Privacy Policy

Last updated: 20 September 2026

This policy explains what personal data The Cupping Clinic Blackburn collects, why we collect it, and what your rights are under UK GDPR and the Data Protection Act 2018.

1. Who We Are

The data controller is The Cupping Clinic Blackburn, a health and wellbeing clinic based in Blackburn, Lancashire.

2. What Data We Collect

2.1 Booking requests (contact form)

When you submit a booking request via our contact form we collect:

  • Full name, email address, phone number
  • Preferred treatment, preferred date and time
  • Any notes you provide about your health goals or concerns
  • Whether this is your first visit

2.2 Online bookings (booking system)

When you complete an online booking we additionally collect:

  • Booking reference number, service chosen, appointment date and time
  • Agreement to our cancellation policy

2.3 Intake forms

New clients complete a health intake form before treatment. This collects:

  • Full name, date of birth, gender, contact details, address
  • Emergency contact name and phone number
  • Reason for seeking treatment, previous treatment history
  • Medical contraindications, current medications, allergies
  • Consents to treatment, data processing, and marketing (separately)
  • A digital signature confirming the above

This is special category health data under UK GDPR and is handled with a higher level of care.

2.4 Website analytics

We use two analytics tools, and they work differently:

  • Vercel Web Analytics — counts visits and page views. It sets no cookies and stores nothing on your device. Visitors are distinguished using a temporary identifier worked out from your IP address and browser, which is discarded and regenerated each day, so you cannot be recognised from one day to the next. This runs for every visitor.
  • Google Analytics 4 — shows us which pages are read, where visitors arrived from, and whether they went on to book. It does set cookies, and sends your activity on this website to Google, who process it on our behalf and who are based outside the UK. This runs only if you accept analytics cookies, and you can withdraw that at any time in section 9 below.

Neither tool is given your name, email address, phone number, or anything you enter on the intake form.

3. Legal Basis for Processing

Data type Legal basis
Booking requests & appointments Performance of a contract (Article 6(1)(b) UK GDPR)
Health / intake form data Explicit consent (Article 9(2)(a)) and provision of healthcare (Article 9(2)(h))
Marketing communications Consent (you may opt in on the intake form and withdraw at any time)
Website analytics — cookieless visit counts Legitimate interests (Article 6(1)(f)) — no cookies, nothing stored on your device, no identifier that lasts beyond the day
Website analytics — Google Analytics cookies Consent (Article 6(1)(a)), given through the cookie banner and withdrawable at any time

4. How We Use Your Data

  • To confirm and manage your appointments
  • To send appointment reminders (email)
  • To assess your suitability for treatment and provide safe, effective care
  • To respond to enquiries and booking requests
  • To send marketing communications (only where you have consented)
  • To improve our website and services (analytics only)

5. How We Store Your Data

Booking and intake data submitted through this website is stored in the following ways:

  • Browser localStorage: A local copy of your booking reference is stored in your browser so you can manage or cancel your appointment. This data stays on your device and is never transmitted unless you use the manage-booking feature.
  • Email (clinic inbox): When you submit a booking or intake form, the details are sent to our secure clinic email address via an encrypted email delivery service (EmailJS). This copy is retained in our inbox and used to provide your care.

We do not operate a cloud database at this time. All intake records are maintained securely in our clinic email system and any local paper/digital records held at the clinic.

6. Retention Periods

Record type Retention period Reason
Health / intake records 7 years from last treatment (adults); until age 25 for minors UK clinical records guidance & potential medico-legal obligations
Booking and contact records 2 years from appointment date Business administration and follow-up care
Marketing consent records Until consent is withdrawn Demonstrating consent under UK GDPR
Analytics (localStorage) 30 days (browser-controlled) Session-level website improvement only

7. Sharing Your Data

We do not sell, rent, or share your personal data with third parties for their own purposes. We only share data in the following limited circumstances:

  • EmailJS (email delivery service) — used to transmit booking and intake notification emails to our clinic inbox. Your data passes through their servers transiently to deliver the message. See EmailJS Privacy Policy.
  • Legal obligation — if we are required to disclose information by law or a court order.
  • Protection of vital interests — in a medical emergency where sharing information is necessary to protect your life or the life of another person.

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

  • Right of access — to request a copy of the personal data we hold about you
  • Right to rectification — to correct inaccurate or incomplete data
  • Right to erasure — to request deletion of your data (subject to our legal retention obligations)
  • Right to restrict processing — to limit how we use your data in certain circumstances
  • Right to data portability — to receive your data in a structured, machine-readable format
  • Right to withdraw consent — at any time, for processing based on consent (e.g. marketing emails)
  • Right to object — to processing based on legitimate interests

To exercise any of these rights, please contact us at hello@thecuppingclinic.uk. We will respond within 30 days.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO):

9. Cookies and your choice

Your answer to the cookie banner is kept in your browser's local storage so that we do not ask again. That is not a cookie, and it never leaves your device.

If you accept, Google Analytics sets cookies that recognise you on return visits. If you decline, no analytics cookies are set. Our cookieless visit counting (section 2.4) runs either way and stores nothing on your device.

We do not use advertising cookies, and we do not sell or share your data with advertisers.

Change your mind at any time. Clear this site's data in your browser settings and the banner will appear again.

Withdrawing removes the Google Analytics cookies already on your device, and brings the banner back so you can choose again. You can also clear cookies and local storage yourself at any time through your browser settings.

10. Changes to This Policy

We may update this policy from time to time. The "last updated" date at the top of this page will reflect any changes. For significant changes, we will display a notice on our website.

11. Contact Us

For any questions about this policy or your personal data, please contact: