Privacy Notice

Scope

This document refers to personal data, which is defined as information concerning any living person (a natural person who hereafter will be called the Data Subject) that is not already in the public domain.

The UK General Data Protection Regulation (UK GDPR), together with the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), sets out the framework for protecting personal data in the United Kingdom. These laws establish individuals’ rights in relation to their personal data and place obligations on organisations to process personal data lawfully, fairly and transparently, to keep it secure, and to respect those rights.

This Privacy Notice also applies to personal data processed through our online booking system, including where appointment-related data is stored or processed in the European Union. Where this happens, we ensure that personal data is handled in accordance with the UK GDPR and appropriate safeguards.

1 - Elvina’s Osteopathic Clinic

Elvina’s Osteopathic Clinic is based at Airport House, Purley Way, Croydon, CR0 0XZ. We provide osteopathic treatment and related healthcare services.

This Privacy Notice explains how we collect, use, store and protect your personal data when you contact us, book appointments, receive treatment, use our website or otherwise interact with the practice.

2 - Who we are

In this Privacy Notice, “we”, “us” and “our” refer to Elvina’s Osteopathic Clinic. Elvina’s Osteopathic Clinic is responsible for deciding how your personal data is used for the purposes described in this notice. This includes personal data collected in connection with enquiries, appointments, treatment, clinical records, billing, administration and related communications. We provide osteopathic treatment in accordance with relevant professional standards and guidance.

The practice may also provide Cranio-Sacral Therapy treatments.

3 - Personal data

a) For the purposes of providing treatment, we may require detailed medical information. We will only collect what is relevant and necessary for your treatment. When you visit our practice, we will make notes which may include details concerning your health, medication, treatment and other issues affecting your musculoskeletal condition. This data is held securely and is not shared with anyone who is not involved in your treatment, except where this is necessary for the purposes described in this notice.

To provide safe and effective treatment, we need to collect, record and use relevant information about your health and treatment. We process this health information where it is necessary for medical diagnosis, the provision of healthcare and the maintenance of accurate clinical records.

As part of our obligations as healthcare practitioners, there may be circumstances where it is necessary to share relevant medical information with other healthcare professionals, such as GPs, consultants, surgeons or medical insurers, where this is required for your care, for medical diagnosis, or to comply with a legal obligation. Where appropriate, we will inform you before doing so. Where we rely on your explicit consent for a specific purpose, such as sharing information with another professional where consent is required, we will ask you for that consent separately and you may withdraw it at any time.

Contact details provided by you, such as telephone numbers, email addresses and postal addresses, may be used to remind you of future appointments, provide reports or other information concerning your treatment.

b) We may use the contact details you provide to respond to your enquiries and to communicate with you about appointments, treatment and related administrative matters. These service communications are not treated as direct marketing where they are necessary to provide information you need about your care or your arrangements with us. If we wish to send you promotional messages about our services by email or text, we will only do so where permitted under the Privacy and Electronic Communications Regulations (PECR), for example where you have given your consent or where the limited soft opt-in rules apply.

c) We do not assume that you consent to marketing simply because you contact the practice. Where consent is required for electronic marketing, we will ask for it clearly and separately. You may withdraw your consent or opt out of marketing communications at any time by using the contact details in this notice or any unsubscribe method provided in the message. If we promote services provided by other practitioners working from our premises, we will only do so where this is lawful under PECR and the UK GDPR. We do not sell or broker your personal data.

d) We may collect limited personal data through website enquiry forms, surveys, correspondence records and information about how our website is used. This may include contact information you choose to provide and technical information such as Internet Protocol (IP) addresses. Where our website uses cookies or similar technologies, we will provide appropriate information about them and, where required by law, ask for your consent or give you a clear way to object. We will only use website and analytics information in accordance with the UK GDPR and PECR.

e) We use cookies and similar technologies on our website to help the site function, to remember preferences, and, where applicable, to understand how visitors use the website. Some cookies are strictly necessary for the operation of the website, while others, such as analytics cookies, may only be used with your consent where required by law. You can manage your cookie preferences through any settings made available on the website and through your browser controls.

f) We only collect personal data that is adequate, relevant and limited to what is necessary for the purposes described in this notice. We do not sell your personal data or act as a data broker.

4 - Legal basis for processing personal data

We process personal data only where we have a valid lawful basis under Article 6 of the UK GDPR and, where health information is involved, an additional condition under Article 9 of the UK GDPR. For the provision of osteopathic treatment and the maintenance of clinical records, we rely on processing that is necessary for the performance of our contract with you and for the purposes of medical diagnosis and the provision of health care. For general enquiries and practice administration, we may rely on legitimate interests where this is appropriate and where those interests are not overridden by your rights and freedoms.

5 - Legitimate interests

Where we rely on legitimate interests, this is generally for purposes such as responding to enquiries, arranging appointments, administering the practice, maintaining secure systems and records, and improving our services where this can be done in a proportionate way. We do not rely on legitimate interests where another lawful basis is more appropriate, and we will always consider the impact on your rights and freedoms.

6 - Consent

This Privacy Notice explains how we collect, use and protect your personal data. It is not, by itself, a consent form. We only rely on consent where this is the appropriate lawful basis for a specific purpose, such as certain marketing communications or other optional processing. Where we rely on your consent, you may withdraw it at any time using the contact details provided in this notice. Withdrawal of consent will not affect processing already carried out lawfully before it was withdrawn.

7 - Disclosure

We will keep your personal information secure and limit access to those who need it for legitimate purposes. This may include osteopaths and other practitioners involved in your care, as well as administrative staff who need access to contact, appointment or account information in order to manage the practice. We may disclose personal data where this is necessary to comply with a legal obligation, to respond to lawful requests from public authorities, to establish, exercise or defend legal claims, or to protect the vital interests of you or another person. We may also share information where necessary for insurance, regulatory, professional or safeguarding purposes, provided that there is a lawful basis for doing so.

We may also share limited personal data with third-party service providers who support the operation of the practice, such as our booking and reminder system provider, where this is necessary to arrange appointments, send reminders and manage related administration. These providers act on our behalf and are required to keep personal data secure and use it only for authorised purposes.

8 - Retention policy

We retain personal data only for as long as necessary for the purposes for which it was collected and to meet our legal, professional, regulatory and insurance obligations. Clinical records are generally retained for eight years after the end of treatment. Records relating to children are generally retained until the patient reaches the age of 25. In some circumstances, we may retain limited information for longer where this is necessary to establish, exercise or defend legal claims, to comply with regulatory or safeguarding requirements, or to maintain an accurate record that a request relating to your data has been made. When personal data is no longer required, it will be securely deleted or destroyed.

9 - Data storage

We store personal data securely using systems and service providers that support the operation of the practice. Some booking and reminder data is stored in the European Union through our third-party booking and reminder provider. If personal data is transferred or accessed outside the United Kingdom or the European Union, we will only do so in accordance with the UK GDPR and will ensure that an appropriate safeguard or other lawful transfer mechanism is in place where required.

10 - Your rights as a data subject

If you make a request to exercise your rights, we will respond in accordance with UK data protection law. If we are unable to comply with your request, we will explain why, subject to any legal restrictions. You also have the right to complain to us directly about how your personal data has been handled, and to raise concerns with the Information Commissioner’s Office (ICO).

• Right of access – you have the right to request a copy of the information that we hold about you.
• Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
• Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
• Right to restriction of processing – where certain conditions apply you have a right to restrict the processing.
• Right of portability – you have the right to have the data we hold about you transferred to another organisation.
• Right to object – you have the right to object to certain types of processing such as direct marketing.
• Right to object to automated processing, including profiling – you also have the right not to be subject to the legal effects of automated processing or profiling.

11 - Information you can request

We do not use solely automated decision-making or profiling to make decisions about you that produce legal or similarly significant effects.

• Identity and the contact details of the person or organisation (Osteopaths) that has determined how and why to process your data.
• Contact details of the data protection officer, where applicable.
• The purpose of the processing as well as the legal basis for processing.
• If the processing is based on the legitimate interests of Osteopaths and information about these interests.
• The categories of personal data collected, stored and processed.
• Recipient(s) or categories of recipients that the data is/will be disclosed to.
• How long the data will be stored.
• Details of your rights to correct, erasure, restrict or object to such processing.
• Information about your right to withdraw consent at any time.
• How to lodge a complaint with the supervisory authority (ICO).
• Whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the personal data and the possible consequences of failing to provide such data.
• The source of personal data if it wasn’t collected directly from you.

12 - Access requests and identification

If you wish to request access to the personal data we hold about you, please contact us using the details set out in this notice. To protect your personal data, we may ask you to provide proof of identity and enough information to help us locate the records you are requesting.

We will usually accept identification such as a copy of your driving licence, passport or birth certificate, together with a recent utility bill or similar supporting document dated within the last three months. We normally require at least one form of photographic identification and one supporting document. If we are not satisfied with the identification provided, we may ask for further information before releasing personal data.

We will respond to your request in accordance with UK data protection law. In most cases, this means responding within one month of receiving your request and any information needed to confirm your identity. We do not normally charge a fee for dealing with a request, although we may do so where a request is manifestly unfounded, excessive or repetitive, or we may refuse to act on such a request where the law allows. Requests should be made by email to info@elvinas-osteopathicclinic.co.uk, by telephone on 07960 941461, or in writing to us at the address set out below.

13 - Complaints

If you wish to make a complaint about how your personal data is being processed, please contact us first. You can use our online complaints form or any of the contact methods below. We will aim to respond within 30 days. If you do not receive a response within 30 days, or if you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO).

Elvina Coutinho, Elvina’s Osteopathic Clinic
Airport House, Purley Way, Croydon, CR0 0XZ
Telephone: 07960 941461
Email: info@elvinas-osteopathicclinic.co.uk

Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, SK9 5AF
Telephone: 0303 123 1113
Contact form: ico.org.uk/global/contact-us