Last updated: 19/10/26
1. Who I am
Field Remedies (“me”, “I”, “my”) is a sole-trader herbal medicine practice operated by Marion Mackonochie, providing:
- One-to-one herbal medicine consultations to individual clients (“patients”)
- Consultancy services to businesses in the herbal supplement industry (“business clients”)
Contact details:
- Business name: Field Remedies
- Address: 3 Major Close, Brighton, BN1 7EE
- Email: marion@fieldremedies.com
- Website: www.fieldremedies.com
- ICO registration number: ZA238294
I am the data controller for the personal data described in this policy.
2. What personal data I collect
From patients (individual herbal consultations):
- Contact details: name, email address, phone number, and (for in-person or postal dispensing) home address
- Health information you share with me, including: current complaint and severity, past medical history, allergies, current medication, diet, lifestyle, stress levels, function of body systems, and (for in-person appointments) pulse, blood pressure, and physical examination findings
- Formal diagnoses or test results you choose to share with me
- Payment and invoicing details
- Records of my communications with you (email, text, WhatsApp)
From business clients (consultancy work):
- Contact details and company information
- Communications and documents relevant to the consultancy engagement
- Payment and invoicing details
3. How I use your data and why
| Purpose | What I do | Legal basis |
| Booking and delivering your consultation | Scheduling, preparing for and conducting the session, dispensing herbal preparations | Performance of a contract with you |
| Health record-keeping | Recording consultation notes, tracking progress over time | Explicit consent (special category data) — see Section 4 |
| Dispensing and posting herbal preparations | Sharing your name and address with a courier where needed | Performance of a contract with you |
| Invoicing and accounts | Issuing invoices, keeping financial records | Legal obligation / legitimate interests |
| Following up with you | Sending consultation summaries, advice sheets, and (where introduced) reminders about repeat appointments or preparations running low | Legitimate interests, in your therapeutic interest |
| Responding to your queries between appointments | Email/text/WhatsApp correspondence | Performance of a contract with you |
| Business consultancy work | Delivering the agreed consultancy services | Performance of a contract with the business client |
I do not use your data for marketing communications unless you have separately opted in, and you can withdraw that consent at any time.
4. Special category data (health information)
Because herbal consultations involve information about your health, I rely on your explicit consent to process this data, which I ask for at or before your first consultation. You can withdraw this consent at any time, though this may affect my ability to continue providing you with care, and withdrawal does not affect the lawfulness of anything already done.
5. How I store your data
- Paper consultation notes are stored in a locked filing cabinet at my clinic, accessible only to me.
- Digital communications and records (emails, appointment summaries, advice sheets, invoices) are held in a business Google Workspace account, which is separate from any personal email account and covered by Google’s Data Processing Addendum for commercial use.
I keep your health records for a minimum of 8 years to meet my professional duty of care and insurance requirements. After this period, records are securely destroyed (paper records shredded; digital records permanently deleted).
6. Who I share your data with
I do not sell your data. I share it only where necessary:
- With couriers or postal services, to dispatch herbal preparations to you (name and address only)
- With Google, as my email and document provider, under a data processing agreement
- With my accountant/bookkeeper, for invoicing and tax purposes, where applicable
- With the Information Commissioner’s Office, a court, or another authority, where I am legally required to
- With another healthcare professional, but only with your explicit consent (for example, if you ask me to correspond with your GP)
I do not transfer your data outside the UK/EEA except where a service provider (such as Google) does so under appropriate safeguards, including Standard Contractual Clauses.
7. Your rights
Under UK GDPR, you have the right to:
- Access the personal data I hold about you
- Have inaccurate data corrected
- Have your data erased, in certain circumstances
- Restrict or object to my processing of your data
- Receive your data in a portable format
- Withdraw consent at any time, where consent is the basis for processing
- Complain to the Information Commissioner’s Office (ico.org.uk) if you’re unhappy with how I have handled your data
To exercise any of these rights, contact me at marion@fieldremedies.com. I will respond within one month.
8. Security
I take reasonable steps to protect your data, including keeping paper records under lock and key, using a business-grade email account with two-factor authentication, and limiting access to your information to what’s necessary for your care.
9. Changes to this policy
I may update this policy from time to time. The current version will always be available at www.fieldremedies.com/privacy-policy.
10. Contact us
If you have any questions about this policy or how I handle your data, contact me at marion@fieldremedies.com.