top of page
7a5ec8_dae4834deab54124a81b2b3b43fc504b~mv2.png

Privacy Policy

​Last updated: November 2026

At Abuelita’s, privacy isn’t paperwork. It’s part of how we care for you. The information you share with us — your name, your body’s history, what brought you in — is sensitive, and we treat it that way. This policy tells you plainly what we collect, why, where it goes, how long we keep it, and what you can ask us to do with it. If anything here isn’t clear, email us at info@abuelitas.co.uk. We will answer.

​

1. Who we are

Abuelita’s Wellbeing CIC is a Community Interest Company registered in England and Wales, with studios at Hackney Downs and Tileyard Islington.

We are the “data controller” for the information we hold about you — meaning we decide how and why your data is processed, and we’re responsible for looking after it.

  • Email: info@abuelitas.co.uk

  • Phone: 0748 159 2374

  • Data Protection Officer: Simona Ilincariu (Founder Director)

​​

2. What we collect

To work with you safely, we need to know some things about you. In most cases, that is:

  • Your full name, date of birth, and contact details (email, phone, address)

  • Your relevant medical and health history

  • Your clinical notes from each session

  • Your emergency contact

​​

Your preferences, feedback, and anything you choose to tell us about how you’re doing. We don’t collect anything we don’t need. If you’d rather not share something, tell us, and we’ll work out whether we can proceed without it.

​

3. Why we collect it

We use your information to:

  • Deliver safe, appropriate care

  • Decide whether a particular treatment is right for you (and when to refer you elsewhere)

  • Keep in touch about your appointments and your plan

  • Keep accurate clinical records, as we are legally and professionally required to

  • Send you occasional updates and offers — only if you’ve specifically opted in

​

4. The legal reasons we’re allowed to hold your data

Under UK GDPR, we need a lawful basis for processing. Ours are:

  • Your consent — for things like marketing emails, AI-assisted notes, and anything optional

  • Our contract with you — for the actual delivery of your sessions and the records that come with them

  • Our legal obligations — for professional record-keeping, tax and accounting, and safeguarding duties

​​

5. Who sees your data

We don’t sell your data. We don’t share it with anyone who isn’t involved in your care or the running of the business. Specifically, your information is handled by:

  • Your practitioner(s) at Abuelita’s — for your sessions and clinical notes

  • Jane App — our booking and clinical notes platform, which stores your records securely on our behalf

  • Mailchimp — our newsletter platform, but only if you’ve subscribed

  • Our accountant — for financial records, with no clinical detail

​​

Where the law requires it — for example, in a safeguarding emergency, a Police request, or a regulator’s investigation. Each of these is covered by appropriate confidentiality and data-sharing agreements. Everyone who sees your data at Abuelita’s is bound by our Code of Conduct, Data Protection Policy and Safeguarding Policy.

​

6. AI-assisted clinical notes

From January 2027, we use Jane App’s AI Scribe feature during some sessions, with your explicit consent. It listens to the clinical conversation and drafts the clinical note, which your practitioner then reads, edits, and signs off.

  • We will always ask you first, and your consent is captured in writing at intake.

  • You can opt out at any time, for any reason, without explaining — and your practitioner will go back to writing notes by hand.

  • AI Scribe recordings are processed within Jane App’s secure environment and are not used to train any external AI model.

  • The full details of how we use AI Scribe are in our Data Protection Policy and our AI Scribe consent pack, which we are happy to share on request.

​

7. How long we keep it

We keep your records for as long as we need them to look after you properly and meet our legal obligations.

  • Clinical records: 7 years from your last appointment (UK clinical retention standard)

  • Financial records: 6 years (HMRC requirement)

  • Newsletter subscription: until you unsubscribe

  • Website analytics: anonymised and retained per Google’s default settings

​​

After these periods, we securely delete or anonymise your data.

​

8. Your rights

The law gives you real power over your own data. You can:

  • See what we hold about you (a “subject access request”)

  • Correct anything wrong or incomplete

  • Ask us to delete your data, subject to any legal obligation we have to keep it

  • Object to or restrict how we’re processing it

  • Withdraw consent at any time (previous processing remains lawful, but no new processing continues)

  • Receive your data in a portable format so you can take it elsewhere

Email info@abuelitas.co.uk to make any of these requests. We respond within one calendar month, usually faster.

Analytics, a web analytics service provided by Google LLC, helps us understand how visitors use our website and to improve user experience.

​

If you believe we have handled your data badly, you can complain to us first — our Complaints Policy explains how. If you’d rather go straight to the regulator, you can contact the Information Commissioner’s Office (ICO) on 0303 123 1113 or at ico.org.uk.

​

9. How we keep your data safe

We use appropriate technical and organisational measures to protect your data — secure cloud storage (Jane App, Google Workspace), encrypted devices, two-factor authentication on critical accounts, controlled access to clinical records, and written protocols for lost or stolen devices.

The full detail is in our internal Data Protection Policy and Online Safety Policy.

​

10. Cookies and Google Analytics

Our website uses Google Analytics to understand how people find and use us. Google processes website usage data on our behalf to compile anonymised reports — we never see individual user activity.

You can opt out of Google Analytics tracking through your browser settings or by installing the Google Analytics Opt-out Browser Add-on.

Non-essential cookies only load with your consent, through the cookie banner on your first visit.

​

11. Our wider policy library

This Privacy Policy is one of a family of documents that describe how we run Abuelita’s responsibly. The others are available either on our website or on request:

  • Complaints Policy — how to raise a concern and what we’ll do

  • Safeguarding Policy summary — how we keep clients safe

  • Equalities and Diversity Policy — our commitments on access, dignity and inclusion

  • Data Protection Policy — the full internal counterpart to this Privacy Policy

  • Code of Conduct summary — what you can expect from our practitioners

  • Online Safety, Disciplinary and Grievance, Terms of Booking, Whistleblowing, Working Ratios — available on request at info@abuelitas.co.uk.

​​

12. Changes to this policy

We review this policy at least once a year, and sooner when the law changes, or we change how we work. When we update it, the date at the top changes and (where it’s a material change) we tell you by email.

​

Final word

If you’ve read this far, thank you. If something isn’t clear, write to us. We’d rather answer a hundred small questions than have one person feel their data is being handled in the dark.

​

With care,
Simona Ilincariu
Founder Director · Abuelita’s Wellbeing CIC
info@abuelitas.co.uk · 0748 159 2374

​

​

bottom of page