Legal
Privacy
Policy.
How Yin Rooms collects, uses and protects your personal information.
1
Who we are
Melissa Garland, trading as Melissa Garland Acupuncture, is the data controller for personal information collected through this website and clinical practice.
Yin Rooms
16 Stickle Down, Deepcut, Camberley, Surrey
hello@yinrooms.com
ICO Registration Number: ZB685689
As a data controller, Melissa Garland is responsible for deciding how and why your personal information is used. She is registered with the Information Commissioner's Office (ICO) as required by the Data Protection (Charges and Information) Regulations 2018.
2
What information we collect and why
Enquiries and contact
When you use the contact form on this website, we collect your name, email address and the content of your message. We use this to respond to your enquiry. If you ask about a treatment or the membership, we may also use it to send you relevant information you have requested.
Newsletter and free resources
When you subscribe to Between the Needles or request a Restore Series guide, we collect your first name and email address. Your subscription is managed through Mailchimp (see section 5 on third parties). You can unsubscribe at any time by clicking the link in any email from us.
Workshop bookings
When you register for a Guided Gua Sha workshop or other event, we collect your name and email address to send you joining instructions and any follow-up materials related to that event.
Membership
If you join as a member (Restore, Balance or Transform), we collect your name, email address, billing address and payment information. Payment card details are handled directly by our payment processor and are never stored on our systems.
Clinical treatment
When you book and attend a treatment at the clinic, we collect health and medical information as part of the clinical intake process. This includes your medical history, current health concerns, medications, lifestyle information and any notes from your treatments. This information is necessary to provide safe, appropriate care and is treated with the highest level of care and confidentiality.
Website usage
This website uses essential cookies only (see section 7). We do not use tracking or analytics software at this time.
3
The legal basis for processing your information
Under UK GDPR, we must have a lawful basis for processing personal information. The bases we rely on are:
| Purpose | Legal basis |
|---|---|
| Responding to your contact form enquiry | Legitimate interests (responding to a message you initiated) |
| Sending the newsletter and free resources | Consent (you opted in) and Legitimate interests for existing contacts |
| Workshop registration and follow-up | Contract performance (you registered for the event) |
| Processing membership sign-up and access | Contract performance (your membership agreement with us) |
| Providing clinical treatments and maintaining treatment records | Contract performance; Legal obligation; and under Article 9(2)(h) UK GDPR for special category health data (healthcare provision) |
4
Health information
Health and medical information is classed as special category data under UK GDPR and receives additional protections.
We process your health information on the basis of Article 9(2)(h) UK GDPR, which permits processing where it is necessary for the provision of healthcare. This processing is also subject to professional confidentiality obligations under the rules of the British Acupuncture Council (BAcC), of which Melissa is a member.
Your health information will never be shared with third parties except:
- With your explicit consent (for example, if you ask us to write to your GP)
- Where we are legally required to do so (for example, a court order or safeguarding duty)
- With another treating practitioner where this is necessary for your care and you have agreed
Clinical records are stored securely and separately from marketing and membership data.
5
Who we share your information with
We do not sell your personal information. We share it only with the following trusted third-party service providers who process it on our behalf:
Mailchimp (The Rocket Science Group LLC)
We use Mailchimp to manage our email list and send newsletters. Mailchimp is based in the United States and is certified under the EU-US Data Privacy Framework (extended to the UK). Their privacy policy is available at mailchimp.com/legal/privacy.
WordPress and website hosting
This website is built on WordPress and hosted by GoDaddy. Your data may be stored on servers within the UK or EEA, or in a jurisdiction that provides adequate protections under UK law.
Payment processing
Membership payments are processed by Monzo or Stripe, who handle payment card data in accordance with PCI-DSS security standards. We do not have access to your full card details.
MemberPress
Membership access and content restrictions on this site are managed via MemberPress software, which stores your name, email and membership status within our WordPress installation.
All third-party processors are bound by data processing agreements and are required to handle your information securely and only for the purposes we specify.
6
How long we keep your information
| Type of information | Retention period |
|---|---|
| Contact form enquiries | 12 months from your last contact with us |
| Newsletter subscriber data | Until you unsubscribe, or 3 years of inactivity, whichever comes first |
| Workshop registration data | 12 months after the event |
| Membership records | 6 years after the end of your membership (for financial and contractual obligations) |
| Clinical treatment records | 8 years from the date of your last treatment (or until age 25 if you were a child at the time of treatment), in line with BAcC professional guidance |
After these periods, your information is securely deleted or anonymised.
7
Cookies
This website uses only essential cookies, which are necessary for the site to function. We do not use advertising, tracking or analytics cookies.
| Cookie | Purpose | Duration |
|---|---|---|
| wordpress_* | WordPress session and authentication (only set if you log in as a member) | Session / 14 days |
| wp-settings-* | WordPress user preferences (only for logged-in members) | 1 year |
| memberpress_* | Membership access verification | Session |
Because we use only essential cookies, a cookie consent banner is not required by law. If we introduce analytics or marketing cookies in future, we will update this policy and obtain your consent before setting them.
8
Your rights
Under UK data protection law, you have the following rights. You can exercise any of them by contacting us at hello@yinrooms.com. We will respond within one month.
- Right of access. You can request a copy of the personal information we hold about you (a Subject Access Request).
- Right to rectification. If the information we hold is inaccurate or incomplete, you can ask us to correct it.
- Right to erasure. You can ask us to delete your personal information where there is no longer a lawful reason for us to hold it. Please note that we may be required to retain certain records (particularly clinical records) for a minimum period under professional guidelines or law.
- Right to restriction. You can ask us to limit how we use your information while a query or complaint is resolved.
- Right to data portability. Where our legal basis is consent or contract performance, you can ask for a copy of your data in a structured, machine-readable format.
- Right to object. You can object to us processing your information on the basis of legitimate interests, including for direct marketing. We will stop unless we can show compelling legitimate grounds that override your interests.
- Right to withdraw consent. Where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing that took place before the withdrawal.
There is no charge for making a request. If your request is complex or you make multiple requests, we may ask for more time (up to a further two months) and will tell you if this is needed.
9
How to make a complaint
If you have concerns about how we handle your personal information, please contact us first at hello@yinrooms.com. We take all concerns seriously and will do our best to resolve them promptly.
If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
ico.org.uk/make-a-complaint
10
Changes to this policy
We may update this privacy policy from time to time, for example if we introduce new services, add third-party tools, or if legal requirements change. The date at the top of this page will always show when it was last revised. We will notify active subscribers and members of any significant changes.