1. Who is responsible
The data controller for personal data submitted through this site is Beijing Bo's Abdominal Acupuncture Research Institute (北京薄氏腹针医学研究院), the operator of Bo's Abdominal Acupuncture.
Data controller & contact.
- Legal entity: Beijing Bo's Abdominal Acupuncture Research Institute (北京薄氏腹针医学研究院)
- Address: Room 107, Building 1, No. 38 Songyu South Road, Chaoyang District, Beijing, China (北京市朝阳区松榆南路38号院1号楼底商107)
- Privacy contact: [email protected] (also used for general enquiries)
- Telephone: +86-10-5620 2955 / 5620 2988
EEA and UK status. We are established in China and do not currently have an establishment, Data Protection Officer, or appointed data-protection representative in the EEA or the United Kingdom. This website provides general educational and institutional information and does not state that EU or UK data-protection law applies to every visit. Where those laws apply to a particular processing activity, you may contact the controller directly using the details above. We will publish representative details here if an appointment is required and made.
2. What we collect
2.1 Contact form
When you submit the enquiry form on the Contact page, we receive the name, email address, selected topic and message you provide. The form is delivered through Formspree, a third-party form-processing service, which transmits the message to our inbox.
2.2 Website delivery, security and limited statistics
Our hosting, network and security providers may process technical request information needed to deliver and protect the site, such as IP address, request time, requested page, device or browser information, and security events. Cloudflare Web Analytics is not currently enabled through a website analytics script. If enabled later, we will review this notice and the applicable notice or consent requirements before deployment.
2.3 Information we do not seek
We do not use advertising pixels, cross-site behavioral advertising or Google Analytics. We do not intentionally collect payment-card details, government identifiers or medical records through this website.
3. Cookies and tracking
We do not intentionally set advertising or cross-site tracking cookies, and we do not currently enable a website analytics script. Hosting and security infrastructure may use technologies that are strictly necessary to deliver, secure or balance traffic to the site. Laws governing cookies and similar technologies vary; we will review the applicable rules before adding any non-essential technology.
Your choice. If we introduce non-essential cookies or similar technologies that require consent in a visitor's jurisdiction, we will provide the required notice and controls before activating them for that visitor. You may also use browser privacy controls to limit scripts or storage.
4. Legal basis
We use the following grounds where the GDPR, UK GDPR or a comparable law applies:
- General, partnership and institutional enquiries: our legitimate interests in receiving, securing and responding to genuine communications (GDPR Art. 6(1)(f)).
- Training or service enquiries: taking steps at your request before a possible agreement (GDPR Art. 6(1)(b)); related administration and fraud prevention may also rely on legitimate interests.
- Website delivery and security: our legitimate interests in providing a reliable, secure website and preventing misuse (GDPR Art. 6(1)(f)).
- Aggregated website statistics: our legitimate interest in understanding site performance and improving content, to the extent personal data is involved (GDPR Art. 6(1)(f)).
Our legitimate interests are limited to the purposes above and are assessed against visitors' rights and reasonable expectations. We do not rely on consent merely because a visitor submits an enquiry.
5. Recipients and international processing
Enquiries are available only to authorized Institute personnel and service providers that support the form, email, hosting, network security and website operation. We may also disclose information where required by law or when reasonably necessary to protect legal rights.
The controller and its email inbox are in China. Formspree processes form submissions using infrastructure in the United States, and Cloudflare operates a global network that may process technical data in multiple countries. China and some other processing locations may not have an adequacy decision from the European Commission or UK Government.
Formspree states that it relies on the European Commission's Standard Contractual Clauses as a processor. Where EEA or UK restricted-transfer rules apply to our use of a provider, an applicable transfer mechanism and any required supplementary assessment must be in place. You may contact us to ask what mechanism applies to your submission. We do not claim that the EU–US Data Privacy Framework applies unless the specific recipient and processing are covered by a current certification.
6. How long we keep data
We normally delete closed enquiry records from our active Formspree account and email records within 12 months after the last substantive communication. We may keep a limited record longer where an ongoing relationship, legal obligation, dispute, fraud-prevention need or defense of legal claims requires it; we review such records at least annually and delete them when that need ends. Residual copies held in provider backups follow the provider's documented backup and deletion cycle.
We do not currently enable Cloudflare Web Analytics through a website analytics script. If analytics is enabled later, its verified retention periods will be stated here.
7. Your rights
Subject to applicable law, you may have rights to access, rectify, erase, restrict or receive a copy of your personal data, and to object to processing based on legitimate interests. Where a processing activity separately relies on consent, you may withdraw that consent without affecting earlier lawful processing. These rights are not absolute and lawful exceptions may apply.
To exercise a right, contact us using the details in Section 1. We may request proportionate information to verify your identity. EEA residents may also complain to a local authority listed by the European Data Protection Board; UK residents may contact the Information Commissioner's Office.
8. About medical information
The website contact form is for general training, institutional, partnership and administrative enquiries. It is not a clinical intake, diagnosis, treatment or emergency channel. Please do not enter symptoms, diagnoses, test results, treatment histories or other health records. For clinical needs, contact an appropriately qualified healthcare practitioner through a suitable confidential channel.
Accidental submissions. We do not ask for health data through analytics or the website form. If unsolicited health information is included in an enquiry, we will limit access, avoid using it to provide care through the website, and delete it as soon as reasonably practicable unless applicable law requires preservation or a separate appropriate process and lawful condition has been established.
9. Required information and automated decisions
Name, email address and message are required to submit the form because we cannot identify, understand or answer an enquiry without them. Topic is optional in substance and is used only to route the message. You may instead email us directly. We do not use website data for automated decisions that produce legal or similarly significant effects, and we do not profile visitors for advertising.
10. Changes and version
Effective and last updated: 12 August 2026. We may update this notice when the site, vendors or applicable requirements change. The current version will be published here. Where reasonably practicable, material changes affecting existing enquiry records will also be communicated through an appropriate channel.