The law about how anyone holds and uses your personal data (GPDR 2016/697) is changing from 25th May 2018. This gives more rights to you as an individual and more obligations to me as an acupuncturist holding your personal data. For these purposes, Liz Flood, operating as Traditional Acupuncture, is the data controller. To comply with the new regulations  I need to explain how I take, use and hold information about patients, prospective patients, former patients or visitors to my website  


I comply by keeping personal data up to date, by storing and destroying it securely, by not collecting or retaining excessive amounts of information, by protecting it from loss, misuse, unauthorised access and disclosure and by ensuring technical measures are in place to protect it.



Storage of records:

All data relating to you and your treatment is held on a paper file ONLY and kept in a locked filing cabinet at the practice address, 61 Whitehall Street, Shrewsbury SY2 5AD. I do not hold any computerised records about you or your personal data.

The only data processing I undertake  is my smartphone records of your name, phone number and email for the purposes of contacting you about appointments, follow- up issues or responding to queries. I do not make any other unsolicited attempts to contact you. 

Under new regulations I am legally required to provide your appointment date/time and contact details to the test and trace service if requested. I have registered with the ICO for this purpose.

Occasionally, for the purposes of planning or reviewing your treatment, I transport files in a small rucksack to my home for a short period, then return them to the clinic as above. No one other than Liz Flood has access, or the opportunity to access, personal information I hold.

I do not keep an online diary. All appointments are made using a paper based diary and, aside from your name, no other identifiable information is included. My diary is kept securely either at home or at my clinic.

When you contact me either by phone, email, through the website or Facebook page,  these details are retained in the same format you originally used using secured technology. Ie my phone and laptop are password controlled and no one has either the codes or administrative capacity.

Where enquiries are submitted, I will only use the information supplied to respond to your enquiry.

 I use your personal data for the purposes set out below:

  1.  Your name, address, telephone number and email address are used, at your request, to discuss acupuncture, make and rearrange appointments.

  2. I do not send marketing materials to anyone.  

  3. From 25th May 2018 (the date this policy comes into operation), I will keep a permanent  attendance register which records all appointments for patients attending my clinic for tax purposes and to secure potential evidence in the event of a criminal prosecution, civil litigation, insurance claim or complaint to my regulatory body, the British Acupuncture Council.

  4. I use your presenting complaint and symptoms reported by you for the purposes of making a full traditional diagnosis, formulating treatment strategy and treatment planning.

  5. I use any relevant medical and family history you disclose for making a full traditional diagnosis, formulating treatment strategy and treatment planning.

  6. I use your GP’s name and address in the event that I need to contact your GP including in an emergency and because it is a mandatory requirement in the British Acupuncture Council Code of Professional Conduct. I take your date of birth for the purpose of ensuring your correct identification.

  7. I use my clinical findings about your health and wellbeing for making a full traditional diagnosis and formulating treatment strategy and treatment planning.

  8. I maintain a record of treatment given and your feedback and refer to this to monitor your progress, including reviewing treatment planning, reviewing your diagnosis and treatment strategy and to secure evidence in the event of criminal proceedings, civil litigation, an insurance claim or complaint.

  9. I record any decisions made in conjunction with you to help you to receive the most appropriate treatment and to secure evidence in the event of criminal proceedings, civil litigation, and insurance claim or complaint.

  10. I keep accident records for any patients or visitors who are involved in accidents at my clinic in accordance with UK Health and Safety legislation including the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations (RIDDOR) to comply with the law and to secure evidence in the event of criminal proceedings, civil litigation, an insurance claim or complaint.

  11. In the event of an adverse incident occurring, I report the matter to the British Acupuncture Council to develop its safe practice guidelines as well as providing research data and information for the BAcC’s insurers and other interested parties.

  12. I maintain records of all patient’s consent to treatment (and/or parent/guardian/next of kin if appropriate) in order to prove that I have satisfactorily explain treatment procedures and the patient has consented to treatment to secure evidence in the event of a civil claim, criminal prosecution, insurance claim or consent.

  13. Regarding e-mails, please note that I am unable to send or receive encrypted emails so you should be aware that any emails I send or receive may not be protected in transit. I also monitor emails sent to me, including file attachments, for viruses or malicious software. Please be aware that you have a responsibility to ensure any email you send is within the bounds of the law.



  1. If I was to receive a complaint, I would make up a file containing the details, normally containing the identity of the complainant and any other individuals who may be involved. I would only use this information to process the complaint and check on the level of service provided. I would need to disclose the complainants identity to the British Acupuncture Council and Insurers, unless they objected and it was possible to handle anonymously.  I would keep information retaining to a complaint securely for 2 years from closure, restricting access according to a ‘need to know’ principle.



  1. My website is self-designed using WIX. Com. Search queries and data analytics are rarely analysed and, if so, would be processed only in such a way which does not identify anyone. I would not knowingly permit any web-based company or search engine to make any attempt to find out the identity of anyone visiting my website.

  2. I use to help maintain the security and performance of my website. To deliver this service it processes the IP addresses of website visitors.

  3. I use to host my website  From time to time I may use services that help me collect anonymous information about users activity to help me make ongoing improvements to the information I present. This site also allows visitors to communicate directly with me through providing their name and e-mail address on the site, although anyone is also able to e-mail me directly through

  4. I have a Facebook page Liz Flood: Traditional Acupuncture Shrewsbury and Shropshire.  I am the sole administrator of this page.

  5. From time to time, I put ad-hoc posts designed to communicate issues of interest or illustrate interesting case studies. Please note that any such posts, while representing genuine examples, are for illustrative purposes based on a legacy of treatment experience. They are generally composite examples and no one is identifiable. Anyone wishing me to remove any post has the right to do so at any time.

  6. If I ever wished to promote an issue relating to any specific patient experience, I would request your consent in writing to permit me to do this.



Your personal data will be treated as strictly confidential.  The following reasons are the events when it will be shared:

  • To named third parties only with your consent.

  • With a relevant authority such as the police or a court, if necessary for compliance with a legal obligation to which I am subject, eg a court order.

  • With your doctor or the police if necessary to protect yours, or another persons, life.

  • With the police or a local authority for the purpose of safeguarding children or vulnerable adults.

  • With my regulatory body, the British Acupuncture Council, or my insurance company in the event of a complaint or insurance claim being brought against me.

  • My solicitor in the event of any investigation or legal proceedings being brought against me.

  • For further details about the situations when information about you might be shared, please see the Information Commissioner’s website at



I keep your personal data for no longer than reasonably necessary.

I keep patient records for a period of 7 years in accordance with the British Acupuncture Council Code of Professional Conduct.

In the case of patients under 18 years of age records must be kept until the patient reaches the age of twenty-five (seven years after reaching eighteen).

I keep any information updated at each treatment and periodic reviews, where appropriate,  which I discuss with you face to face at your appointments.

I destroy your personal data through incineration.


Unless subject to an exemption under the GDPR, you have certain rights with respect to your personal data:

  • The right to request a copy of your personal data which I hold.

  • The right to request that I correct anything if it is inaccurate or out of date.

  • The right to request that I provide you with your personal data.

  • The right to be informed if your data is lost.

  • The right to lodge a complaint with the Information Commissioner’s Office.

For further details please see the ICO website at



If I wish to use your personal data for a new purpose not covered by this notice, then I will explain and seek your prior consent.



To exercise all relevant rights, queries or complaints, please in the first instance contact me at:

Liz Flood

Traditional Acupuncture

61 Whitehall Street

Shrewsbury SY2 5AD


Phone: 07434 768034


You can contact the Information Commissioner’s Office on 0303 123 1113 or by email at or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF