Privacy Notice

Last updated: September 2026

Your privacy is important to me. This notice explains how I collect, use and protect your personal information when you visit this website, contact me or book and receive treatment at The Rose Clinic.

Who I am

Rosie Mayhew is responsible for the personal information collected through this website and in connection with treatments provided at The Rose Clinic.

Rosie Mayhew
The Rose Clinic, Hastings
Email: rosiemayhew@gmail.com

For data protection purposes, I am the data controller of your personal information.

Information I may collect

Depending on how you interact with me, I may collect:

  • your name and contact details;

  • appointment and booking information;

  • correspondence you send to me;

  • payment and transaction information;

  • information you provide when purchasing or using a gift voucher;

  • information about your health, medical history, cancer treatment, surgery, symptoms and recovery where this is relevant to assessing your suitability for treatment and providing your care;

  • treatment notes and records relating to appointments; and

  • limited technical information about how you use this website, where this is collected through website cookies or analytics.

I only ask for information that is relevant to providing my services or running my practice.

How I use your information

I may use your personal information to:

  • respond to enquiries;

  • arrange and manage appointments;

  • assess whether treatment is appropriate and safe for you;

  • plan and provide your treatment;

  • maintain appropriate client and treatment records;

  • process payments and administer gift vouchers;

  • contact you about appointments or matters relating to your treatment;

  • meet my professional, insurance, legal and regulatory responsibilities; and

  • operate and improve this website.

I will not sell your personal information to third parties.

Health and medical information

Information about your health is classed as special category personal data under UK data protection law and receives additional protection.

I collect health information only where it is relevant to assessing your suitability for treatment, providing treatment safely and maintaining appropriate professional records.

My lawful basis for using your information

Data protection law requires me to have a lawful reason for using your personal information. The basis I rely upon will depend on why the information is being used and may include:

  • contract – where information is needed to provide a service you have requested;

  • legal obligation – where I am required to retain or use information by law;

  • legitimate interests – where information is reasonably necessary to operate and protect my business and provide my services, provided those interests do not override your rights; and

  • consent – where I have specifically asked you to agree to a particular use of your information.

Where consent is the basis for processing, you may withdraw it at any time.

Sharing your information

I do not routinely share your personal or health information with other healthcare professionals without your knowledge.

I may use trusted third-party service providers to help operate my practice, such as website hosting (Squarespace), appointment booking (Acuity Scheduling), payment processing (PayPal and Monzo), email (Gmail) or other administrative systems. These providers may process personal information on my behalf only where necessary to provide their services.

I may also disclose information where required by law or where there is another lawful reason to do so.

How long I keep your information

I keep personal information only for as long as it is reasonably necessary for the purpose for which it was collected and to meet any legal, professional or insurance requirements that apply to my practice.

Different types of information may therefore be kept for different periods.

When information is no longer required, it will be securely deleted or destroyed.

Keeping your information secure

I take reasonable steps to protect personal information from loss, misuse, unauthorised access or disclosure. Where I use third-party systems to store or process information, I choose reputable providers and use appropriate security measures.

International transfers

Some of the technology providers used to operate this website or manage the practice may process information outside the UK. Where this happens, I will ensure that appropriate safeguards are in place as required by UK data protection law.

Your rights

Depending on the circumstances, you have rights over your personal information, including the right to:

  • ask for a copy of the information I hold about you;

  • ask for inaccurate information to be corrected;

  • ask for information to be deleted in certain circumstances;

  • ask me to restrict how your information is used;

  • object to certain uses of your information;

  • request transfer of certain information; and

  • withdraw consent where I rely on consent to use your information.

If you would like to exercise any of these rights, please contact me using the details above.

You also have the right to complain to the Information Commissioner's Office (ICO) if you are concerned about how your personal information has been handled.

Cookies

This website may use cookies and similar technologies to make the website work and, where enabled, to understand how visitors use it.

Essential cookies may be used where necessary for the website to function. Other cookies, including analytics or marketing cookies, will only be used where the appropriate consent has been obtained.

You can manage your cookie preferences through the cookie settings available on the website.

Changes to this notice

I may update this Privacy Notice from time to time to reflect changes to my services, systems or legal obligations. The date at the top of this page shows when it was last updated.