1. Scope
This privacy notice explains how Jackie Gowland trading as Osteo & Therapy Hub collects, uses, stores, and protects your personal data. Personal data is defined as any information relating to an identified or identifiable living individual (the Data Subject).
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), the Privacy and Electronic Communications Regulations (PECR), and the Data (Use and Access) Act (DUAA). These laws safeguard your rights, prevent unlawful data processing, and regulate the secure handling and storage of personal data within the UK.
2. Who We Are (Data Controller)
Jackie Gowland Osteopath – Osteo & Therapy Hub, based at Frogpool Manor Farm, Perry Street, Chislehurst, BR7 6HA, is the Data Controller responsible for your personal data. We diagnose and treat musculoskeletal conditions in accordance with professional standards and the Institute of Osteopathy Patient Charter.
- Data Controller / Lead: Jackie Gowland
- Address: Osteo & Therapy Hub, Frogpool Manor Farm, Perry Street, Chislehurst, BR7 6HA
- Email: jackie@osteotherapyhub.co.uk
- Telephone: +44 (0) 7474 521329
3. Personal & Special Category Data We Process
To deliver treatment and run our practice efficiently, we collect and process several categories of data:
- Medical & Health Data (Special Category Data): Detailed health information, including medical histories, medications, treatment clinical notes, and physical assessment records. Under UK GDPR Article 9, explicit consent and healthcare provision conditions apply.
- Administrative & Contact Data: Name, phone number, home address, email address, and emergency contact details used for scheduling, billing, clinical reports, and automated appointment reminders.
- Exercise & Digital Care Records: Patient exercise plans, rehab programs, and advice sheets.
- Website & Online Interactions: IP addresses, browser info, online booking form details, customer reviews, and web forms.
- CCTV Video Recordings: Short video clips (approx. 30 seconds) captured by our external security camera system for site security and safety.
4. Third-Party Systems, Administrative Access & Emergency Delegates
We do not sell or broker your personal data. Access to personal data is strictly restricted to authorized practice personnel, administrative staff, emergency delegates, and vetted third-party cloud service providers bound by formal agreements, job descriptions, and confidentiality obligations:
- Authorized Administrative Staff & Archiving Assistants: Pre-vetted administrative personnel process patient contact details and manage physical records for booking, account management, secure filing, archiving, and cross-cut destruction in accordance with strict confidentiality agreements.
- Emergency Delegate & Website Support: An authorized technical delegate maintains our website infrastructure and holds emergency access protocols to access patient contact databases solely if the practice owner is incapacitated or otherwise unable to communicate directly with patients regarding appointment cancellations or operational urgent updates.
- Cliniko: Practice management software used for appointment scheduling, patient records, online booking, and clinical note storage.
- Heidi Health: AI transcription tool used to assist in converting spoken medical information into structured clinical notes under direct practitioner oversight.
- Rehab My Patient: Digital platform used to create and deliver individual exercise plans and patient advice sheets.
- Gmail (Google Workspace): Email provider used for encrypted administrative, booking, and general patient communications.
- Eufy: Cloud security camera system capturing 30-second video clips of individuals walking past external security areas for premises security.
- Healthcare Professionals & Insurers: Where necessary for your ongoing care or insurance claims, relevant medical reports may be shared with your GP, consultants, or medical insurance providers with your explicit consent.
5. Legal Basis for Processing Data
We rely on the following lawful bases to process your personal data under UK GDPR Article 6 and Article 9:
- Contractual Necessity & Explicit Consent (Health Data): It is a requirement of treatment that you provide explicit consent for us to collect, document, and process your personal medical records for diagnosis and therapy.
- Legitimate Interests & Business Continuity: To schedule appointments, respond to enquiries, maintain emergency contact capabilities, secure premises (CCTV), and promote musculoskeletal treatments.
- Legal Obligation: To satisfy statutory healthcare record-keeping requirements, accountancy rules, and legal standards.
6. Marketing & Electronic Communications
We may use your contact details to respond to enquiries or share news, advice, and updates about services at Osteo & Therapy Hub.
- You have the right to opt out of marketing communications at any time.
- Unsubscribing can be done by clicking the “unsubscribe” link in any promotional email, or by emailing us directly at jackie@osteotherapyhub.co.uk.
- Service-related messages (such as Cliniko appointment reminders or emergency rescheduling notifications) are operational and unaffected by marketing preferences.
7. Website Cookies & Tracking Technologies
Our website (WordPress) uses cookies and embedded tools to improve navigation, analyze traffic, and power online features:
- WordPress Core Cookies: Essential functional cookies required for website operations.
- Cliniko Booking Widget: Enables patients to view availability and book appointments online.
- Google Analytics: Measures website traffic performance anonymously (configured in line with DUAA guidance).
- Google Reviews Widget: Displays client feedback and social proof.
8. Data Storage & Retention Policy
All personal and clinical records are held securely within the United Kingdom or processed using compliant UK-adequate cloud systems.
- Adult Patient Records: Retained for a minimum of 8 years following the conclusion of treatment to satisfy statutory health regulations and legal obligations.
- Child/Minor Patient Records: Retained for 8 years after the individual reaches 18 years of age (until their 25th birthday).
- CCTV Footage: 30-second clip recordings are automatically overwritten/deleted on a rolling cycle unless required for an ongoing safety incident.
- Deletion & Destruction: Once statutory retention periods expire, physical records are securely cross-cut shredded and digital records permanently erased.
9. Your Data Subject Rights
Under UK data protection legislation, you hold the following statutory rights regarding your personal information:
- Right to Information: The right to clear information on how your data is collected and used.
- Right of Access (SAR): The right to request copies of the personal data held about you.
- Right to Rectification: The right to request correction of inaccurate or incomplete details.
- Right to Erasure (“Right to be Forgotten”): The right to request data deletion, subject to legal health retention exemptions.
- Right to Restrict or Object to Processing: The right to object to direct marketing or limit processing.
- Right to Data Portability: The right to request your data be transferred to another healthcare provider.
10. Data Protection Complaints Procedure
Under the Data (Use and Access) Act, you have the right to submit data protection complaints directly to us:
- Submit Your Complaint: Email jackie@osteotherapyhub.co.uk or write to Jackie Gowland, Osteo & Therapy Hub, Frogpool Manor Farm, Perry Street, Chislehurst, BR7 6HA.
- Acknowledgment & Investigation: We will acknowledge your complaint within 30 days of receipt, investigate without delay, and inform you of the outcome.
- Escalation: You retain the right to lodge a complaint with the UK Information Commissioner’s Office (ICO):
Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113 | Website: https://ico.org.uk