Privacy Policy | Chelmsford Osteopathy Clinic

Introduction

At Chelmsford Osteopathy Clinic, I take your privacy seriously. This policy explains what personal information I collect, how I use it, how I protect it and what your rights are under UK data protection law.

Chelmsford Osteopathy Clinic is operated by John Dods, a sole practitioner registered with the General Osteopathic Council (GOsC). I am registered with the Information Commissioner’s Office (ICO) as a data controller.

If you have any questions about this policy or how I handle your personal data, please contact me at:

📧 info@chelmsfordosteopathyclinic.co.uk
📞 07440 498109
📍 Chelmsford Osteopathy Clinic, 2 Rainsford Road, Chelmsford CM1 2QD

What Personal Data I Collect

Patient Information

When you book an appointment or attend the clinic, I may collect:

Your full name, date of birth and contact details (address, phone number, email)
Medical history, current medications and health information relevant to your treatment
Treatment notes and clinical records
Emergency contact details
Insurance information where applicable
Payment information

This information is necessary for me to provide safe and appropriate osteopathic care. It is classified as special category data under UK GDPR and is handled with the highest level of care and confidentiality.

Website Information

When you visit chelmsfordosteopathyclinic.co.uk, I may collect:

Your IP address and browser information for security and spam detection purposes
Information you submit through contact forms or enquiry forms
Cookie data — see the Cookies section below

Why I Collect Your Data

I collect and use your personal information for the following purposes:

To provide osteopathic treatment — clinical records are essential for safe, effective and continuous care
To communicate with you — appointment confirmations, reminders and follow-up correspondence
To process payments — including insurance claims where applicable
To meet legal and professional obligations — as a GOsC registered osteopath I am required to maintain accurate clinical records
To improve the website — anonymous usage data helps me understand how patients find and use the site

Legal Basis for Processing Your Data

Under UK GDPR, I process your personal data on the following legal bases:

Contract — processing necessary to provide the osteopathic services you have requested
Legal obligation — to comply with professional regulatory requirements set by the GOsC
Legitimate interests — for website security, spam prevention and improving the clinic’s services
Explicit consent — for marketing communications such as the newsletter, where you have opted in

For special category health data, I rely on:

Explicit consent — obtained at your first appointment
Health and social care purposes — as permitted under UK GDPR Article 9(2)(h)

How Long I Keep Your Data

Clinical records are retained for a minimum of 8 years from the date of last treatment in line with professional guidance, or until a patient’s 25th birthday if they were a minor at the time of treatment — whichever is longer.

Contact and enquiry data is retained for as long as necessary to respond to your enquiry and for a reasonable period thereafter.

Website comment data is retained indefinitely to allow recognition and approval of follow-up comments.

Marketing data is retained until you unsubscribe or request removal.

Who I Share Your Data With

I treat your personal information with strict confidentiality. I will only share your data in the following circumstances:

With your consent — for example, if you ask me to correspond with your GP or another healthcare professional
When legally required — for example, in response to a court order or safeguarding concern
With service providers — such as my booking system, email provider or website host, all of whom are bound by data processing agreements and required to protect your data

I do not sell your personal data to third parties. I do not use your data for unsolicited marketing without your explicit consent.

Cookies

Cookies are small text files stored on your device when you visit a website. This website uses the following types of cookies:

Essential cookies — necessary for the website to function correctly. These include temporary session cookies set when you visit the site.

Comment cookies — if you leave a comment on the site, you may opt in to saving your name, email address and website in cookies for your convenience. These last for one year.

Login cookies — if you log in to the website, cookies are set to save your login information for up to two days, or two weeks if you select “Remember Me.”

Analytics cookies — where analytics tools are used to understand how visitors use the site, this may involve cookies. No personally identifiable information is collected through analytics.

You can control and delete cookies through your browser settings at any time. Disabling certain cookies may affect the functionality of the website.

Embedded Content

Pages on this website may include embedded content from third-party services such as YouTube or Google Maps. Embedded content from other websites behaves as if you had visited those websites directly and may collect data about you, use cookies and monitor your interaction with that content. Please refer to the relevant third-party privacy policies for further information.

Your Rights Under UK GDPR

Under UK data protection law, you have the following rights:

Right of access — you can request a copy of the personal data I hold about you
Right to rectification — you can ask me to correct inaccurate or incomplete data
Right to erasure — you can ask me to delete your personal data, subject to any legal obligations to retain it
Right to restrict processing — you can ask me to limit how I use your data in certain circumstances
Right to data portability — you can request your data in a portable format
Right to object — you can object to processing based on legitimate interests
Right to withdraw consent — where processing is based on consent, you can withdraw it at any time

To exercise any of these rights, please contact me at info@chelmsfordosteopathyclinic.co.uk

I will respond to all requests within one month. If your request is complex or you have made multiple requests, I may extend this period by a further two months, in which case I will notify you.

How I Protect Your Data

I take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or disclosure. These include:

Secure, password-protected systems for storing clinical records
Encrypted email communication where possible
Limited access to personal data on a need-to-know basis
Regular review of data security practices

Data Breaches

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, I will notify the ICO within 72 hours of becoming aware of the breach, and will notify affected individuals without undue delay where required.

Complaints

If you are unhappy with how I have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

🌐 ico.org.uk
📞 0303 123 1113

I would always appreciate the opportunity to address your concerns directly before you contact the ICO, so please feel free to get in touch with me first.

Changes to This Policy

I may update this privacy policy from time to time. Any changes will be posted on this page with an updated date. I encourage you to review this policy periodically.

Contact

If you have any questions about this privacy policy or how I handle your personal data, please contact me:

John Dods
Chelmsford Osteopathy Clinic
2 Rainsford Road, Chelmsford CM1 2QD
📧 info@chelmsfordosteopathyclinic.co.uk
📞 07440 498109

Chelmsford Osteopathy Clinic | Last updated: July 2026