Privacy Policy
Updated October 2026
Who I am
Innovative Healing: Kaori Murphy, The Hale Clinic, 4 Harley Street, London W1G 9PB. Telephone 07891 573397. Email info@innovativehealing.co.uk.
I am the data controller for the personal information described in this policy, and I'm registered with the Information Commissioner's Office, registration number ZB152334.
Your health information is held on paper only. No health data is stored online, in any booking system, or on any computer.
What information I hold
If you book an appointment, I hold your name, email address, telephone number and appointment history. If you pay online or in the clinic, a record of that payment is held by my payment providers. If you've asked to be kept informed by email, I hold your name and email address for that purpose. When you visit this website, anonymised information about how the site is used is collected through Google Analytics.
Health information
When you arrive for your appointment, I'll ask you to complete a case history form covering your health, diet, lifestyle and any medication or supplements you take. This is special category data under UK GDPR, and I process it on the basis of Article 9(2)(h) — the provision of health care by a practitioner subject to a duty of confidentiality — together with your written consent, which forms part of that same form.
I use this information solely to carry out your session safely and to give you relevant dietary suggestions. I'm the only person who handles these forms. They are not shared with anyone else, including The Hale Clinic, unless you ask me to or I'm required to by law.
Case history forms are kept on paper only. They are never stored on a computer, in cloud storage or in any online system, and are held in a locked cabinet to which I am the only person with access.
Why I hold your information, and on what basis
I hold your contact and appointment details in order to arrange and provide the session you've booked, which is necessary to perform our agreement. I hold payment records to take payment and to meet my obligations to HMRC. I hold health information to provide your session safely, as set out above. I hold email addresses for occasional updates only where you've consented, and you can withdraw that consent at any time.
Who else handles your information
I use a small number of service providers. Each acts as a processor on my behalf and may only use your data for the purpose I've instructed.
Acuity Scheduling (Squarespace Inc.) manages appointment bookings and holds your name, email address, telephone number and appointment history. It holds no health information.
Stripe processes card payments made online. Stripe holds your payment details directly — I never see or store your full card number.
Zettle (PayPal) processes card payments taken in person at the clinic. It operates independently of my booking system and is linked only to my business bank account. Your card details go to Zettle rather than to me.
Wix hosts this website and handles any enquiry forms you submit.
Mailchimp (Intuit Inc.) holds the email addresses of people who have asked to be kept informed. I use it only occasionally, for practical announcements such as a change of clinic location. It holds your name and email address only.
Google Analytics (Google LLC) collects anonymised information about how visitors use this website, such as which pages are viewed and how people arrive at the site. It does not collect your name or contact details and isn't used to identify individual visitors.
I may also share information where I'm legally required to, for example with HMRC, or with my insurer or professional body if a complaint or claim arises.
Some of these providers are based outside the UK. Where that's the case, transfers are made under the UK's approved safeguards — either an adequacy decision, the UK International Data Transfer Agreement, or the UK Extension to the EU-US Data Privacy Framework.
Email updates
I don't send a regular newsletter. I'll only email you if you've specifically asked to be kept informed, and only about practical things such as a change of clinic location. Booking an appointment does not add you to any mailing list, and I never share your details with anyone else for marketing.
You can unsubscribe at any time using the link in any email, or by emailing me at info@innovativehealing.co.uk.
How long I keep your information
Paper case history forms are kept for seven years after your last appointment, in line with professional guidance for complementary healthcare practitioners, after which they are securely destroyed. Booking and payment records are kept for six years after the end of the relevant tax year, as required by HMRC. Email addresses are kept until you unsubscribe.
Keeping your information secure
Paper records are held in a locked cabinet that only I can access. Online systems are protected by the security measures of the providers named above, and access to each is limited to me. If a data breach occurs that is likely to affect your rights, I'll notify you and the ICO where I'm required to do so.
Your rights
You have the right to ask for a copy of the information I hold about you, to have it corrected if it's wrong, to ask for it to be deleted, to object to or restrict how it's used, to ask for it to be transferred to someone else, and to withdraw consent where you've given it. To exercise any of these, email me at info@innovativehealing.co.uk and I'll respond within one month.
Please bear in mind that where I'm legally required to keep records, I may not be able to delete them before the retention period above has passed.
Cookies
This website uses cookies that are necessary for it to function, and analytics cookies that help me understand how the site is used. Analytics cookies are only set if you accept them. You can change your preferences at any time through your browser settings, or by using the cookie banner on this site. Further detail is in my cookie policy.
Links to other websites
This website contains links to other sites, including my booking page and professional register entries. I'm not responsible for their privacy practices, and I'd encourage you to read the privacy notice of any site you visit.
Complaints
If you're unhappy with how I've handled your information, please contact me first so I can try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.