01Introduction
This policy explains how Marx Ayur collects, uses, stores and protects your personal information. It covers our website, contact form, telephone and WhatsApp enquiries, appointments, and our Google Business Profiles.
We provide Ayurvedic therapies and treatments at centres in Walsall, Northampton and Southall. We handle personal information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR), as amended by the Data (Use and Access) Act 2025.
02Who we are
Marx Ayur is responsible for your personal information (the data controller). This means we decide how and why it is used. Your information is handled by the centre you contact or visit.
When you contact us through the website, your enquiry goes to the centre you choose or the centre nearest to you.
- Website: https://marxayur.com/
- Privacy questions: call or WhatsApp the centre you dealt with, or use the contact form on our website.
We have not appointed a Data Protection Officer because we are not legally required to. The manager at each centre handles data protection questions.
Our centres
Opening hours: Monday to Sunday, 10:00 AM to 8:00 PM.
03Information we collect
3.1 Information you give us
| How you contact us | What we collect |
|---|
| Website contact form | Name, email address, phone number, subject and your message. |
| Telephone or WhatsApp | Your name, phone number, and anything you tell us in the call or messages. |
| Booking an appointment | Name, contact details, preferred centre, date and time, and treatment requested. |
| Consultation and treatment | Health and lifestyle information you share with our practitioners, and notes of the treatment we provide. |
| Payment | Payment amount, date and method. Card payments are handled by our card payment provider, and we do not store full card details. |
| Google reviews and questions | Your Google profile name and what you post. |
3.2 Health information
Messages, consultations and treatment records may include information about your health. This is special category data under UK GDPR, and we give it extra protection (see Section 6).
Please only include the health details needed for your enquiry. You do not need to share medical history through the website form.
3.3 Information collected automatically
When you visit our website, we may collect device and browser type, pages visited, how you arrived at the site, approximate location (town or region, not exact) and cookie identifiers. See Section 7 for cookies.
04How we use your information
We use your information to:
- Reply to enquiries made by form, phone or WhatsApp.
- Arrange, confirm, change and remind you about appointments.
- Carry out consultations and treatments, and keep treatment records.
- Take payment and keep financial records.
- Respond to Google reviews and questions.
- Understand how our website is used and improve it.
- Meet our legal obligations, and establish or defend legal claims.
We do not sell your personal information. We do not make decisions about you using only automated means.
05Our lawful basis
UK GDPR requires a lawful basis for each use of personal information. Ours are:
| Purpose | Lawful basis (Article 6) |
|---|
| Replying to enquiries | Legitimate interests (responding to people who contact us), or steps you ask us to take before a contract. |
| Booking and providing treatment | Contract. |
| Treatment records | Contract, and legitimate interests (safe, continuous care). |
| Payments and accounts | Legal obligation (tax and accounting law). |
| Responding to Google reviews | Legitimate interests (managing our reputation). |
| Website analytics and advertising cookies | Consent. |
| Promotional messages | Consent. |
| Legal claims | Legitimate interests. |
Where we rely on legitimate interests, we have checked that our interests do not override your rights. You can object at any time (Section 13).
You need to give us your name and a contact number or email to book an appointment. Without them, we cannot confirm or manage your booking.
06Health information
Health information needs an additional condition under Article 9 of UK GDPR. We rely on:
| When | Article 9 condition |
|---|
| You share health details in a website form, email or WhatsApp message | Your explicit consent, given by ticking the consent box on the form or confirming in writing. |
| Consultation and treatment records | Your explicit consent, recorded on your consultation form. |
| Legal claims | Article 9(2)(f), establishing or defending legal claims. |
Only the practitioners and staff who need your health information can access it. You can withdraw consent at any time. Withdrawal does not affect use before that point, and we may still need to keep treatment records for the retention period in Section 12.
Ayurvedic treatment does not replace care from your GP or other medical professional.
07Cookies and analytics
Cookies are small files stored on your device. We only set non-essential cookies after you accept them in our cookie banner. You can change your choice at any time through the cookie settings link on our website.
| Cookie / tool | Provider | Purpose | Type | Expiry |
|---|
| Cookie consent record | Our cookie banner | Remembers your cookie choice | Strictly necessary | 12 months |
| _ga, _ga_(ID) | Google Analytics 4 | Counts visits and measures website use | Analytics, consent required | Up to 2 years |
| _fbp (only when we run Meta ads) | Meta | Measures how our Facebook and Instagram ads perform | Advertising, consent required | 3 months |
Google Analytics keeps event data for 14 months. Google and Meta may also use this data as described in their own privacy policies. If we add other cookies, we will list them here.
08Appointments and communications
You can book or enquire by phone, by WhatsApp, or through our website form. The “Book Appointment” buttons let you contact your chosen centre in one of these ways.
We use your details to send service messages about your enquiry or appointment, such as confirmations and reminders.
We only send promotional offers by WhatsApp, text or email if you have agreed. Every message tells you how to stop them.
WhatsApp is run by Meta and is subject to its own terms and privacy policy.
09Who we share information with
We share personal information only where needed, with:
| Recipient | Why |
|---|
| Our website hosting provider | Hosts our website and contact form. |
| Our email provider | Delivers form submissions and emails to us. |
| Google | Website analytics and Google Business Profiles. |
| Meta (WhatsApp, Facebook, Instagram) | Messaging with you, and measuring our ads. |
| Card payment provider | Processing card payments. |
| Our accountant | Preparing accounts and tax returns. |
Our service providers may only use your information on our instructions. We may also disclose information when required by law, to protect someone’s vital interests, or to establish or defend legal claims.
10International transfers
Some providers, including Google and Meta, may process information in the United States or other countries outside the UK. Where they do, we rely on the UK–US Data Bridge (where the recipient is certified) or the UK International Data Transfer Agreement or Addendum, which give your information equivalent protection. Contact us for details of the safeguard that applies.
11Keeping your information secure
We limit access to staff who need it and protect devices and accounts with passwords. Paper records are kept in locked storage at each centre. Health information gets the strictest access controls.
No system is completely secure. If a breach is likely to put you at high risk, we will tell you without undue delay and report it to the ICO where required.
12How long we keep information
| Information | How long |
|---|
| Enquiries that don’t lead to an appointment | 12 months from last contact. |
| Treatment and consultation records (adults) | 8 years after your last treatment. |
| Treatment records for under-18s | Until age 25, or 8 years after last treatment if later. |
| Payment and accounting records | 6 years after the end of the financial year (HMRC requirement). |
| WhatsApp messages | 12 months, unless part of a treatment record. |
| Analytics data | 14 months. |
| Complaint records | 3 years after the complaint closes. |
After these periods, we securely delete or anonymise your information. We may keep it longer if needed for a legal claim.
13Your rights
You have the right to:
- Access: get a copy of your personal information.
- Rectification: have inaccurate information corrected.
- Erasure: have information deleted, where the law allows.
- Restriction: limit how we use your information.
- Portability: receive information you gave us in a portable format, where it is processed by consent or contract and by automated means.
- Object: object to uses based on legitimate interests, and to any direct marketing at any time.
- Withdraw consent: where we rely on consent, without affecting earlier use.
To use a right, call, WhatsApp or write to the centre you dealt with (Section 2), use the contact form on our website, or tell staff at any centre. Requests are free in most cases. We reply within one month, extendable by two months for complex requests, and we will tell you if we extend. We may ask for proof of identity first.
14Complaints
Complaining to us
If you are unhappy with how we have handled your information, please tell us first so we can put it right. You can complain by:
- The contact form on our website.
- Phone or WhatsApp to the centre you dealt with.
- Post to the centre you dealt with (addresses in Section 2).
- In person at any centre.
We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome without undue delay.
Complaining to the ICO
If you are not satisfied with our response, you can complain to the Information Commissioner’s Office (ICO):
- Website: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
- Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
15Other websites and services
Our website and Google Business Profiles may link to other services, such as WhatsApp and Google Maps. We are not responsible for their privacy practices, so please read their privacy policies.
16Children
Our website is not intended for children, and we do not knowingly collect information from children through it. If a child under 18 receives treatment, a parent or guardian must be present and provides information on their behalf.
17Changes to this policy
We will update this policy when our services, systems or the law change. The date at the top shows the latest version. If we make significant changes, we will highlight them on our website.
18Contact us
For any privacy question or request, use the contact form at marxayur.com, write to the centre you dealt with, or call us:
