Privacy Promise & Data Notice

Last Updated: September 2026

I, Emma Schade-Stylli, operating as a registered herbal medicine practitioner and end-of-life doula, am committed to protecting your privacy and treating your personal and health information with the utmost respect and confidentiality. This policy outlines how I collect, use, store, and protect your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Questions or Requests?

Email: emma@emmaschadestylli.com

1. What Information Do I Collect?

  • Personal & Contact Details: When you book a session, sign up for my newsletter, purchase products, or enquire, I collect details such as your full name, email address, phone number, and delivery address.

  • Special Category (Health) Data: To provide safe integrative care, End-of-Life Care Plans (EoLCP), and bespoke herbal formulations, I collect sensitive health information. This includes your medical history, current symptoms, pharmaceutical medications, primary care team details, and practical care preferences.

  • Financial Information: Payment details are processed securely through established third-party payment processors (e.g., Stripe, PayPal). I do not store full credit card details on my private systems.

  • Website Technical Data: When you browse my website, basic technical details are collected automatically, such as your IP address, browser type, and usage patterns (via cookies).

2. Why Do I Collect Your Information & Legal Basis

I process your data under the following legal bases:

  • Fulfilment of Contract: To deliver the consultations, Care Mapping Sessions, End-of-Life Care Plans, and Comfort Care Parcels you request.

  • Special Category Condition (Explicit Consent & Healthcare): Explicit consent provided on your Client Agreement and Intake Form allows me to process sensitive health data safely to formulate herbal remedies without pharmaceutical interactions.

  • Legitimate Interests: To maintain website security, provide responsive ad-hoc client support, and manage professional practice administration.

  • Legal & Regulatory Obligations: To comply with UK tax laws, accounting rules, and standard clinical record-keeping protocols mandated by professional bodies (Association of Master Herbalists and End of Life Doula UK).

  • Protecting Vital Interests: In rare emergency circumstances where it is necessary to protect life or prevent serious harm.

3. Who Do I Share Your Data With?

I value your trust and never sell or trade your personal information. Data is shared strictly on a need-to-know basis with:

  • Essential Service Providers: Secure platforms that enable my practice to run, including trusted payment gateways, website hosting, digital signature software (Google Workspace), and trackable postal couriers (Royal Mail). All providers adhere to strict UK GDPR security standards.

  • Emergency Medical Services: In cases of acute deterioration where emergency care is required, relevant health information may be shared with your GP, district nurse, hospice team, or NHS emergency services (111/999) in line with your care consent.

  • Legal Requirements: If required to do so by the laws of England and Wales, a court order, or a regulatory body.

4. How Long Do I Retain Your Data?

Personal and health records are stored securely for as long as necessary to fulfil care delivery and satisfy legal and professional requirements:

  • Standard Practice Records: Consultation notes, health histories, and herbal formulation records are retained for 7 years following the conclusion of care (in line with UK professional practitioner guidelines).

  • Minors (Under 16): Health records for individuals under 16 are retained for 7 years after they reach the age of majority (age 18).

  • Financial Records: Invoice and payment data are retained for 6 years to satisfy HMRC accounting requirements.

  • Mailing Lists: Newsletter subscription data is kept until you choose to unsubscribe or request deletion.

5. Data Security & Storage

I take strong physical and digital measures to protect your information:

  • Digital records and emails are stored using password-protected, encrypted systems (such as Google Workspace with two-factor authentication).

  • Paper records and sensitive clinical notes are kept in locked, secure storage.

  • I am registered with the Information Commissioner’s Office (ICO) as a data controller.

6. Your Data Rights

Under UK data protection law, you have the right to:

  • Access: Request a copy of the personal or health data I hold about you.

  • Rectification: Request corrections to any incomplete or inaccurate information.

  • Erasure ("Right to be Forgotten"): Request deletion of your data (subject to legal or regulatory record retention mandates).

  • Restriction & Objection: Ask to limit or object to how I process your information.

  • Data Portability: Request a transfer of your data to another provider in a structured, common format.

To exercise any of these rights, please contact Emma Schade-Stylli at emma@emmaschadestylli.com.

7. Complaints

If you have any questions or concerns about how your data is handled, please contact me first so I can address them. If you remain unsatisfied, you have the right to lodge a formal complaint with the UK supervisory authority:

Information Commissioner’s Office (ICO)

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Website: www.ico.org.uk | Helpline: 0303 123 1113