GDPR Compliance Policy

The Wild Sage is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and UK data protection laws. This policy outlines how we comply with GDPR requirements and your rights as a data subject.

We process your personal data under the following legal bases:

• Consent: You have given explicit consent for us to process your health and personal information for specific purposes.
• Contract Performance: Processing is necessary to fulfill our contractual obligations to provide services to you.
• Legal Obligation: We process data to comply with legal requirements, such as maintaining health records.
• Legitimate Interests: Processing is necessary for our legitimate business interests, such as improving our services, provided your rights are not overridden.

As a data subject, you have the following rights:

1. Right to Be Informed

You have the right to be informed about how we collect, use, and share your personal data. This policy and our Privacy Policy provide that information.

2. Right of Access

You have the right to request access to your personal data. You can request a copy of the data we hold about you at any time.

3. Right to Rectification

You have the right to request that we correct any inaccurate or incomplete personal data.

4. Right to Erasure ("Right to be Forgotten")

You have the right to request the deletion of your personal data in certain circumstances, such as when:

• The data is no longer necessary for the purpose it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

5. Right to Restrict Processing

You have the right to request that we restrict processing of your personal data in certain situations, such as when you contest the accuracy of the data.

6. Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

7. Right to Object

You have the right to object to:

• Processing based on legitimate interests
• Direct marketing (including profiling)
• Processing for scientific or historical research purposes

8. Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects.

Health information is considered "special category data" under GDPR and receives enhanced protection. We only process health data when:

• You have given explicit consent
• Processing is necessary for healthcare purposes
• It's required by law

We implement additional safeguards to protect this sensitive information, including encryption, access controls, and regular security audits.

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

• Health Records: Maintained for 8 years after the last consultation, in accordance with professional and legal requirements.
• Account Information: Retained while your account is active and for a reasonable period afterward.
• Marketing Consent: Retained until you withdraw consent or we cease marketing activities.

After the retention period, we securely delete or anonymize your data.

Your data is primarily stored and processed within the UK/EU. If we transfer data outside the UK/EU, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions confirming the recipient country has adequate data protection
• Your explicit consent for the transfer

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR.

To exercise any of your GDPR rights, please:

1. Contact us using the details below
2. Clearly state which right you wish to exercise
3. Provide sufficient information to verify your identity

We will respond to your request within one month. If your request is particularly complex, we may extend this period by two months and will inform you of the extension.

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Tel: 0303 123 1113
Website: www.ico.org.uk