Oct 6, 2026 · @Fiona

This notice explains what personal information I hold about you, why I hold it, how I keep it safe and what your rights are. It applies to everyone who books with or attends Aroma Therapie Suite, including In Her Prime, reflexology, aromatherapy massage, facial treatments, health talks and wellbeing workshops.

It is written in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, and with the confidentiality and record-keeping standards of the NMC Code.

1. Who I am

I am Fiona Brown RN, a Registered Nurse on the Nursing and Midwifery Council (NMC) register, and the founder of Aroma Therapie Suite, a nurse-led women's health and wellbeing practice. I am the data controller for the information in this notice, which means I decide how it is used and I am responsible for protecting it.

As a registered nurse I am bound by the NMC Code: Professional standards of practice and behaviour for nurses, midwives and nursing associates. I am also a member of the British Menopause Society (BMS), and I deliver In Her Prime in line with my BMS training in CBT for hot flushes and night sweats and with NICE guideline NG23 (Menopause). I am a registered member of the Association of Reflexologists (AoR) and an associate member of the International Federation of Aromatherapists (IFA), and I follow their codes of practice.

Contact

Details

Name

Fiona Brown RN, Aroma Therapie Suite

Address

34 Agharan Road, Dungannon, BT71 4HG

Telephone

07809 227715

Email

aromatherapie-suite@outlook.com

Website

aromatherapie-suite.com

ICO registration number

ZC146879

I am a sole practitioner, so any question about your information comes directly to me.

2. What information I collect and why

I collect only what I need to assess you safely, provide your care, and run my appointments. Most of it comes directly from you, at booking, at your consultation and during your treatment or programme.

Information

Examples

Why I need it

Contact and booking details

Name, address, date of birth, phone, email, appointment history, payments

To book and confirm appointments, send reminders, take payment and contact you about your care

Health information (special category data)

Medical history, current medicines, menopause symptoms, contraindications, GP details

To check a treatment or programme is safe and suitable for you, and to signpost you elsewhere if it is not

Assessment and care records

Consultation forms, symptom scales (for example the Greene Climacteric Scale and Hot Flush Rating Scale), treatment notes, outcomes

To plan and record your care, measure progress, and meet my professional duty to keep clear, accurate records

Programme and workshop records

In Her Prime attendance, session notes, feedback forms

To deliver the programme as trained, review how it is working for you and improve my service

Website and email data

Enquiry forms, newsletter sign-up, basic website usage via cookies

To answer enquiries and, only if you choose, send you news and offers

In group sessions, everyone is asked to keep what others share in the group confidential. Your own workbook, diaries and logs are yours to keep; I only record what you choose to share with me.

When I deliver talks or programmes for an employer or community organisation, I do not share your individual health information with them. If they ask for feedback, I give only anonymous, combined figures (for example, numbers attending).

3. My lawful basis for using your information

Data protection law requires me to have a lawful basis for each use of your information, plus an additional condition for health information.

Purpose

Lawful basis (UK GDPR Article 6)

Condition for health information (Article 9)

Assessing you and providing your treatment or programme

6(1)(b) contract: you have asked me to provide a service

9(2)(h) provision of health care, with DPA 2018 Schedule 1, Part 1, paragraph 2 (health or social care purposes), under my professional duty of confidentiality as an NMC registrant

Keeping records for the required period and dealing with any complaint or claim

6(1)(c) legal obligation and 6(1)(f) legitimate interests

9(2)(h) as above, and 9(2)(f) legal claims

Sharing in an emergency or to protect someone from serious harm

6(1)(d) vital interests or 6(1)(f) legitimate interests

9(2)(c) vital interests, or DPA 2018 Schedule 1 safeguarding conditions

Sending news, offers and newsletters

6(1)(a) consent

Not applicable: no health information is used

Where I rely on consent, you can withdraw it at any time without it affecting your care.

4. Confidentiality and who I share information with

I treat everything you tell me as confidential, as the NMC Code requires. I do not sell your information, and I do not share it with anyone without your consent except in the limited situations below.

• Your GP or another health professional: only with your agreement, for example if I recommend you seek medical advice. If I am concerned about a symptom, I will discuss it with you first.

• To protect you or others: if I believe you or someone else is at risk of serious harm, I may need to share relevant information with the appropriate service, such as your GP or a safeguarding team. Where it is safe to do so, I will tell you first.

• Where the law requires it: for example a court order, or if requested by a regulator such as the NMC.

• My professional insurer or legal adviser: only if needed to deal with a complaint or claim.

• People who help me run my practice: such as booking, payment, email and IT providers, and any administrative support I use. They act only on my instructions, under written agreements that require them to keep your information confidential and secure. They do not have access to your clinical records unless strictly necessary.

5. How long I keep your information and how I protect it

I keep your care records for 8 years after your last appointment, in line with the Department of Health (Northern Ireland) records disposal schedule, Good Management, Good Records. This also covers my professional insurance, which requires records to be available if a claim is made.

Record

How long I keep it

Adult care and treatment records

8 years after your last appointment

Records of anyone treated under 18

Until their 25th birthday, or 26th if they were 17 at their last appointment (or 8 years after the last appointment, if longer)

Booking and payment records

6 years, to meet HMRC requirements

Marketing contact details

Until you unsubscribe or ask me to remove them

At the end of the retention period, paper records are shredded securely and electronic records are permanently deleted.

Security. Paper records are kept in a locked cabinet in the studio. Electronic records are kept on password-protected devices and secure, encrypted systems with two-step login. I review my security measures regularly and will tell you, and the Information Commissioner's Office where required, if a breach affects you.

Transfers outside the UK. Some of my service providers, such as my website and email systems, may store data outside the UK. Where they do, I make sure appropriate safeguards are in place, such as UK adequacy regulations (including the UK–US Data Bridge) or the ICO's International Data Transfer Agreement.

6. How I contact you

I will contact you by your preferred method (phone, text or email) about:

• your appointments, including reminders and changes

• your care, including information relevant to your treatment or programme

• news, offers and my newsletter, only if you have opted in

You can unsubscribe from marketing at any time using the link in any email, or by contacting me. This will not affect your appointments or care. My website uses cookies; you can manage your choices through the cookie banner on the site.

7. Your rights and how to complain

You have the following rights over your information. To use any of them, contact me using the details in section 1. I will respond within one month, and there is usually no charge.

Right

What it means

To be informed

To know how your information is used (this notice)

Of access

To ask for a copy of the information I hold about you

To rectification

To ask me to correct anything inaccurate or incomplete

To erasure

To ask me to delete your information. I may need to keep care records for the period in section 5, but I will explain why

To restrict processing

To ask me to limit how I use your information

To data portability

To ask for information you gave me electronically, in a format you can reuse

To object

To object to my using your information in certain ways, including marketing

Automated decisions

I do not make decisions about you by automated means or profiling

If you are unhappy with how I have handled your information, please tell me first, by email, phone or in writing. Under the Data (Use and Access) Act 2025, you have the right to complain directly to me. I will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.

If you remain unhappy, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

If your concern is about my professional practice as a nurse rather than your data, you can also raise it with the Nursing and Midwifery Council.

Please note: if you do not want me to keep records of your health and treatment, I may not be able to treat you safely, as accurate records are a professional requirement of the NMC Code.

I review this notice at least once a year. Last updated: October 2026.

Sources

• The Code: Professional standards of practice and behaviour (NMC)

• UK GDPR guidance and resources (ICO)

• How to deal with data protection complaints (ICO)

• The Data (Use and Access) Act 2025 and the new right to complain to controllers (Squire Patton Boggs)

• Data (Use and Access) Act 2025: changes now in force (Bratby Law)