Privacy Policy

Who we are

Dr Ryu Natural Medicine (“we”, “us”, “I”) is a sole-trader natural medicine clinic at Highland House, 165 The Broadway, Wimbledon, London SW19 1NE. We are the data controller for the personal data described in this policy.

• ICO registration number: ZB955106
• Email: info@drryu.co.uk
• Phone: 020 8241 7361

This policy explains what personal data we collect, how we use and protect it, who we share it with, and the rights you have under the UK GDPR and the Data Protection Act 2018.

The data we collect

Depending on how you interact with us, we may collect:

• Identity and contact details — name, email address, mobile/telephone number, postal address, date of birth.
• Health information (special-category data) — your medical and reproductive history, symptoms, test and investigation results, treatment responses, and the clinical notes we make during your care.
• Enquiry information — the details you provide through our enquiry form, including what you are contacting us about and any message you send.
• Online consultation data — if you have an appointment by video: the name you enter when you join, your IP address and connection logs, and any chat messages you type during the call. Documents are not exchanged in the call: they are uploaded to your patient portal. Online consultations are not recorded.
• Payment information — processed securely by our payment provider; we do not store full card numbers.
• Website and technical data — IP address, browser and device information, and information collected via cookies (see Cookies below).

How we collect it

• Directly from you — when you complete our enquiry form, book or attend an appointment at the clinic or online, correspond with us, or make a payment.
• Automatically — when you use our website, through cookies and similar technologies.
• From third parties where relevant — for example, test results from the laboratories we use on your behalf, or reports you ask another clinician to send us.

Our lawful bases for using your data

Under the UK GDPR we rely on the following lawful bases:

• Contract — to provide the consultations, treatment and services you request.
• Consent — for sending you an enquiry response where you have asked us to contact you, and for any optional marketing (which you can withdraw at any time).
• Legitimate interests — to run and administer the practice, respond to enquiries, keep records, and protect the security of our systems.
• Legal obligation — where we must process data to comply with the law (for example, tax and accounting requirements).

Because we process health information, which is special-category data, we additionally rely on:

• UK GDPR Article 9(2)(h) — processing necessary for the provision of health care and treatment, carried out by or under the responsibility of a health professional bound by a duty of confidentiality. This is the only lawful basis on which your clinical record is held.
• UK GDPR Article 9(2)(a) — your explicit consent. We rely on this only where you give separate, specific permission: photography, the use of a testimonial, or optional marketing. Withdrawing that consent stops the activity it covers; it does not affect your clinical record.

How we use your data

We use your data to: respond to your enquiries, and to see, in aggregate, which countries our enquiries come from; assess, plan and provide your care; order and interpret laboratory tests where clinically indicated; arrange and manage appointments; take payment and issue receipts and invoices; keep accurate clinical records; and meet our legal and regulatory obligations. We only use your data for the purposes for which it was collected, or for closely related purposes.

Who we share your data with

We share your data only where necessary, with providers who act as our processors under appropriate contracts:

Provider	Purpose
Pabau	Practice management — booking, clinical records, communications, and our online enquiry forms
Square	Secure card-payment processing
Google	Map display, Business Profile and Reserve with Google bookings, and website analytics
Hetzner Online GmbH (Germany)	Hosting of the server for our own video-consultation system (Nextcloud Talk), which we run ourselves, used for online appointments
Kinsta	Website hosting
Google Workspace	Clinic email — correspondence and enquiry responses
Payhip	Sale and delivery of digital products, where we offer them
Laboratories — e.g. Regenerus, KBMO Diagnostics, Nordic Labs, Genova Diagnostics	Processing functional tests we order on your behalf
Accountant / professional advisers	Meeting our legal, tax and insurance obligations

We may also disclose data where required by law, by a regulator, or to protect the vital interests of you or another person.

We do not sell your data, and we do not use it for automated decision-making or profiling.

International transfers

Some of our providers are based outside the UK. Where your data is transferred internationally, we take reasonable steps to ensure an appropriate safeguard is in place — such as a UK adequacy decision, the UK International Data Transfer Agreement (IDTA), or Standard Contractual Clauses — so your data continues to be protected.

Our video-consultation system is hosted in Germany, within the European Economic Area, which the UK recognises as providing adequate protection for personal data.

How long we keep your data

We keep your data only as long as necessary for the purposes set out above.

• Clinical records (adults) — 8 years after your last treatment.
• Clinical records (patients treated as under-18s) — until the patient’s 25th birthday, or until their 26th birthday if they were 17 when treatment ended.
• Enquiry data that does not lead to treatment — up to 12 months, then deleted.
• Financial and accounting records — 6 years, as required by HMRC.
• Online consultation data on our video system — the consultation room is deleted after each appointment, and with it the name you entered and any chat messages, on the day of the appointment. Connection logs are deleted within 30 days, and backups of the video system are overwritten within 7 days. Anything clinically relevant is added to your clinical record first and kept for the period above.

These periods follow commonly applied UK healthcare practice and our indemnity insurer’s requirements. Even after deletion, data may persist briefly on secure backups before being overwritten.

Keeping your data secure

We use appropriate technical and organisational measures to protect your data, including access controls, secure (encrypted) connections, and reputable providers who maintain their own security standards. Online consultations take place on our own video system: you join through a private link sent only to you, wait in a waiting room until you are admitted, and the call is encrypted in transit. If you suspect any misuse, loss or unauthorised access to your data, please contact us immediately at info@drryu.co.uk.

Your rights

You have the right to: access the data we hold about you; have inaccurate data corrected; have your data erased; restrict or object to our use of it; request portability of data you have provided; and, where we rely on consent, withdraw that consent at any time. To exercise any of these rights, email info@drryu.co.uk. We may need to verify your identity before we respond, and we will normally reply within one month.

These rights are not absolute. In particular, we cannot delete a clinical record on request: health records must be retained for the periods set out above in order to provide continuing care, to meet professional and insurance requirements, and for the establishment or defence of legal claims. The UK GDPR recognises these as exemptions from the right to erasure. Withdrawing consent to optional processing — such as marketing — does not affect the retention of your clinical record.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk. We would, however, appreciate the chance to address your concerns first.

Cookies

Our website uses cookies to make the site work and to understand how it is used. Non-essential (analytics) cookies are set only with your consent, which you can manage at any time. For full details, see our Cookie Policy.

Marketing

We do not currently operate a newsletter or mailing list. If we introduce one, it will be opt-in only: you would have to ask to receive it, every message would carry an unsubscribe link, and you could opt out at any time.

Changes to this policy

We may update this policy from time to time. The current version is always available on our website, and the “last updated” date above shows when it was last revised.