Privacy Policy Last updated: [28th September 2025] Ear Muse Limited (“we”, “our”, “us”) is committed to protecting the privacy and confidentiality of our clients’ personal data. This Privacy Policy explains how we collect, use, store, and protect your information in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and relevant healthcare and regulatory standards. By using our website, you’re agreeing to be bound by this policy. Ear Muse Limited 📄 Companies House Registration: [16588836] 📧 Contact: earmuseltd@gmail.com Ear Muse Limited is a mobile professional ear health and cleaning business. Our services may be hosted at various clinic locations. Clinic details will be published on our website and social media as appropriate. We are the Data Controller of the personal information you provide to us. If you have any questions about this policy, how your data is handled, or if you wish to exercise your data protection rights, please contact our Data Protection Officer (DPO) at: earmuseltd@gmail.com. 2. What Personal Data We Collect We may collect and process the following personal data to deliver our ear cleaning and related healthcare services: Identification details: full name, date of birth, gender, address, telephone number, email address, and (where appropriate) next of kin or lasting power of attorney details. Health and medical information: medical history, ear health and treatment notes, prescribed medications, allergies, and any other information you provide in your medical consent form. Technical data: IP address, device type, and online booking/payment details collected via our service providers (Wix and Timely). 3. How We Collect Your Data We collect personal data in the following ways: Directly from you (in person, via telephone, email, or electronic booking and consent forms). From other healthcare professionals involved in your care (with your consent or where required to support safe treatment). 4. Purpose and Legal Basis for Processing We only process your personal data where legally permitted under UK GDPR and the Data Protection Act 2018: Provision of healthcare services – necessary for medical assessment and ear cleaning treatment (Art. 6(1)(b), Art. 9(2)(h)). Legal obligations – compliance with healthcare and business regulations, including medical record retention, safeguarding, and reporting obligations (Art. 6(1)(c)). Legitimate interests – for business management, audit, and service quality improvement (Art. 6(1)(f)). Consent – for optional activities such as marketing communications or sharing information beyond your care (Art. 6(1)(a)). 5. How We Use Your Information We use your information to: Carry out our obligations arising from any contracts entered into by you and us. Provide safe and effective ear cleaning and healthcare services. Maintain accurate and secure medical records. Communicate with you regarding your queries, appointments, treatment, and aftercare. Process payments and insurance claims (if applicable). Comply with healthcare and regulatory obligations. Improve our services through client feedback. Send you communications which you have requested, consented to and that may be of interest to you. 6. Sharing of Personal Data We only share your data when necessary, including with: Public health bodies where legally required. Regulators and professional bodies (e.g., Care Quality Commission) for compliance purposes. IT service providers (Wix website host and Timely third party booking/payment system), under data processing agreements. Ear Muse Limited’s accountancy team, under strict confidentiality agreements. We do not sell your data to third parties. We do not use your data for marketing without your explicit consent. You can change your marketing preferences at any point by contacting us at earmuseltd@gmail.com. 7. Data Retention We retain your records in line with the Data Protection Act 2018. We review our retention periods on a regular basis. To fulfil our statutory obligations we are legally required to store certain information. We retain your information on our systems for as long as legally required. After the relevant period, your records will be securely deleted or destroyed. 8. Your Rights Under UK GDPR Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. Which lawful basis we rely on may affect your data protection rights which are set out in brief below. Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Your right to erasure - You have the right to ask us to delete your personal information. Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information. Your right to object to processing - You have the right to object to the processing of your personal data. Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us using the contact details at the top of this privacy notice. 9. Data Security We take data security seriously. Measures include: Secure, encrypted storage of electronic records. Access controls with multi-step authentication. GDPR-compliant storage via Wix and Timely platforms. Staff trained in data protection and confidentiality. 10. Cookies & Website Data Our website (www.earmuseltd.com) may use automated cookies and similar technologies to support functionality and improve your experience. The information we may collect includes your IP address, browser characteristics, referring URLs, dates and times of visits to our site and other usage statistics. The primary cookies used on our site are Google Analytics: anonymised data reports the number of visitors to our site and the pages visited. Google Analytics privacy policy can be found here: http://www.google.com/analytics/learn/privacy.html. Necessary cookies are required for the website to function. Analytics cookies (if used) help us understand website usage. You can control or disable cookies through your browser settings. See our cookies policy for more information. 11. Updates to This Policy We may update this Privacy Policy from time to time to reflect changes in law, technology, or business operations. The latest version will always be available on our website: 🌐 www.earmuseltd.com Ear Muse Limited is registered with the Information Commissions Office. You can find more information about GDPR and keeping your data safe at: https://ico.org.uk/