Plain-English policy
Privacy notice
This page explains what happens when you contact the clinic or follow an external booking, map or messaging link.
Last updated: 21 July 2026. The controller is AXONIS LTD trading as Sincerity Cupping Clinic, 330 Streatham High Rd, London SW16 6HH.
Personal data we may handle
Contact and booking information can include your name, telephone number, email address, chosen service, appointment time, booking details, messages and any clinic note made from a call. Safety and consultation information is health information you expressly supply privately for appointment safety. Financial records can include payment and invoice information. Complaint records contain ordinary correspondence and records needed to investigate and answer a complaint. Legal-claim records contain information needed for legal advice or to establish, exercise or defend legal rights. Technical logs can include an IP address, browser information, requested page, date and time.
The contact form prepares an email through a mailto link in your own email application. It does not submit the form to a database on this website. If you send the prepared message, your email provider and the clinic's Google/Gmail account handle it.
What we use, why and our lawful bases
| Data flow | What happens and why | Lawful basis |
|---|---|---|
| Email enquiries | A mailto link opens your email app. A message you choose to send reaches the clinic's Gmail account so we can answer and take the next steps you request. |
Article 6(1)(b): steps at your request before a contract or contract performance. |
| Phone enquiries | Your telephone or telecom provider connects the call and handles the number and call metadata. The clinic uses the call, and any necessary clinic note, to answer an enquiry or for appointment administration. | Article 6(1)(b): steps at your request before a contract or contract performance. |
| Fresha bookings | Fresha receives your contact details, chosen service, appointment time and booking details for booking and appointment administration. | Article 6(1)(b): contract steps or contract performance. |
| Consultation safety information | Health information is handled only when it is expressly supplied for appointment safety during a consultation. | Article 6(1)(b): contract steps or contract performance. As special category data, Article 9(2)(a): explicit consent. |
| Financial records | Payment, invoice and required accounting records are kept to meet tax and accounting duties. | Article 6(1)(c): legal obligation. |
| Complaints | Ordinary contact, booking, payment and correspondence records may be used to investigate and answer a complaint. We do not reuse consultation health information merely because a complaint is made; a separate valid Article 9 condition is required before special category data can be used. | Article 6(1)(f): legitimate interests in fair complaint handling, balanced against your rights. |
| Legal claims and advice | Relevant records are used only where necessary for legal advice, actual or prospective proceedings, or to establish, exercise or defend legal rights. | Article 6(1)(f): legitimate interests in obtaining legal advice and handling legal claims. Where special category information is necessary for that purpose, Article 9(2)(f). |
| Cloudflare security logs | Cloudflare may process IP address, request, browser and time information to deliver and protect the website, detect abuse and investigate security events. | Article 6(1)(f): our legitimate interests in reliable, secure website delivery, balanced against your rights. |
| WhatsApp messages | WhatsApp and Meta handle messages you choose to send so the clinic can answer an enquiry or administer an appointment. | Article 6(1)(b): contract steps or contract performance. |
What is needed and what is optional
Contact details, chosen service and appointment time are needed to arrange and administer an appointment. The general enquiry form also needs the marked contact fields and a message so your email application can prepare a usable enquiry.
Do not send detailed health information by email, WhatsApp or Fresha. Provide necessary health information privately during the consultation, or through an approved private channel the clinic identifies to you. You decide whether to provide it and whether to give explicit consent to its use for appointment safety. Declining necessary in-person safety questions may mean the clinic cannot proceed with the appointment safely.
Special category data and legal claims
Health information is special category data. Appointment-safety processing uses Article 6(1)(b) for contract steps or contract performance and Article 9(2)(a) when you give explicit consent. You may withdraw that consent at any time, without making earlier processing unlawful. That consultation consent does not cover complaint handling. An ordinary complaint uses Article 6(1)(f); if its handling genuinely needs health information, we require a separate valid Article 9 condition, such as separate explicit consent under Article 9(2)(a), and otherwise omit, restrict or delete that information. Legal advice, actual or prospective proceedings, and establishing, exercising or defending legal rights use Article 6(1)(f) and, only where special category information is necessary, Article 9(2)(f). Article 9(2)(f) is not the clinic's general basis for consultation information.
Providers and external links
- Fresha provides booking and appointment administration. Do not enter health information there. Read Fresha's global privacy policy.
- Google/Gmail provides the clinic email account. Google Maps is an external directions service; Google Maps receives technical information only when you choose a directions link. Read Google's UK privacy policy and international data-transfer frameworks.
- WhatsApp/Meta carries messages you choose to send. Do not send health information there. Read the WhatsApp privacy policy for the UK.
- Cloudflare provides website delivery and security services and may handle the technical logs described above. Read Cloudflare's privacy policy and its published customer data-processing terms.
- Telephone or telecom provider connects calls and handles call-routing data under its own privacy information. The particular provider may depend on the caller and network.
Depending on the service and contract, a provider may act as our processor or as a separate controller. We may also disclose relevant data to professional advisers, insurers, regulators, law-enforcement bodies or courts where needed for advice, an actual legal claim or a legal obligation.
Retention
We keep each category only until its stated end criterion is met. A record moves to the complaint, legal-claim or financial category only when that separate purpose genuinely applies:
- Email, WhatsApp and phone enquiries: until the enquiry is answered and any requested follow-up is complete. A clinic-created call note follows the enquiry criterion. Call-routing records held by a telephone provider follow that provider's published lifecycle.
- Fresha booking records: until the appointment is completed or cancelled and the booking, refund and payment administration is closed.
- Consultation safety information: until the appointment and any directly related safety follow-up are complete. It is not moved into an ordinary complaint record automatically; if separate complaint consent or the legal-claims condition applies, the relevant complaint or legal-claim criterion below governs that necessary copy.
- Financial records: until the statutory financial-record period has ended.
- Complaints: until the complaint response and any agreed follow-up are complete. Special category information received without a valid Article 9 condition is omitted, restricted or deleted.
- Legal claims and advice: until legal advice, proceedings or legal rights no longer require the record and any applicable period for establishing, exercising or defending those rights has ended.
- Cloudflare security logs: until the security event is closed and the log is no longer needed for detection, investigation or defence, subject to Cloudflare's service lifecycle.
Provider backup or deletion cycles can finish later under the provider's own documented schedule. You can ask which criterion currently applies to a particular record.
Security
This website is static and its contact form does not create a website database. Booking and message data instead sit in the provider services described above, so security also depends on the website hosting environment, those providers, the clinic's service accounts and the devices used to access them. No website, device or communications service can be made completely secure.
International transfers
Processing outside the UK may occur under each provider's official notice or terms. Fresha describes mechanisms including adequacy rules, an IDTA or UK Addendum; Google publishes its international transfer frameworks; WhatsApp's UK notice describes adequacy decisions, an IDTA and UK Addendum; and Cloudflare publishes arrangements including the UK-US Data Bridge where eligible and contractual safeguards otherwise.
A restricted transfer is permitted only where a valid UK transfer mechanism applies. The relevant route depends on the provider, service and destination. Ask us for the relevant safeguard details or a copy that can lawfully be provided.
Your data protection rights
Depending on the circumstances, you may have rights of access, rectification, erasure, restriction, portability, and the right to object. Where processing relies on consent, you can withdraw consent. A right may be limited by an exemption or by the lawful basis being used. We may need enough information to confirm your identity and understand the request.
Questions and complaints
Contact AXONIS LTD trading as Sincerity Cupping Clinic at sincerityruqyah@gmail.com, call 07552 540000, write to 330 Streatham High Rd, London SW16 6HH, or use the contact page.
You can also complain to the Information Commissioner's Office. See the ICO's guide to making a data protection complaint.
Static websiteNo form database
Clear choicesExternal services are labelled
100+ public reviewsPublished on independent platforms
Open daily10:00–19:00