Privacy Policy

Last updated: 11 November 2026

The Acupuncture Hospital is careful with your information. This page explains what we collect, why we use it, who we share it with, how long we keep it, and the rights you have under UK GDPR and the Data Protection Act 2018.

Please read it before you book, pay, or send us an enquiry. If anything is unclear, just get in touch.

1. Who we are

The Acupuncture Hospital is at 3 Nevill Street, Tunbridge Wells, TN2 5RU. The hospital and this website (theacupuncturehospital.com) are run by OriginalMedicine Ltd, a company registered in England and Wales with company number 07729591. The director is Dr Dan Keown.

OriginalMedicine Ltd is the data controller for the information described in this policy. That means we decide how and why your information is used.

We do not have a separate data protection officer. Dr Dan Keown is the person to contact about your information. You can reach him at dan@drdankeown.com or 07875 736955.

2. How to contact us

• Email: dan@drdankeown.com
• Telephone: 07875 736955
• Post: The Acupuncture Hospital, 3 Nevill Street, Tunbridge Wells, TN2 5RU

3. The information we collect

We only collect what we need to book and provide your care, to take payment, to answer an enquiry, or to run the website safely.

When you book online

Bookings are made through the Amelia Booking form on our appointment page. We ask for:

• your first name and last name
• your email address
• your telephone number (this is optional on the form)
• the appointment you choose, including the date, time, service (for example a private appointment or an intern-clinic treatment), duration and fee, and which practitioner the slot is with

We do not ask for medical history or health details on the website form. These booking details — your name, email address, telephone number if you give one, and your appointment — are held electronically in the booking system.

When you book, the appointment is confirmed automatically. We then send you a confirmation email from dan@drdankeown.com. That email includes your appointment details. We do not send marketing emails unless you have asked us to.

There is no patient login on this website. If we add one later, we will update this page.

When you pay

You can pay in these ways:

• at the clinic, by cash or card
• by card in the Amelia booking form, which uses Stripe
• through a separate Stripe Payment Link on the appointment page
• by bank transfer to our Metro Bank account in the name of Original Medicine Ltd

If you pay by card, Stripe collects the card details and the information needed to take the payment. In the booking form Stripe is also set to collect a billing address. We do not see or store your full card number. Stripe’s own privacy notice applies to the information it holds as part of taking the payment.

If you pay by bank transfer, our bank will show the name, reference and amount that appear on the payment.

If you pay at the clinic, we will keep a simple written record of the payment against your appointment (for example the amount, the method and the date).

When you enquire about a course

The diploma, conversion-course and postgraduate pages include an enquiry form. That form is set up to collect:

• your name
• your email address
• a short message about what you would like

You can also email us. Course enquiries are read by Dr Dan Keown only. We will use the name, email and message you send to reply to your enquiry. We will not add you to a marketing list just because you enquired.

When you email or telephone us

If you contact us by email or phone, we will keep the contact details and the content of the conversation for as long as we need to deal with your request and, if you become a patient, as part of your record.

When you come for treatment

At your appointment we write a paper clinical record. There are no electronic patient notes. The paper notes are likely to include:

• your date of birth, address and emergency or GP contact details, if you give them to us
• your medical history, current symptoms, medicines and other treatments
• findings from the consultation and examination
• the treatment given, including acupuncture points, and how you respond
• any advice we give you, and a note that you gave your consent to treatment

This is special category data under UK GDPR (health data). We treat it as confidential clinical information and keep the paper notes securely at the hospital. We do not keep an electronic copy of these patient notes. We ask for your verbal consent before treatment.

If you are seen in the intern clinic

The intern clinic is a teaching clinic. You will be treated by a student intern, always under the supervision of Dr Keown. People under 16 are not seen in the intern clinic.

That means the intern who is treating you, and Dr Keown, will see the booking and clinical information needed to provide your care. Interns are required to keep that information confidential.

Photographs

We rarely use patient photographs. If we ever use a photograph of you on this website, we will only do so with your written consent.

Children and young people

We do treat people under 18 in private appointments with Dr Keown. People under 16 are not seen in the intern clinic.

If we treat a person under 18, we will also collect the parent or guardian’s name and contact details. For a person under 16, we obtain parent or guardian consent before treatment. We keep children’s records for a longer period (see “How long we keep your information”).

Information collected automatically when you use the website

The site is a WordPress website hosted by Hostinger. Like most websites, the server may record technical information such as your IP address, browser type, the pages you visit and the date and time of the visit, in order to run and secure the site. We keep this only for as long as it is needed for that purpose.

We do not use Google Analytics, a Facebook pixel, Mailchimp, or similar marketing-analytics tools on this site.

Some pages load tools from other organisations, which may collect information or set cookies. These are described in the cookies section below.

4. Why we use your information, and our lawful bases

We use your information for the following reasons. The lawful bases are those in UK GDPR.

To book, confirm, change or cancel an appointment, and to contact you about it. We use your name, email, phone number if you gave one, and the appointment details. The lawful basis is that this is necessary to take steps at your request before a contract, and to perform the contract for your appointment.

To take and record payment. The lawful basis is the contract for your appointment or course, and, for our accounts, our legal obligation to keep financial records.

To reply to a course or other enquiry. The lawful basis is our legitimate interest in responding to people who have asked us a question, or, if you are applying for a place, steps towards a contract for the course. We will not add you to a marketing list just because you enquired.

To provide acupuncture and related care, to keep clinical records, and to supervise intern treatments. The lawful basis for ordinary details (such as your name and appointment time) is the contract for your care, and our legitimate interest in running a safe clinic. For health information (special category data), we also rely on the condition that this is necessary for medical diagnosis and the provision of health care, by a professional who is subject to a duty of confidentiality. That care includes treatment by a supervised intern where you have booked the intern clinic. We also ask for your verbal consent to treatment (and, for a person under 16, parent or guardian consent). That treatment consent is separate from the lawful basis we rely on to hold health information.

To defend legal claims and meet professional or insurance requirements. We may need to keep and, if necessary, share records if there is a complaint, a claim, or a request from a regulator. The lawful bases are legitimate interests and, where it applies, a legal obligation. For health information, this may also be necessary for the establishment, exercise or defence of legal claims.

To run, secure and improve the website. The lawful basis is our legitimate interest in keeping the site working. Please see the cookies section for the tools loaded on the site.

We do not use your information for automated decision-making or profiling that has a legal or similarly significant effect.

5. Who we share your information with

We do not sell your information. We only share it where we need to, as follows.

• Dr Dan Keown, and, if you are seen in the intern clinic, the intern who treats you, for your care and for supervision.
• Hostinger, which hosts this WordPress website and the Amelia booking database.
• Stripe, if you pay by card, to process the payment. Stripe has its own privacy notice at stripe.com.
• Our bank (Metro Bank), if you pay by bank transfer.
• Our email provider, when we send or receive email, including appointment confirmations from dan@drdankeown.com.
• Professional advisers, such as an insurer, accountant or solicitor, if they need the information to advise us or to handle a claim.
• The NHS, your GP or another practitioner, but only if you ask us to, or if we need to share information to protect someone’s vital interests, or if the law requires it.
• The police, a regulator or a court, if we are legally required to do so.

Course enquiries are read by Dr Dan Keown only.

If you click a link or use an embedded map, video or presentation, the provider of that service (for example Google, Vimeo or Prezi) will receive information in the usual way, such as your IP address and the fact that you visited our page. Their own privacy notices apply to what they then do with it.

6. Where your information is stored, and transfers abroad

Your booking details (your name, email address, telephone number if you give one, and your appointment) are held electronically in the Amelia booking system on our Hostinger-hosted WordPress site. Clinical notes are paper only. There are no electronic patient notes.

Some of the organisations we use may store or access information outside the United Kingdom. In particular:

• Hostinger is based in the EEA and also uses a content network that can serve pages from other countries
• Stripe, Google (maps and fonts), Vimeo, Prezi and, if applicable, our email provider may process information in the United States or other countries

Where a transfer goes outside the UK, we rely on the UK’s adequacy regulations where they apply (for example for the EEA), or on another lawful safeguard such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses used by that provider.

7. How long we keep your information

We keep information only for as long as we need it.

Clinical records, and the booking and payment notes that sit with them. We keep adult clinical records for seven years from the date of the last appointment. That is the usual minimum in UK acupuncture practice.

For a child or young person under 18, we keep the record until their 25th birthday, or for seven years after the last appointment, whichever is later. That is also the usual approach in UK acupuncture practice: professional guidance is to keep a minor’s record until they are 25 (seven years after they turn 18). In practice, for anyone last treated under 18, the later of those two dates will be their 25th birthday.

If a record is needed for a complaint, a claim or a legal obligation, we will keep it for as long as that requires.

Course enquiries that do not lead to a place on a course. We keep these for 12 months from our last contact with you.

Student or intern records, if you join a course. We keep them for the duration of the course and for six years afterwards, in line with usual UK record-keeping for contracts and accounts.

Accounts and payment records. We keep these for six years after the end of the financial year, which is the usual period for UK company and tax records.

Emails that are not part of a clinical or student record. We keep them for 12 months after the matter is closed, unless we need them for longer.

Website server logs. For as long as they are needed to run and secure the site.

Cookies. For the lifetime of each cookie, as set out below.

When we no longer need information, we will delete it or, if it is a paper record, securely destroy it, or irreversibly anonymise it.

8. Cookies

This website does not set its own (first-party) cookies when you visit it, and we do not show a cookie banner.

Some pages include tools from other organisations. Those tools may set their own cookies on your device when they load, or when you use them:

• Google Maps — on the homepage, the Find an Acupuncturist page and the Contact page. Google may set a cookie (for example one called NID, which can last about six months) when the map loads.
• Vimeo — videos on the Health Tips page. Vimeo, or Cloudflare which helps deliver the player, may set a short-lived security cookie (typically about 30 minutes).
• Prezi — presentations on the Student Area page. Prezi may set cookies, including a security token (typically about a year) and a longer-lived identifier.
• Cloudflare, via a Hostinger script — a script from our host, Hostinger, loads on every page. That request may set a short-lived Cloudflare security cookie (often called __cf_bm, typically about 30 minutes), which is used to tell people and automated traffic apart.
• Stripe, when you pay — if you pay by card, Stripe may set cookies to help prevent fraud (often including one that lasts about 30 minutes and one that can last about a year). Those cookies are set by Stripe, not by us.

The site also loads typefaces from Google Fonts on every page. In our checks those font files did not set cookies, but Google will still receive the request, which typically includes your IP address.

If you log in as a member of staff, WordPress or the booking system may set a login cookie. Ordinary visitors are not asked to log in, and we do not set those cookies on a normal visit. We do not use Google Analytics, a Facebook pixel, or similar marketing-analytics tools.

You can block or delete cookies in your browser settings. Look for Privacy, Cookies or Site settings, or visit the help pages for Chrome, Safari, Firefox or Edge. You can usually block only third-party cookies, which will often stop these maps, videos and other embeds from setting cookies while still letting you use the rest of the site. If you block all cookies, maps, videos or card payments may not work as expected.

9. How we look after your information

We take reasonable technical and organisational steps to keep your information secure. The website is served over HTTPS. Paper clinical records are kept securely at the hospital. Access to booking and clinical records is limited to people who need it for your care, for supervision, or to administer the clinic. Interns are expected to keep patient information confidential.

No internet transmission or storage can be guaranteed as completely secure. If we ever become aware of a breach that puts your rights at risk, we will report it as the law requires and, where needed, we will tell you.

10. Your rights

Under UK GDPR you have the following rights, in the circumstances the law sets out:

• Access — you can ask for a copy of the information we hold about you.
• Rectification — you can ask us to correct information that is inaccurate or incomplete.
• Erasure — you can ask us to delete your information in some situations. This right does not always apply to clinical records, which we may need to keep for professional, legal or insurance reasons.
• Restriction — you can ask us to limit how we use your information in some situations.
• Objection — you can object to our using your information where we rely on legitimate interests.
• Data portability — where we are processing information by contract or consent, and it is held in a structured electronic form, you can ask us to provide it to you or to another organisation. This may apply to electronic booking details. It will not usually apply to paper clinical notes.
• Withdraw consent — if we are relying on your consent (for example to use a photograph on this website), you can withdraw it at any time. This does not affect anything we did before you withdrew it.

We will not charge a fee for most requests, and we will reply within one month, or we will explain if we need a little longer.

To use any of these rights, contact us using the details above. We may need to check your identity first.

11. How to complain

If you are unhappy with how we have used your information, please contact us first and we will try to put it right.

12. Changes to this policy

We may update this page from time to time, for example if we change the booking form, the tools on the website, or the law. The “last updated” date at the top will change when we do. Please look back now and then if you use the site regularly.