Privacy notice

We are Right Remedy Ltd, a private homeopathic clinic trading as Natural Health Care. The clinic is run by Dr Muhammad Siddiq and has been established at 98 Forth Street, Pollokshields, Glasgow G41 2TB since 1995.

For the purposes of UK data protection law, Right Remedy Ltd is the data controller — the organisation that decides what information is collected and how it is used. This means we are responsible for what happens to your information.

We collect three kinds of information.

Personal information you provide to us

• your name
• contact details — telephone number, email address, postal address where you give it to us
• the date and time of your appointments
• the reason you have contacted the clinic

Information about your health

This is treated as a special category under data protection law and gets a higher level of protection. It includes:

• the conditions you discuss with us
• treatments we recommend or provide
• consultation notes the practitioner takes during and after your visit

We do not collect your date of birth, your National Insurance number, or your payment card details. Payment for consultations is taken in cash or by card on the day of your appointment; no payment information is processed through our systems.

Information about your visit to our website

• a small number of essential cookies needed for the site to work — we don't use tracking cookies, and we don't share information with advertisers or analytics providers
• if you submit our contact form, the information you give us in that form

We use your information to:

• arrange and manage your appointments
• send you confirmation messages and (where you ask for them) appointment reminders
• keep clinical records of the consultations you have with the practitioner
• meet our record-keeping obligations under tax law and professional standards
• respond to questions or requests you send us through the website

We do not use your information for marketing. We do not sell your information to anyone.

UK data protection law requires us to identify a "lawful basis" for processing your personal information. We rely on the following.

For your name, contact details and booking information

Article 6(1)(b) of the UK GDPR — contract. Processing this information is necessary for us to provide the consultation services you have asked for.

We also rely on Article 6(1)(c) — legal obligation for the part of our processing that involves keeping records to meet HMRC retention requirements and our professional record-keeping obligations.

For information about your health

Article 9(2)(a) of the UK GDPR — explicit consent. Health information is treated as a special category under data protection law and needs a stronger lawful basis. The first time you attend the clinic, we will ask you to read this privacy notice and sign a paper consent form, agreeing that we may collect and hold information about your health for the purpose of providing your care.

You can withdraw your consent at any time — see Section 8.

We use a small number of carefully selected service providers to run our booking system, our website and our email. These providers process information on our instructions only — they don't use your information for their own purposes. We have written agreements with each of them under Article 28 of the UK GDPR.

We don‘t share your information with anyone else. We don't pass information to advertisers, insurers, or any third party not listed above.

If we are required by law to disclose information — for example, in response to a court order — we will do so, and we will tell you if we are legally allowed to.

Most of our service providers are based in the UK or the European Union. Switzerland, where our email provider Proton is based, has been recognised by the UK government as offering an adequate level of data protection, so transfers there don't need any additional safeguards.

Where any processing happens in the United States — for example, on Cloudflare's or Vercel's edge network — the transfer is covered by the UK International Data Transfer Agreement, or by the EU Standard Contractual Clauses with the UK Addendum. These are legal mechanisms approved by the UK government to make sure your information is protected to UK standards even when it leaves the country.

We keep your records for seven years after your last consultation. For patients who were children when they attended the clinic (under 18 at the time of consultation), we keep records until the patient's 25th birthday. These periods reflect guidance from the Homeopathic Medical Association (UK) and our retention obligations under tax and professional standards.

Once a record reaches the end of its retention period, it is securely destroyed: paper records are shredded, and digital records are permanently deleted from our systems.

If you ask us to delete your record sooner, we will consider your request — see Section 8.

Under UK data protection law you have the following rights. To exercise any of them, please contact us using the details in Section 11.

• Right of access. You can ask us for a copy of the personal information we hold about you. We will respond within one month.
• Right to rectification. If any of the information we hold is inaccurate, you can ask us to correct it.
• Right to erasure.You can ask us to delete your information. We may need to keep some information to meet legal record-keeping obligations, but we'll explain this when you ask.
• Right to restrict processing. You can ask us to stop using your information for particular purposes while we sort out a query.
• Right to data portability. Where we process your information based on your consent, you can ask for it in a machine-readable format that you can take to another provider.
• Right to object.Where our processing is based on legitimate interests, you can object. We don't currently rely on legitimate interests, but the right is here for completeness.
• Right to withdraw consent.Where our processing is based on your consent — including the consent you give for us to process your health information — you can withdraw that consent at any time. Withdrawing consent doesn't make our past processing unlawful, but it stops us continuing to process your information for those purposes (subject to any legal records we have to keep).
• Right to complain to the ICO.If you're not happy with how we've handled your information, you have the right to make a complaint to the Information Commissioner's Office, the UK regulator. See Section 12 for details.

We don't make any decisions about your care using automated processing. Decisions about your treatment are made by Dr Siddiq personally.

Our website uses only essential cookies — small files stored in your browser that are needed for the site to work. We don't use cookies to track you, and we don't share data with any analytics or advertising service.

The first time you visit our site, you'll see a notice telling you about our cookie use. You can dismiss it by clicking "Got it"; we'll record that you've seen the notice in a small cookie of its own, so you don't see it on every page.

We take reasonable technical and organisational measures to keep your information safe. These include:

• two-factor authentication on the practitioner's email and other key accounts
• encryption of all data sent to and from our website (HTTPS)
• keeping patient records in the clinic's own booking system, not on the public website

You can contact us in any of these ways:

• By post: Right Remedy Ltd, 98 Forth Street, Pollokshields, Glasgow G41 2TB
• By telephone: 0141 611 0347 (clinic) or 0755 519 7493 (mobile)
• By email: doctor@drsiddiq.uk

We aim to respond to data-protection enquiries within seven days. If you are exercising one of the rights in Section 8 above, the formal response time is one month.

If you believe we have not handled your information properly, you have the right to complain to the Information Commissioner's Office:

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post:Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

We'd appreciate the chance to put things right ourselves first, but you don't need to contact us before going to the ICO.

We will update this notice when we change how we handle information. The version number and date at the top of the page show the latest version. If we make significant changes — for example, adding a new processor, or changing what information we collect — we will tell affected patients directly.