Privacy Policy
Pathfinder Osteopathy is committed to protecting and respecting your privacy. This privacy notice explains how we collect, use, and protect your personal data when you visit our clinic or use our services, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who We Are
Pathfinder Osteopathy is the "Data Controller" for your personal information.
● Address: Pathfinder Osteopathy, The Olive Sanctuary, Olives Yard, Uckfield High Street, East Sussex, TN22 1QP
● Phone: 07722 46 86 36
● Email: joe@pathfinder.clinic
● Data Protection Lead: Jody Seaver
2. The Types of Personal Data We Collect
We collect and process personal information to provide you with safe and effective osteopathic treatment. This includes:
● Contact Data: Name, address, date of birth, telephone number, and email address.
● Medical / Special Category Data: Detailed clinical notes including medical history, symptoms, lifestyle factors, medications, scan/X-ray reports, and details of treatments provided.
● Financial Data: Payment card details and billing history.
3. Our Lawful Basis for Processing Data
Under the UK GDPR, we rely on the following lawful bases to process your information:
1. Contractual Necessity: We process your contact and financial data to fulfil our contract with you (i.e., managing bookings and processing payments).
2. Legitimate Interests: We may process your contact info to send appointment reminders or follow-ups to ensure continuity of care.
3. Provision of Health or Social Care (Special Category Data): For your medical records, our legal basis falls under Article 9(2)(h) of the UK GDPR, which permits the processing of health data for the purposes of preventive or occupational medicine, medical diagnosis, and the provision of health or social care treatment.
4. How We Use and Share Your Data
Your information is stored securely and access is strictly limited:
● Internal Use: Only clinical practitioners and vetted administrative staff involved in your care or booking administration will have access to your data.
● External Sharing: We will never share your medical details with third parties (such as your GP, consultant, or insurance company) without your explicit consent, unless legally compelled to do so by law enforcement, court order, or public safety mandates.
4.1 Third-Party Software and Cloud Storage (Cliniko)
We use a secure, cloud-based practice management system called Cliniko to host our electronic health records, schedule online appointments, issue invoices, and manage patient communication.
● Data Role: Under the UK GDPR, Pathfinder Osteopathy is the Data Controller of your personal information, and Cliniko acts as our Data Processor. This means they only handle your data according to our strict instructions and for the exclusive purpose of operating our clinical diary and record system.
● Data Protection Safeguards: We hold a formal Data Processing Addendum (DPA) with Cliniko. They employ robust administrative, technical, and physical security controls (including end-to-end data encryption in transit and at rest) to safeguard your clinical notes and personal details.
● International Transfers: Where data is transferred or processed outside the UK, Cliniko utilizes Standard Contractual Clauses (SCCs) and has designated a legal UK privacy representative to guarantee an equivalent level of data protection.
5. Marketing Communications
We would love to keep you updated with clinic news, health advice, and promotional offers. However, we will never use your personal data for marketing purposes without your explicit consent.
● How We Collect Consent: When you complete your initial intake form or use our online booking platform, you will be given a clear option to opt-in to marketing emails or SMS texts.
● No Third-Party Sharing: We do not sell, rent, or pass your contact details to third-party marketing companies.
● Your Right to Opt-Out: You can withdraw your consent and opt-out of marketing communications at any time. You can do this by clicking the "Unsubscribe" link at the bottom of any marketing email, or by contacting us directly at [Insert Email Address].
Please note: Opting out of marketing will never affect administrative communications regarding your health care, such as appointment confirmations, changes to clinic hours, or invoices.
6. Data Retention Timelines
In accordance with the General Osteopathic Council (GOsC) standards and UK medical record guidance, we retain your records for the following periods:
● Adult Patients: Medical records are retained for a minimum of 8 years from the date of your last treatment.
● Child Patients (Under 18): Medical records must be retained until the patient’s 25th birthday, or 26th birthday if the patient was 17 at the conclusion of their last treatment (whichever is longer).
7. Your Data Protection Rights
Under UK data protection law, you have specific rights regarding your personal information:
● Right of Access (Subject Access Request): You have the right to request a copy of the personal and medical data we hold about you.
● Right to Rectification: You can request that we correct any factually inaccurate information.
● Right to Erasure ("Right to be Forgotten"): Please note: This right does not override our legal and professional obligation to maintain medical records for the mandatory 8-year retention period.
● Right to Restrict or Object to Processing: You can ask us to restrict how we use your data, or opt-out of optional processing like marketing communications.
To exercise these rights, please contact us using the details in Section 1. We may require proof of identification before releasing clinical data to ensure patient security.
8. How to Complain
If you have any concerns about how we handle your data, please contact us directly so we can resolve the issue. If you remain unsatisfied, you have the right to lodge a formal complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection.