Data Protection Complaints

Last updated: June 2026

This page is for complaints about how Laura the Acupuncturist collects, uses, stores or shares your personal data. If your complaint is about your treatment, an appointment, billing or our service generally, please use our service complaints procedure instead.

Who is responsible for your data

The data controller is Laura Biddle, trading as Laura the Acupuncturist, a sole trader based at 6 Queens Chambers, 61 Boldmere Rd, Boldmere, Sutton Coldfield, B73 5XA. As an acupuncture and Chinese herbal medicine clinic, we hold health information, which is treated as special category data under UK data protection law and given extra protection.

Your rights

Under the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025 you have the right to:

• be informed about how your data is used;
• access the personal data we hold about you;
• have inaccurate data corrected (rectification);
• have your data erased in certain circumstances;
• restrict or object to our processing of your data;
• data portability; and
• complain about how your data has been handled.

Storing your data vs. asking for a copy

These are two different things, and it helps to keep them separate:

• Storage (retention) is how we keep your records safe and for how long. As a healthcare provider we are required to retain clinical records for a set period; how long, and how we protect them, is set out in our Privacy Policy.
• Access is your right to ask for a copy of the personal data we hold about you. This request is called a Subject Access Request (SAR). It is normally free of charge, and we will respond within one month.

Confirming it is really you (identity verification)

Because we hold sensitive health information, we will only release your data once we are satisfied the request genuinely comes from you. We will ask you to confirm your request in writing from the email address or phone number we already hold for you on record. This is for your protection: it stops us from disclosing your health information to anyone trying to obtain it without your permission.

If we need to verify your identity or ask you to clarify your request, the one-month response time pauses ("stops the clock") until you provide what we have asked for. This is permitted under the Data (Use and Access) Act 2025.

Our duty to handle your complaint

Following the Data (Use and Access) Act 2025, we have a duty to make it easy for you to complain and to deal with your complaint directly. We will:

• Facilitate your complaint, including by providing this page and a complaint form;
• Acknowledge your complaint within 30 days of receiving it; and
• Respond to your complaint without undue delay, keeping you updated if a full response will take longer.

How to complain

Email Laura@TheAcu.co.uk with the words "Data protection complaint" in the subject line, or complete and send us the form below. Please tell us what has happened, which of your rights or concerns it relates to, and what you would like us to do.

What happens next

Stage	Timescale
We acknowledge your complaint	Within 30 days
We investigate and respond	Without undue delay
We tell you the outcome and your right to escalate	With our response

Escalating to the ICO

If you are not satisfied with our response, you can complain to the Information Commissioner's Office (ICO), the UK's data protection regulator. We would ask that you give us the chance to put things right first, but you can contact the ICO at any time.

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

See also: Privacy Policy • Service & Treatment Complaints