Privacy notice

I am Hanaà Prior. I trade as The Priory Room and I run the clinic on my own. There’s no team, no reception desk and no third party handling your information on my behalf, beyond the suppliers listed under who else sees it.

For the purposes of UK data protection law I am the data controller for everything described on this page.

• 29 Haven Road, Canford Cliffs, Poole, BH13 7LE
• hanaa@theprioryroom.com
• 07525 438309

Write to me at that address or email me and it reaches me directly. Nobody else reads it.

This notice covers theprioryroom.com and the enquiries that come through it.

It doesn’t cover the consultation record I take in the treatment room. That record contains health information and is handled under a separate notice. I give it to you in writing before your first treatment, and you can ask for it at any time. The two notices are kept apart on purpose. The website and the treatment room collect very different things, for very different reasons.

The enquiry form

Your name, your email address, your phone number if you give one, and whatever you choose to write in the message box. That’s the whole list.

Please do not send me health information through this website. The form doesn’t ask for your medical history, your medication, your diagnoses or a description of a skin condition. I’d rather you didn’t volunteer any of it here. Health data is special category data under Article 9 of the UK GDPR, and it deserves a more careful route than a web form and an inbox. Tell me you’d like to talk about something and I’ll call you. Or we’ll cover it properly at your consultation.

If you do write something health-related into the box, I won’t ignore it. I’ll move it into your clinical record and delete it from the enquiry, and I won’t reply to it by email.

Server logs

The company that hosts this site keeps short-lived technical logs of requests: an IP address, the page requested, the time, and the browser and device type. I use these only to keep the site working and to see whether it’s being attacked. They aren’t linked to you, and I don’t try to link them to you.

What the website doesn’t collect

• No analytics. No Google Analytics, no heatmaps, no session recording.
• No advertising or social media tracking pixels.
• No non-essential cookies, and so no cookie banner.
• No profiling, and no automated decisions about you.

The cookies page sets that out in full.

UK data protection law requires me to have a specific reason for each use. Mine are:

• Answering your enquiry and arranging an appointment. Article 6(1)(b), steps taken at your request before entering a contract. If you’re asking a general question rather than trying to book, the basis is Article 6(1)(f), my legitimate interest in replying to people who contact my business.
• Keeping the site available and secure. Article 6(1)(f), my legitimate interest in running a website that works and is not being abused.
• Keeping records I am required to keep. Article 6(1)(c), legal obligation. Tax records, and treatment records my insurer requires me to retain.

Where I rely on legitimate interests I have considered whether my interest is overridden by your rights, and concluded it is not: the data is minimal, expected, and used only for the purpose you contacted me for. You can object at any time. See your rights.

I don’t run a marketing mailing list from this website. There’s no newsletter sign-up, no pre-ticked box, and enquiring or booking won’t add you to anything.

If that ever changes it’ll be opt-in only: an unticked box, a plain description of what you’d receive and how often, a record of when and where you consented, and an unsubscribe link in every message that works on the first click.

I don’t sell your information, share it for anyone else’s marketing, or hand it to data brokers. A small number of suppliers process it on my instructions so that the business can function:

• The company that hosts this website, which serves the pages and keeps the technical logs described above.
• My email provider, which delivers and stores enquiries and my replies.
• The booking system. See booking, and the system it runs on.
• My accountant, for invoices and payment records only.

Each is bound by a contract that limits them to acting on my instructions. I’ll also disclose information where the law requires it, for example to HMRC or in response to a court order.

Some of these suppliers operate outside the UK. Where information leaves the UK, the transfer is covered either by UK adequacy regulations or by the International Data Transfer Addendum to the standard contractual clauses.

Appointments are currently taken through Jane, an appointment and clinic-records system operated by Jane Software Inc. When you press a booking link you leave this website. What you type into Jane is governed by Jane’s own privacy policy as well as by mine. I remain the controller of your appointment record, and Jane processes it on my instructions.

If you’d rather not use it, call or email me and I’ll book you in myself.

Open the booking system (opens in a new tab)

• Enquiries that don’t become appointments. Twelve months from your last message, then deleted.
• Client and treatment records. Eight years after your last appointment, including consent records and the answers on your welcome form. This is the period my insurer requires so that a claim can be answered. Where I have treated someone under 18, the record is kept until their twenty-fifth birthday. If you ask me to delete your record while that period is still running, I will tell you so and note your request.
• Invoices and payment records. Six full tax years, as HMRC requires.
• Server logs. A matter of days, then overwritten by the host.

When a retention period ends the record is deleted, not archived indefinitely.

Under the UK GDPR you can ask me to:

• tell you what information I hold about you, and give you a copy;
• correct anything that is wrong or incomplete;
• delete it, where I have no continuing legal reason to keep it;
• restrict what I do with it while a dispute about accuracy is sorted out;
• stop using it where I rely on legitimate interests and you object;
• hand it to you, or to someone else, in a portable format, where the processing is based on consent or contract and is automated.

Where I have asked for your consent for something, you can withdraw it at any time, and withdrawing it doesn’t affect anything done before you did.

Email me and say what you want. I’ll respond within one month, and there’s no charge. I may ask a question to confirm you’re who you say you are. That’s a safeguard for you rather than an obstacle.

The site is served over HTTPS. Enquiries reach an account protected by two-factor authentication. Paper consultation records are kept locked at the clinic and are not taken off the premises. Devices are encrypted and password-protected.

No system is perfect. If a breach happens that’s likely to put your rights at risk, I’ll tell you. And I’ll report it to the Information Commissioner within 72 hours, as the law requires.

This website isn’t aimed at children, and I don’t knowingly collect information about anyone under 16 through it. I treat clients under 18 only with a parent or guardian present, and their consent recorded.

If something about the way I’ve handled your information bothers you, tell me first. It’s usually a misunderstanding I can fix the same day.

You also have the right to complain directly to the Information Commissioner’s Office, and you don’t have to come to me first.

• ico.org.uk/make-a-complaint
• 0303 123 1113
• Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

When this notice changes I’ll update the date at the top of the page. If a change is significant, I’ll say so here rather than quietly editing a sentence. That means a new purpose, a new supplier holding your information, or a shorter or longer retention period.