Botanik Herbs Customer Privacy Notice

This privacy notice tells you what to expect us to do with your personal information.

Contact Details

Post: Annika Bucceri, Foreman & Jones Ltd, 6-8 Bank Street, Hythe, Kent, CT21 5AN, United Kingdom

Telephone: 07407355751

Email: nik@botanikherbs.com

What Information We Collect, Use, and Why

We collect and process the following information:

a) Personal Data

When contacting us or when booking appointments online, we may store your full name, email, address, phone number and other personal data for the purpose of providing adequate treatment and to communicate with you. Such information is only collected from you when you voluntarily submit it to us. We may also use this data to contact you through our newsletter, giving you the opportunity to opt out of this communication if you wish.

b) Digital Information

Digital information data collected when you visit our website, including IP-addresses, browser data, traffic data, social media behaviour, and user patterns. If you subscribe to our newsletter, we may collect data regarding which newsletters you open, your location when opening them and whether you access any links inserted in the newsletters. We use the Digital Information data gathered from visitors to our social media platforms in an aggregate form to help us better design and organise our social media activity.

c) Non-Personal Data

We may use the non-personal, anonymised data gathered from our website to get a better understanding of how the website is used and which pages are of most interest to visitors.

Like most websites we may gather statistical and other analytical information on an aggregate basis of all visitors to our website. This non-personal data comprises information that cannot be used to identify or contact you such as demographic information.

We collect or use the following information to provide services and goods, including delivery:

· Names and contact details

· Addresses

· Date of birth

· Payment details (including card or bank information for transfers and direct debits)

· Health information (including dietary requirements, allergies and health conditions)

· Account information

· Website user information (including user journeys and cookie tracking)

· Photographs or video recordings

· Records of meetings and decisions

· Information relating to compliments or complaints

· Test results, medical correspondence, medical imaging, general medical records

We may also collect or use the following special category information to provide services and goods, including delivery. This information is subject to additional protection due to its sensitive nature:

· Health information

· Sex life information

· Sexual orientation information

We collect or use the following information for the operation of customer accounts and guarantees:

· Names and contact details

· Addresses

· Purchase history

· Account information, including registration details

· Marketing preferences

We collect or use the following information for service updates or marketing purposes:

· Names and contact details

· Addresses

· Marketing preferences

· Purchase or viewing history

· Website and app user journey information

· Records of consent, where appropriate

We also collect or use the following special category information for service updates or marketing purposes. This information is subject to additional protection due to its sensitive nature:

· Health information

We collect or use the following information to comply with legal requirements:

· Name

· Contact information

· Safeguarding information

We also collect or use the following special category information to comply with legal requirements. 

This information is subject to additional protection due to its sensitive nature:

· Health information

We collect or use the following personal information for dealing with queries, complaints or claims:

· Names and contact details

· Address

· Payment details

· Account information

· Purchase or service history

· Relevant information from previous investigations

· Customer or client accounts and records

· Financial transaction information

· Correspondence

We also collect the following special category information for dealing with queries, complaints or claims. This information is subject to additional protection due to its sensitive nature:

· Health information

Lawful Bases and Data Protection Rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

· Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.

· Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.

· Your right to erasure - You have the right to ask us to delete your personal information. Read more about the right to erasure.

· Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.

· Your right to object to processing - You have the right to object to the processing of your personal data. Read more about the right to object to processing.

· Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Read more about the right to data portability.

· Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our Lawful Bases for the Collection and Use of Your Data

Our lawful bases for collecting or using personal information to provide services and goods are:

· Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

· Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

· Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

· Legitimate interest – we are collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

Collecting and using personal information to provide herbal medicine consultations, Reiki treatments, client support, appointment management, record keeping, payment processing, and related administrative activities. This processing is necessary for the effective operation of the practice and to ensure that clients receive safe, appropriate, and continuous care. These legitimate interests do not override the rights and freedoms of my clients.

· Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.

Our lawful bases for collecting or using personal information for the operation of customer accounts and guarantees are:

· Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

· Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

· Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

· Legitimate interest – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

· Processing personal information to respond to enquiries, arrange appointments, provide consultations and treatments, maintain client records, communicate with clients, process payments, and provide ongoing care where requested. This processing is necessary to deliver the services that clients have requested. 

· Processing personal information to manage and operate the practice, maintain accurate records, protect the security of practice systems and records, handle complaints, prevent fraud, and administer the business effectively. Legitimate interests do not override the rights and freedoms of clients. 

· Processing health information for the purpose of providing herbal medicine consultations, treatment recommendations, Reiki sessions, and maintaining appropriate clinical records. Where required, Botanik Herbs relies on explicit consent and/or the provision of health care by a health professional as the relevant condition for processing special category data.

Our lawful bases for collecting or using personal information for service updates or marketing purposes are:

· Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

· Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

· Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

· Legitimate interest – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

· We use personal information to keep clients and subscribers informed about our services, workshops, events, clinic updates, and other information that may be relevant to their interests. We have assessed that these communications are unlikely to have an impact on individuals' privacy, and recipients can opt out of marketing communications at any time.

· Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.

Our lawful bases for collecting or using personal information for legal requirements are:

· Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

· Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

· Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

· Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

· Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

· Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

 
For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above. 

Where We Get Personal Information From

· Directly from you

· Health care providers

· Councils and other public sector organisations

How Long We Keep Information

Personal information will be retained for at least 7 years following the last treatment given. In the case of minors, records will be kept until the client reaches at least the age of 25 (seven years after turning 18). This is in alignment with insurance requirements.

Who We Share Information With

1) Joint Data Controllers

We have a joint controller relationship with Foreman & Jones Ltd. We process your personal information with that joint controller for the use of shared practice and booking software.

2) Data Processors

Ovatu Pty Ltd

This data processor provides cloud-based booking, client management, and payment/sales tracking software. We use it to schedule appointments, store client contact details, manage client records, send appointment reminders and confirmations, and process intake forms completed by clients. It also records sales and spending data relating to client transactions. The system securely hosts and processes this data on our behalf so we can manage our practice efficiently and deliver services to clients.

Skedda

This data processor provides cloud-based room and space booking software that we use to manage the scheduling of clinic rooms and resources. It processes booking information, including names, contact details, appointment times, and related scheduling data, so that we can allocate and manage room usage efficiently. The system securely hosts and processes this data on our behalf.

Others We May Share Personal Information With

· Health care providers

· Organisations we need to share information with for safeguarding reasons

· Insurance companies

· Financial or fraud investigation authorities

· Relevant regulatory authorities

· External auditors or inspectors

· Professional consultants

· Organisations we’re legally obliged to share personal information with

· Emergency services

· Publicly on our website, social media or other marketing and information media

· Debt collection agencies

· Suppliers and service providers

· Accountant/bookkeeper for financial and tax purposes

· Payment processing providers for money transfers and card payments

· Professional advisors such as insurers or legal/regulatory bodies where required

We will only share client information where it is necessary for clients' care, and only with appropriate consent or lawful basis.

Sharing Information Outside the UK

Our data processors may store personal information on servers outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.

Organisation name: Ovatu

Category of recipient: Practice Management Software

Country the personal information is sent to: servers located in Australia, the United States and other international locations

How the transfer complies with UK data protection law: agreed UK GDPR requirements

Organisation name: Skedda

Category of recipient: Booking and Scheduling Software

Country the personal information is sent to: outside the EU with the Data-Processing Agreements (DPAs) they have executed with their sub-processors include the Standard Contractual Clauses where required to ensure data transfer is performed with adequate safeguards.

How the transfer complies with UK data protection law: agreed UK GDPR requirements

Any information given to us - in consultation, orally, in writing, or electronically - will be kept in a secure physical, computer-based or web-based location when not in use. However, no data transmission over the internet can be guaranteed to be 100% secure, and there may be break-ins or human error in relation to physical storage, and you are accepting these risks when you share any personal data with us.

How to Complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to us:

Email: nik@botanikherbs.com

Post:  Annika Bucceri, Foreman & Jones Natural Health Practice , 6-8 Bank Street, Hythe, Kent, CT21 5AN

If you remain unhappy with how we have used your data after raising a complaint with us, you can also complain to the ICO. 

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint

Last updated on 08.06.2026.