Privacy Notice
Cecilia B Wellness & Herbs
Version: 1.0
Effective date: August 2026
Review date: August 2027
1. Introduction
Cecilia B Wellness & Herbs is committed to protecting your privacy and ensuring that your personal information is handled securely, confidentially and in accordance with UK data protection legislation.
This Privacy Notice explains how I collect, use, store and protect your personal information when you:
visit my website;
contact me with an enquiry;
subscribe to my newsletter;
book an appointment;
receive herbal healthcare;
purchase services or products.
This Privacy Notice has been prepared in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Who is responsible for your information?
For the purposes of UK data protection law, the Data Controller responsible for your personal information is:
Cecilia Bernardini, trading as Cecilia B Wellness & Herbs, provider of herbalist services and registered with NIMH and ANP.
Email: contact@ceciliabwell.com
Website: www.ceciliabwell.com
If you have any questions about this Privacy Notice or how your information is handled, please contact me using the details above.
3. What personal information do I collect?
The information I collect depends on how you interact with my practice.
Website visitors
When you visit my website, certain information may be collected automatically, including:
IP address;
browser type;
device information;
cookies;
website usage information.
This information helps the website function correctly and helps me understand how visitors use my website.
Contact enquiries
If you contact me through my website, by email or telephone, I may collect:
your name;
email address;
telephone number;
information you provide within your enquiry.
This information is used to respond to your enquiry and arrange services where requested.
Newsletter subscribers
If you choose to subscribe to my newsletter, I collect:
your name (if provided);
your email address;
your newsletter preferences.
Your information is used only to send newsletters and updates that you have chosen to receive.
You can unsubscribe at any time by using the unsubscribe link included in each newsletter.
Clients receiving healthcare
To provide safe and appropriate herbal healthcare, I collect information including:
name;
address;
telephone number;
email address;
date of birth;
GP details where relevant;
medical history;
current health concerns;
symptoms;
medications;
supplements;
allergies;
lifestyle information relevant to your health;
consultation notes;
treatment plans;
herbal prescriptions;
appointment history;
communications relating to your care.
Health information is classified as special category personal data under UK GDPR and receives additional protection.
Payment information
Where you purchase services or products, I process information relating to invoices and payments.
Payment card details are processed securely by the relevant payment provider. I do not have access to or store your full payment card details.
4. How is your information collected?
Information may be collected when you:
visit my website;
complete a website contact form;
subscribe to my newsletter;
book a consultation;
complete health questionnaires;
communicate with me by email, telephone or through Practice Better;
attend a consultation;
make a payment.
5. Why do I use your information?
Your information is used for the following purposes:
to respond to enquiries;
to provide safe and effective herbal healthcare;
to assess your health and develop personalised treatment plans;
to prescribe, dispense and ship herbal medicines;
to maintain accurate clinical records;
to manage appointments and communications;
to obtain functional tests (such as blood or urine) where you have provided consent, through specialised providers;
to supply supplements or other products directly to you on my recommendation through selected companies;
to process payments;
to meet legal, professional and insurance requirements;
to send newsletters where you have provided consent.
Your personal information will not be used for unrelated purposes and will never be sold to third parties.
6. Lawful basis for processing your information
Under UK GDPR, I process your personal information using one or more of the following lawful bases:
Performance of a contract
Processing is necessary to provide the healthcare services you have requested.
Legal obligation
Processing is necessary to comply with legal requirements, including maintaining appropriate records.
Legitimate interests
Processing is necessary for the safe and effective operation of my professional healthcare practice.
Consent
Where required, I rely on your consent, for example when you subscribe to my newsletter.
Because healthcare information is special category personal data, it is processed under:
Article 9(2)(h) UK GDPR – processing necessary for the provision of health care or treatment.
7. Confidentiality and sharing of information
All client information is treated as confidential.
Your identifiable information will only be shared where necessary and appropriate.
This may include:
Practice Better (clinical records and practice management);
Squarespace (website and newsletter services);
payment providers;
professional advisers such as accountants;
professional indemnity insurers where necessary;
your GP or another healthcare professional with your consent;
regulatory or legal authorities where disclosure is required by law.
I may discuss your case anonymously with appropriately qualified healthcare professionals for professional supervision or clinical advice. You will not be identifiable during these discussions.
8. How your information is stored and protected
I take appropriate technical and organisational measures to protect your personal information from:
unauthorised access;
accidental loss;
misuse;
destruction;
disclosure.
Clinical records are maintained electronically using secure, password-protected systems and trusted cloud-based services.
Access to your information is restricted to those who have a legitimate need to process it.
9. Third-party service providers
To operate my practice, I use carefully selected third-party providers who process information on my behalf.
Practice Better
Practice Better is my electronic practice management system.
It is used for:
appointment management;
health questionnaires;
clinical records;
secure communication;
treatment plans.
Practice Better acts as my data processor.
Further information:
https://practicebetter.io/privacy/
Practice Better sub-processors:
https://trust.practicebetter.io/subprocessors
Squarespace
My website and newsletter services are provided through Squarespace.
Squarespace processes information submitted through:
website contact forms;
newsletter subscriptions;
website interactions.
Further information:
https://www.squarespace.com/privacy
Payment providers
Payments may be made through:
bank transfer;
Practice Better online payments powered by Stripe;
NatWest Payit.
Where online card payments are used, payment card details are processed and securely stored by Stripe.
Cecilia B Wellness & Herbs does not have access to or store your full payment card details.
10. International transfers of personal data
Personal data will not be transferred outside the UK without appropriate safeguards in place.
Some service providers I use, including Practice Better, Squarespace and Stripe, may store or process personal information outside the UK.
If data needs to be stored or processed outside the UK, this will only occur where:
the country has been deemed to provide an adequate level of data protection; or
appropriate safeguards are in place, such as approved contractual safeguards under UK GDPR.
Personal data will not be transferred internationally without ensuring compliance with UK data protection law.
11. How long do I keep your information?
In line with professional standards and insurance requirements, clinical records are retained for:
• 7 years from the date of last consultation for adults
• For children: until age 25 (or 26 if aged 17 at end of treatment)
After this period, records are securely deleted or destroyed. In certain cases, such as where records may be relevant to an insurance claim or legal proceeding, they may be retained for longer.
Financial records are retained for the period required by HM Revenue & Customs.
Newsletter information is retained until you unsubscribe.
Website enquiries that do not become clients are retained only for as long as reasonably necessary to respond to your enquiry.
12. Your rights
Under UK GDPR, you have the right to:
request access to your personal information (Subject Access Requests - SAR);
request correction of inaccurate information;
request deletion where applicable;
request restriction of processing;
object to certain processing activities;
request transfer of your information where applicable;
withdraw consent where processing is based on consent.
Please note that some rights may be limited where healthcare professionals are required to retain records for legal or professional reasons.
If you make a Subject Access Request:
• Identity verification will be required before releasing any records;
• An electronic copy of the requested information will be provided free of charge - printed records will be provided only if explicitly requested;
• The information will be supplied within one month of receiving the request;
• Where the request is complex or multiple requests are received, this period may be extended by up to two further months. I will inform you within the initial one-month period if an extension is required;
• If a request is manifestly unfounded or excessive, a reasonable administrative fee may be charged, or the request may be refused where legally permitted;
• If the request relates to a large volume of information, I may ask you to clarify the specific data you require.
13. Cookies
My website uses cookies provided by Squarespace.
Cookies help my website:
function correctly;
remember preferences;
understand how visitors use the website.
When you first visit my website, you will have the opportunity to manage your cookie preferences through the cookie settings provided, or through your browser settings.
14. Children
Where I provide healthcare to children or young people, consent from a parent or legal guardian is required before treatment can begin. Personal information will normally be collected from a parent or person with parental responsibility where appropriate.
Children's information is protected with the same level of confidentiality and care as adult records. The child remains the data subject under data protection law. Both parents may have the right to access the child’s records unless there is a legal restriction or court order in place that limits this access.
15. Reporting breaches
Any breach of this policy or of data protection laws will be reported as soon as practically possible. This means as soon as I become aware of a breach. I have a legal obligation to report any data breaches to UK Supervisory authority (Information Commissioners Officer) within 72 hours.
16. Complaints
If you have concerns about how your personal information has been handled, please contact me first so that I can try to resolve your concerns. I will acknowledge your complaint within 30 days and investigate it in accordance with my data protection complaints procedure.
You also have the right to make a complaint to the Information Commissioner's Office (ICO).
Website:
17. Changes to this Privacy Notice
This Privacy Notice may be updated from time to time to reflect changes in legislation, professional guidance or the way my practice operates.
The latest version will always be available on my website.