Personal Data
To treat you, we require relevant, detailed medical information. This information may include your and your family’s medical histories, other issues affecting your health, referral correspondence and a case history of your treatment at the Practice. It is a requirement for your treatment that you allow us to do this. Your medical information is only shared with those involved in your treatment.
Your contact details (eg name, date of birth, address, email and telephone numbers) are required to identify you, administer and update you regarding your treatment and remind you of appointments. We use online appointment scheduling software. Only your contact details are stored in its database. This service has its own privacy policy. If you do not wish to use this service, you may book and administer your appointments with us by telephone. Using your contact details only (not your sensitive personal information), we may use other third-party services (eg virtual receptionists or bookkeepers) or software to administer your treatment and our Practice, undertake clinical audits or statistical analysis or to get feedback regarding our service.
We may also use your contact details to respond to your enquiries and email you general health information in the form of articles, advice, offers or updates to promote Osteopathy and the Practice. We may occasionally promote other practitioners and services based at the Practice (who we may not employ and are responsible for their own privacy obligations) but we will not sell or broker your data. In contacting the Practice, you consent to us having this dialogue with you, but we will also ask for your consent when you first attend for treatment and you can withdraw that consent at any time and ask us to remove you from our marketing database.
Our website and online appointment scheduling service may use cookies which is software that the website stores on the visitor’s device and gathers information from the visitor’s browser each time the visitor returns. This may include tracking the IP address of the visitor and certain access preferences. Website visitors who do not wish to have cookies placed on their device should set their browsers to refuse cookies before using the sites.
Basis for Processing Your Data
We have a legal basis to process your data to provide you with treatment (the contract between us) and because you have given us your consent. We also have a legitimate interest to process your data to provide this service and to promote treatments for all types of health problems including back pain and neck pain, tennis elbow, frozen shoulder, sciatica, headaches, sports injuries and other degenerative conditions.
Consent
By agreeing to this Privacy Notice, you are consenting to us processing your personal data for the reasons given above. You can withdraw your consent to us using that data for marketing purposes at any time.
Disclosure
We will only disclose your personal information if compelled to do so to meet legal obligations or regulatory requirements. We may also do so if we need to detect or prevent harm to the rights, property or safety of patients or staff. We will not pass your personal information to a third party except another healthcare professional (eg if you are referred elsewhere or attend another practice) or to your insurance company or legal representative. We would only do this with your consent.
Retention
We will process your data during your treatment and have a legal obligation to store your information for at least eight years after the date of your last appointment or until the age of 25, if you are under the age of 16 at the time of treatment. After this time and when we no longer require your information, it will be securely destroyed.
Data Storage
Your medical information is kept on paper and stored securely at the Practice. We do not store computerised data on servers outside of the UK or other EEA countries, except where Privacy Shield agreements are in place.
Your Rights
You have the right to:
Access (you can ask us for the information we have)
Correction (you can ask us to correct any inaccuracies or incomplete data)
Be Forgotten (in certain circumstances, we can will erase certain information regarding you)
Restrict Processing (where certain conditions apply)
Portability (you can ask us to transfer the data to someone else)
Object (you can opt out of certain types of processing eg marketing, automated processing or profiling)
What Information You Can Request
You can request the following information
Who at the Practice is responsible for your data
Why we process the information and the basis for doing so
What information we have collected, stored and processed
Who the information has come from (if not you)
Who we have disclosed that information to
How long we have stored the information for
Your rights as above
How you can withdraw your consent
How to complain
To access your information, we will require you to complete an Access Request Form and provide identification (details on the Access Request Form). Further information may be required before data can be released. We will process your request within 30 calendar days.
Data Protection Complaints
References:
A. Data Protection Act 2018 (DPA)
B. UK GDPR
C. Data (Use and Access) Act 2025
The Data (Use and Access) Act 2025 (DUAA) came in to force in June 2025. It does not replace the DPA or GDPR, but amends certain areas. One area is the requirement to have a policy specifically related to data protection complaints.
Principles
The Practice will take all data protection complaints seriously, treat complainants fairly and respectfully, investigate complaints impartially, respond within reasonable timescales and take corrective action where appropriate.
How to Make a Complaint
Complaints may be submitted by email, post, telephone, or in person. Where a complaint is made orally, staff should document the complaint and seek confirmation from the complainant that the record is accurate.
Information Required
Complainants should provide their name, contact details, a description of the concern, relevant dates, supporting evidence, and their desired outcome where known.
Complaint Handling Procedure
Complaints will be acknowledged within five working days, investigated appropriately, and a written response will normally be provided within one calendar month. Complex matters may be extended by up to two further months where permitted by law.
Personal Data Breaches
Where a complaint identifies a potential breach involving sensitive or personal data, the Practice will assess the breach and comply with applicable ICO notification requirements.
Subject Access Request Complaints
The Practice will ensure searches are reasonable and proportionate in accordance with current legislation.
Escalation
If dissatisfied, complainants should first contact the Practice Manager/Clinic Director. If their issue cannot be resolved this way, then they may contact the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, www.ico.org.uk.
Complaint Records
The Practice will maintain a Data Protection Complaints Register and retain complaint records for a minimum of six years from closure unless a longer period is required by law.
Learning and Improvement
The Practice will periodically review complaints to identify trends, training needs and opportunities for improvement.
Responsibilities
The Clinic Director is responsible for overall compliance. All staff (including assistants, associates and consultants working as part of the Practice) must recognise and report complaints, cooperate with investigations and maintain confidentiality.
Policy Review
This policy will be reviewed annually, following significant legislative changes, significant incidents or updated regulatory guidance.
Complaints
If you wish to complain about how we process and handle your data, you have the right to do so. If you are not satisfied with our response, you can complain to the ICO. Details for each of these contacts are:
Patricia Bishop
Flitwick Osteopathic Clinic
Room 16, The Rufus Centre
Steppingley Road
Flitwick
MK45 1AH
Tel: 01525 712204
ICO Registration Number: ZA335537
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113
email via https://ico.org.uk/concerns/