Privacy Policy for The Sage Apothecary

Last Updated: June 2026

​

At The Sage Apothecary, we take your privacy seriously. This policy explains how we collect, store, use, and protect your personal information. It also details your choices regarding your data.

​

We are registered with the Information Commissioner's Office (ICO) under registration number ZB469108

​

Who We Are and What We Control

 

The Sage Apothecary acts as the Data Controller for any information you submit directly to our website or during consultations with our primary Medical Herbalist.

​

Independent Therapists & Room Rentals Notice

​

Please note that other holistic therapists rent treatment rooms from our physical premises.

​

• Website Bookings: If you book an appointment with an independent therapist through our website, we only collect your name, email address, and telephone number to facilitate the booking slot.

• Separate Responsibility: Once your booking is confirmed, that independent therapist is solely responsible for their own data protection compliance. The Sage Apothecary does not hold, see, or manage any of their treatment plans, clinical notes, or personal health records. You must request a copy of your specific therapist’s individual privacy policy for details on how they manage your care records.

​

The Information We Collect

 

We collect different types of data depending on how you interact with us:

​

• Website Bookings: Name, email address, and phone number.

• Online Shop Customers: Billing address, shipping address, name, phone number, and order history.

• Newsletter Subscribers: Email address.

• Medical Herbalist Patients: Detailed medical histories, lifestyle notes, current medications, custom herbal treatment plans, and voice recordings or text transcriptions from your consultations.

​

Why We Use Your Information (Lawful Basis)

 

Under the UK GDPR, we must have a valid legal reason to hold your data:

​

• For Shop Orders and Bookings: We process your data to fulfill a contract (e.g., mailing out your handmade skincare or supplements, or confirming your appointment).

• For the Newsletter: We only send you emails if you give us your explicit consent by opting in. You can click "unsubscribe" at any time.

• For Herbalist Patient Notes & Consultations: Because medical history and health details are classified as sensitive Special Category Data, we process this information specifically for the provision of health or social care or treatment. 

​

How Your Data is Stored and Secured

​

We use trusted, industry-standard systems to keep your information safe:

​

• Patient Notes & Cloud Storage: Final clinical records for medical herbalism clients are stored digitally in Apple iCloud. This data is fully password-protected, encrypted, and fortified with Two-Factor Authentication (2FA).

• Consultation Audio & Transcripts: We use PLAUD (a note-taking and transcription service) to record and transcribe our consultations. PLAUD is fully GDPR-compliant. All voice data and text transcripts are fully encrypted during transit and at rest. Furthermore, PLAUD is contractually bound to never use our patients' data or audio files to train AI models.

• Website & Storefront: Our website is built on the Wix platform, which keeps client bookings and account details secure.

• Payments: All digital financial transactions are handled securely via Stripe. The Sage Apothecary never sees, processes, or stores your credit card details.

• Newsletters: Our mailing list is delivered safely through Mailchimp.

​

How Long We Keep Your Data

 

• Shop and Financial Records: Stored for 6 years to comply with UK tax authorities (HMRC).

• Medical Herbalist Clinical Notes: In accordance with UK medical record guidelines, consultation notes and their corresponding transcripts are kept securely for a minimum of 8 years after your last treatment. If the patient is a child, files are kept until their 25th birthday.

​​

Your Legal Data Rights

 

You have the right to request a copy of the data we hold about you, ask us to fix mistakes, or ask us to delete information we no longer have a legal requirement to keep.

 

The 30-Day Complaint Process

​

In accordance with the Data (Use and Access) Act 2025, you have a formal right to complain directly to us about how your data is handled.

​

If you submit a data protection complaint to us:

​

1. We will acknowledge your complaint within 30 days of receiving it.

2. We will investigate the issue and provide a full response without undue delay.

3. To file a privacy complaint or data query, please email us directly at: hello@thesageapothecary.com

​

If you are unsatisfied with our response, you retain the right to escalate your complaint directly to the Information Commissioner's Office (ICO).