Privacy Policy

Here you will find information on how we use personal information and how we protect privacy in line with the UK General Data Protection Regulation and the Data Protection Act 2018.

Last updated: 27^th October 2026

1. Who we are

Nether Edge Herbarium is the trading name of Alton & James Ltd, 386 Abbeydale Road, Sheffield S7 1FP. We run the shop, the herbal dispensary, our online shop at traditionalherbalist.com, talks, workshops and courses, and the clinic. We are the data controller for the personal information described in this notice, and we are registered with the Information Commissioner’s Office (ICO), registration number ZA305999.

Our data protection lead is Robyn Soma, Director. You can contact her at robyn@traditionalherbalist.com, on 0114 255 0022, or by post at the address above.

Some practitioners who see clients in our clinic are independent and hire rooms from us. They are responsible for their own client records and will give you their own privacy information. Where they send a prescription to our dispensary, or you book through our booking system, we are responsible for that information as described here.

2. The information we collect

• Contact details: name, address, phone number, email address and date of birth.
• Clinic records: health history, consultation notes, treatment, prescriptions and progress notes. This is health information, which the law treats as special category data and gives extra protection.
• Orders and bookings: what you buy or book, payment and delivery details, and batch numbers of our own products supplied to you.
• Marketing preferences: whether you have asked to receive our newsletter or news of events.
• Complaints and feedback: including any reports of a reaction to a product.
• CCTV images: we have CCTV in the shop for security.
• Website information: see our Cookie Policy.

We collect this information from you when you book or attend a consultation, buy from us in the shop or online, book a talk, workshop or course, sign up to our newsletter, contact us, or visit the shop. With your permission, we may also receive information from your GP or another health professional.

3. How we use it, and our legal reasons

What we use it for	Our legal reason (lawful basis)
Providing consultations and treatment, keeping clinic records, and making up and supplying prescriptions	To provide the service you have asked for (contract). For health information, because it is needed for the provision of health care by a professional who owes you a duty of confidentiality.
Appointment bookings, reminders, follow-up and repeat prescription checks	Contract; and our legitimate interest in providing a well-run service
Processing and delivering orders, and taking payment	Contract
Bookings for talks, workshops and courses	Contract
Keeping tax, accounting and sales records	Legal obligation
Tracing batches of our own products, product recalls, and recording complaints and reactions to products	Legal obligation (food safety law); and our legitimate interest in keeping customers safe
Sending a newsletter and news of events	Your consent. You can unsubscribe at any time using the link in each email or by contacting us.
CCTV in the shop	Our legitimate interest in preventing crime and protecting staff and customers
Dealing with complaints, enquiries and legal claims	Our legitimate interests; and legal obligation

 

We do not make decisions about you using automated means alone, and we do not sell your information.

4. Your clinic records

• With your permission, your practitioner may discuss your treatment with other members of our clinic team where this helps your care.
• With your permission, your practitioner may contact your GP or another health professional. You can withdraw that permission at any time.
• Students from herbal medicine training courses sometimes observe consultations in our training clinics, supervised by their herbalist. We will always ask you first, and you can say no without affecting your care.
• In rare cases, the law allows or requires us to share information without your consent, for example to protect someone from serious harm (safeguarding), or if required by a court or the police. We will only share what is necessary.

5. Who we share information with

We share your information only where needed. We use the following service providers, who process information on our behalf under contracts that require them to keep it secure:

• Herbarial (Herbarial.net Ltd): our dispensary and till system, which practitioners use to send prescriptions to the dispensary;
• Appointedd: our online booking system, for bookings, confirmations and reminders;
• Google: email;
• Dropbox and Google Drive: secure storage of our documents and back-ups;
• our website host (Hostinger) and online shop (WooCommerce);
• card payment and online payment providers (Stripe, Evopayments and GoCardless)
• Royal Mail and couriers, to deliver orders;
• Xero, our accounting software, and our accountants, Claydon Accountancy Ltd.

We may also share information with HMRC, our insurers and professional advisers, and regulators or the police where the law requires.

6. Transfers outside the UK

Some of our service providers (for example Google and Dropbox) may store information outside the UK. Where they do, the transfer is protected by UK adequacy regulations or by approved contract terms, as the law requires.

7. How long we keep it

Information	How long
Clinic records and prescriptions	Kept indefinitely, on the advice of our insurers, because claims can be brought many years after treatment. They are stored securely with restricted access.
Orders, sales and booking records	6 years from the end of the financial year (tax law)
Records of reactions to products	10 years
Complaints	6 years after the complaint is closed
Newsletter and marketing	Until you unsubscribe. We keep your email address on a suppression list so that you are not added again by mistake.
CCTV	Usually 30 days, unless needed to investigate an incident

 

8. Keeping your information secure

Our electronic records are held in secure cloud systems protected by strong passwords and two-factor authentication. Paper records are kept in a locked cabinet. Only people who need to see your information can access it.

Ordinary email is not fully secure. If you would prefer, we can password-protect attachments such as prescriptions or letters; just ask.

9. Children and young people

For clients under 18, we usually communicate through a parent or carer. A young person who is able to understand and make decisions about their own care (Gillick competent) can ask us to keep their information confidential and can exercise their own data protection rights.

10. Your rights

You have the right to:

• ask for a copy of the information we hold about you (free of charge);
• ask us to correct information that is wrong or incomplete (for clinic records, we may add a note to the record rather than changing the original entry);
• ask us to delete your information, or to restrict how we use it, in some circumstances;
• object to how we use your information, and to stop direct marketing at any time;
• ask for information you gave us to be transferred to you or another organisation in a portable format, in some circumstances;
• withdraw your consent at any time, where we rely on consent.

To make a request, contact us using the details in section 1. We will respond within one month, or tell you within that time if we need longer.

11. Complaints

If you are unhappy with how we have used your personal information, please tell us and we will try to put it right. You can complain using our contact form, by email to robyn@traditionalherbalist.com, by post to Data Protection Complaints, Alton & James Ltd, 386 Abbeydale Road, Sheffield S7 1FP, or by speaking to any member of staff. We will acknowledge your complaint within 30 days and let you know the outcome as soon as we can.

You also have the right to complain to the Information Commissioner’s Office or on 0303 123 1113.

12. Cookies

For information about cookies on our website, please see our Cookie Policy.

13. Changes to this notice

We review this notice regularly and will post any changes on this page. The date at the top shows when it was last updated.