. We will respond within 30 days.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO):

9. Cookies

Our website uses a strictly necessary session cookie for the cookie consent banner. We do not use advertising or third-party tracking cookies. Our analytics are privacy-first and do not set persistent tracking cookies.

You can clear cookies and localStorage data at any time via your browser settings.

10. Changes to This Policy

We may update this policy from time to time. The "last updated" date at the top of this page will reflect any changes. For significant changes, we will display a notice on our website.

11. Contact Us

For any questions about this policy or your personal data, please contact: