Privacy Policy

Scope

This document refers to personal data, which is defined as information concerning any living person (a natural person who hereafter will be called the Data Subject) that is not already in the public domain.

The UK General Data Protection Regulation (GDPR) which is EU wide and far more extensive than its predecessor the Data Protection Act, along with the Privacy and Electronic Communications Regulations (PECR), seek to protect and enhance the rights of EU data subjects. These rights cover the safeguarding of personal data, protection against the unlawful processing of personal data and the unrestricted movement of personal data within the EU and its storage within the EEA.

1 – Bearsted Osteopathic Practice, based at Audley Mote house, Mote Park, Maidstone ME15 8NQ, hereafter for the purposes of this Privacy Notice referred to as “The Osteopaths”, diagnose and treat health conditions. Treatments are carried out in accordance with the Institute of Osteopathy’s patient charter http://www.iosteopathy.org/osteopathy/the–patient–charter/ . The practice may also provide other treatments, about which our staff will be pleased to provide more details.

Keira Piper is the Principal Osteopath and Data Protection Officer.

2 – Personal Data

For the purposes of providing treatment, Osteopaths may require detailed medical information. We will only collect what is relevant and necessary for your treatment and ongoing management. When you visit our practice, we will create treatment notes (Updated to electronic June 2024 – explained further down in this document) which may include details concerning your medication, treatment and other issues affecting your health. This data is always held securely, is not shared with anyone not involved in your treatment, although for data storage purposes it may be handled by pre-vetted staff who have all signed an integrity and confidentiality agreement. To be able to process your personal data it is a condition of any treatment that you give your explicit consent to allow Osteopaths to document and process your personal medical data. Contact details provided by you such as telephone numbers, email addresses, postal addresses may be used to remind you of future appointments and provide reports or other information concerning your treatment. As part of our obligations as primary healthcare practitioners there may be circumstances related to your treatment, on-going care or medical diagnosis that will require the sharing of your medical records with other healthcare practitioners e.g GPs, consultants, surgeons and/or medical insurance companies, however this will only be completed with your consent.

Where this is required, we will always inform you first unless we are under a legal obligation to comply.

For administration purposes, the Osteopaths and receptionists may also use the contact details provided by you via telephone/email or online booking to respond to your enquiries, including making telephone contact, postal contact and emailing information to you which the practice believes may be of interest to you. Contact details are stored in your treatment notes and a secure GDPR safe clinic diary database (Currently Cliniko).

In making initial contact with the practice either via telephone, email or online booking, you consent to Osteopaths maintaining an administrative dialogue with you until you either opt out (which you can do at any time) or we decide to desist in promoting our services.

For Marketing purposes we may collect some basic personal data of those who have opted in to marketing and promotional content. Personal data may be collected about you from the marketing forms and surveys you complete by choice, phone calls with us and from details of your visits to our website, including but not limited to, personally identifying information like Internet Protocol (IP) addresses.

In addition to direct marketing communications, we may use website analytics and advertising technologies to better understand how users interact with our website and to measure the effectiveness of our advertising campaigns. This may include the use of advertising platforms such as Google Ads and advertising services provided by Meta Platforms, Inc. (including Facebook and Instagram). These platforms may use cookies and similar tracking technologies to collect information about website usage, device information and interactions with our adverts.

Osteopaths’ website also uses cookies, to help Osteopaths to identify and track visitors and their website access preferences. Osteopaths’ website visitors who do not wish to have cookies placed on their computers should set their browsers to refuse cookies before using Osteopaths’ website. A pop up banner will be present when visiting the website asking for your preference, giving the opportunity to accept or decline. 

Our cookie banner is permanently accessible via the icon displayed in the bottom left corner of our website, allowing users to update or withdraw their preferences at any time.

Advertising and non-essential analytics cookies do not load, activate or transmit data unless and until a user has actively provided consent via the cookie banner. We do not rely on implied consent, pre-ticked boxes, or continued browsing as a form of consent for advertising cookies.

We go into more detail about this in our service partners section.

Osteopaths will only collect the information needed so that we can provide you with the services you require, the business does not sell or broker your data. The only circumstance in which your data would be shared with a new party is in the case of the business being sold as a going concern of goodwill or ownership being transferred in the unexpected event of illness/death of the clinic owner. You would be informed of this either via our website, email, letter, or direct verbal contact. Confidentiality would be maintained and personal data would continue to be processed in the same way as set out in this privacy policy. Any contact details would continue to be used for the same purposes unless you requested to withdraw your information from the database. Your written patient treatment records however would be maintained by law as per the retention policy outlined later in this document.

In summary the only information we hold is provided by you which includes; contact details, date of birth, address, communication and appointment logs, medical information and treatment details/notes.

  1. Service Partners

We may use the following third-party service providers named below. Please read to understand how they are used by bearsted osteopathic clinic, what personal data they may collect and how they process and store your data.

Cliniko

Bearsted Osteopathic Clinic uses Cliniko, a secure practice management software, to manage appointments, scheduling, and patient records. When you book an appointment or become a patient at our clinic, we collect some personal information through Cliniko to provide you with the best possible care.

This information may include:

  • Your name, date of birth, address, and contact details (phone number, email address)
  • Appointment details (date, time, type of appointment)
  • Medical history relevant to your treatment
  • Records of consent
  • Treatment notes, referral letters and files.
  • Billing information

How we use your information:

The information we collect through Cliniko is used solely for the following purposes:

  • To schedule and manage your appointments
  • To provide you with healthcare services
  • To send appointment confirmations and reminders
  • To communicate with you regarding your care
  • For billing purposes
  • For marketing and promotional communication (Applicable to patients who have opted in)

Cliniko Online booking:

We offer a convenient Cliniko online booking system linked on our website and social media sites to schedule appointments at your own pace. To ensure a smooth booking experience, we collect some information when you use this service. If you use our online booking system, your information will be automatically transferred to Cliniko, our secure practice management software. Please refer to the “Cliniko and Your Personal Information” section of this policy for details on how Cliniko handles your data. By using our online booking system, you consent to the collection, use, and disclosure of your personal information as described in this section.

Security and Storage:

Cliniko adheres to strict industry standards for data security. Your information is encrypted and stored securely on Cliniko’s servers in the UK, backed up daily. As Cliniko is a company based in Australia some of their servers and sub processors may also store/process data outside of the UK. For this reason they have a DPA (Data processing addendum) in place which includes Standard Contractual Clauses to ensure GDPR compliance. We also have implemented additional security measures to protect your personal data.

  • We keep all our devices updated with the latest security and anti-virus software to safeguard against emerging threats.
  • Within our clinic management software (Cliniko), we assign different access levels to team members. This ensures that only authorised personnel, such as osteopaths, have access to your medical records. Receptionists and other staff with non-clinical roles will not have access to this sensitive information.
  • Our Cliniko account is protected by strong passwords and configured with automatic timeouts in case of inactivity. Additionally, we only access this information on private devices that are also password-protected.

Google Tag Manager Integration

We use Google Tag Manager to manage website tracking scripts and marketing tags. Our Cliniko online booking system is integrated with Google Tag Manager solely for the purpose of measuring advertising conversions (for example, understanding when a booking has been completed following an advert click).

This integration does not transmit clinical notes, medical history, treatment details or any sensitive health data to advertising platforms. Only limited booking confirmation data necessary for conversion measurement may be processed where consent has been provided via our cookie banner.

Further information about Clinikos security and GDPR compliance can be found at: https://help.cliniko.com/en/articles/4792789-how-cliniko-helps-you-comply-with-uk-gdpr

Mailchimp

We use Mailchimp (The Rocket Science Group, LLC), a marketing automation platform owned by Intuit Inc., to send subscribers email newsletters and promotional content. Mailchimp is committed to GDPR compliance and offers several features to ensure we handle your data responsibly. Mailchimp stores your data securely on servers located within the United States. For this reason they have a DPA (Data processing addendum) in place which includes Standard Contractual Clauses to ensure GDPR compliance. They also implement various security measures to protect your data from unauthorised access. We use Mailchimp’s opt-in feature, which requires you to subscribe via a GDPR sign-up form available on our website. This provides a clear record of your consent. When you sign up for our Marketing email list, we collect your email address and any other information you voluntarily provide, such as your name. We will only send you marketing emails if you have explicitly consented to receive them. You can withdraw your consent at any time by clicking the “unsubscribe” link at the bottom of our emails or manage your data processing preferences. If you have any questions about our use of Mailchimp or your data privacy rights, please contact us at bearstedosteo@gmail.com or visit https://mailchimp.com/gdpr/

WordPress Software

Our website utilises the WordPress platform and linked plugins to manage content, functionality, and security. WordPress itself collects certain data, which may include:

  • IP address: This identifies your device on the internet and helps us understand general website traffic patterns.
  • User Agent: This identifies the web browser and operating system you’re using, which helps us ensure compatibility and troubleshoot any issues.
  • Website Cookies: These are small data files stored on your device that can track your browsing activity on our site. You can choose to disable cookies in your browser settings, but this may affect certain functionalities. We provide further information on the use of cookies below.

Please note: We have no direct control over the data collected by WordPress itself. For more details on their privacy practices, please refer to the WordPress Privacy Policy. https://wordpress.org/about/privacy/

This website may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for the content of other websites and are not responsible for their privacy statements or for the protection or privacy of data you submit to them. When you leave our website, we encourage you to read the privacy notice of every website you visit.

Cookies and Website Analytics

Our website uses cookies. A cookie is a small file stored on your computer or device, which enables our website to identify your computer or device as you view our website pages. Cookies allow websites to store your preferences and track how websites are used.

The use of cookies is useful to:

  • Make our website work as expected,
  • Improve the speed/security of the site,
  • Continuously improve our website for you,
  • Track visits to the site’s articles so we know what kind of information is popular for our visitors.

We do not use cookies to:

  • Collect any personally identifiable information
  • Collect any sensitive medical information
  • Pass personally identifiable data to third parties
  • Cookies do not provide us with access to your computer. You can use your web browser’s settings to refuse cookies if you wish.

However, where you have provided consent, we may use cookies and tracking technologies for analytics and advertising purposes as described below.

Google Analytics

In addition to cookies, we use Google Analytics, a web analytics service provided by Google, Inc. Google Analytics uses cookies to collect information about how users interact with our website, including the number of visitors, the pages visited, and the time spent on each page and how they arrived at the site.

This information helps us understand how users navigate our website and how to improve their experience.

Our Google Analytics account is linked with our Google Ads account and our Meta advertising account for the purpose of measuring cross-platform advertising performance, understanding user journeys, and improving marketing effectiveness.

Where enabled, advertising reporting features may provide aggregated demographic or interest-based insights. These insights are anonymised and do not identify individual patients.

The information generated by the cookie about your use of the website (including your anonymized IP address) will be transmitted to and stored by Google on servers in the United States. Google will use this information for the purpose of evaluating your use of our website, compiling reports on website activity for us, and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate your IP address with any other data held by Google.

You can refuse the use of cookies by selecting the appropriate settings on your browser or in the cookie banner, however, please note that if you do this you may not be able to use the full functionality of this website. You can also opt-out of Google Analytics by downloading and installing the Google Analytics Opt-out Browser Add-on.

Google Ads & Meta Advertising

We use Google Ads and advertising services provided by Meta Platforms, Inc. to promote our services online. These platforms may use cookies and tracking technologies (such as conversion tracking and remarketing tools) to:

  • Measure the effectiveness of advertising campaigns
  • Deliver relevant adverts
  • Create advertising audiences based on website activity
  • Understand interactions following advertisement clicks

For certain advertising activities, Bearsted Osteopathic Clinic and the relevant platform provider may act as joint controllers in respect of the initial collection and transmission of website interaction data. Once data has been received by the platform provider, it is processed in accordance with their own privacy policies.

Profiling Disclosure

Where advertising and analytics cookies are accepted, we may analyse website behaviour and interactions to create anonymised marketing audiences and improve advertising relevance. This may constitute profiling for marketing purposes.

This profiling does not produce legal effects or similarly significant effects for individuals. We do not make automated decisions that produce legal or significant effects based solely on automated processing.

By using this website and providing consent through our cookie banner, you consent to the processing of data as described above. You may withdraw or modify your consent at any time using the cookie settings icon displayed on our website.

4 – Legal basis for processing any personal data

To meet our contractual obligations obtained from explicit Patient Consent and legitimate interest to respond to enquiries concerning the services provided.

Contractual necessity – to provide osteopathic treatment and manage appointments.

Legal obligation – to comply with healthcare record retention laws & GDPR

Consent – for marketing communications and the use of advertising and non-essential analytics cookies.

Provision of healthcare – for processing special category health data necessary for medical diagnosis and treatment.

5 – Legitimate interests pursued by Osteopaths

To promote safe and tailored treatments for patients with all types of health problems indicated for osteopathic care and ongoing management.

6 – Consent

Through agreeing to this privacy notice you are consenting to Osteopaths processing your personal data for the purposes outlined above. You can withdraw consent at any time by using the postal, email address or telephone number provided at the end of this Privacy Notice.

7 – Disclosure

Osteopaths will keep your personal information safe and secure, only staff engaged in providing your treatment will have access to your written patient records, although our administration team will have access to your contact details so that they can make appointments and manage your account. Osteopaths will not disclose your Personal Information unless compelled to, in order to meet legal obligations, regulations or valid governmental requests. The practice may also enforce its Terms and Conditions, including investigating potential violations of its Terms and Conditions to detect, prevent or mitigate fraud or security or technical issues; or to protect against imminent harm to the rights, property, or safety of its staff.

8 – Retention Policy

Osteopaths will process personal data during the duration of any treatment and will continue to store only the personal data needed for eight years after the contract has expired to meet any legal obligations. After eight years all personal data will be deleted, unless basic information needs to be retained by us to meet our future obligations to you, such as erasure details. Records concerning minors who have received treatment will be retained until the child has reached the age of 25. Prior to the age of 25 or 8 years since your last visit there is no right of erasure of written patient records.

9 – Data storage

We understand the importance of protecting your privacy. At Bearsted Osteopathic Clinic, all your personal data is held in accordance with strict GDPR regulations.

Effective June 2024, Bearsted Osteopathic Clinic will be implementing an electronic note-taking system to enhance the efficiency and security of our patient records. This initiative is aimed at improving our services while ensuring the utmost confidentiality and compliance with privacy regulations. All existing patient notes recorded in paper format will remain securely stored onsite in a lockable cabinet in a lockable room in accordance with our established privacy policy. These records will continue to be accessible at each appointment and handled with the same level of care and confidentiality as before the introduction of electronic notes. Clinical Notes from June 2024 of existing patients and new patients will be created and stored on our Cliniko software. Only Data processors with the Cliniko security roles of administrator (Keira Piper Clinic owner) and Practitioners (Associate osteopaths) will have access to create, view and edit electronic notes. Our Receptionists will continue to only have access to patients contact details, communication logs and patient consent forms for the purpose of managing appointments.

10 – Your rights as a data subject

At any point whilst Osteopaths are in possession of, or processing your personal data, all data subjects have the following rights:

  • Right of access – you have the right to request a copy of the information that we hold about you.
  • Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
  • Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
  • Right to restriction of processing – where certain conditions apply you have a right to restrict the processing.
  • Right of portability – you have the right to have the data we hold about you transferred to another organisation.
  • Right to object – you have the right to object to certain types of processing such as direct marketing.
  • Right to object to automated processing, including profiling – you also have the right not to be subject to the legal effects of automated processing or profiling.

In the event that Osteopaths refuse your request under rights of access, we will provide you with a reason as to why, which you have the right to legally challenge. At your request Osteopaths can confirm what information it holds about you and how it is processed.

11 – Request of information :

To access what personal data is held, identification will be required

Osteopaths will accept the following forms of identification (ID) when information on your personal data is requested: a copy of your driving licence, passport, birth certificate and a utility bill not older than three months. A minimum of one piece of photographic ID listed above and a supporting document is required. If Osteopaths are dissatisfied with the quality, further information may be sought before personal data can be released. All requests should be made to bearstedosteo@gmail.com or by phoning 01622 735568 or writing to us at the address further below.

12 – Complaints

In the event that you wish to make a complaint about how your personal data is being processed by Osteopaths you have the right to complain to us. If you do not get a response within 30 days, you can complain to the ICO. Please refer to our separate document covering our complaints process on our website.

13 Additional Treatments and Therapists

Please note that Bearsted Osteopathic Clinic may offer additional therapies outside of osteopathy provided by alternative therapists who operate as independent sole traders. These therapists are responsible for managing their own bookings, data, and privacy practices. As such, this privacy policy does not extend to the practices or services provided by alternative therapists. Any personal information collected or processed by these therapists is subject to their own privacy practices and policies.

Data controllers and processors of Bearsted Osteopathic Clinic do not share personal data with any alternative therapists offering additional therapies operating from the clinic premises. In the event of a general enquiry to the Clinic contact number relating to additional therapies, with the permission of the person enquiring the reception staff can forward personal data such as contact details with a message to the applicable therapists to assist in enquiries. Alternatively contact details can be found on our website.

The details for each of these contacts are:

Keira Piper (Principal Osteopath & Data Protection Officer)– Bearsted Osteopathic Clinic

Telephone +4401622 735568 / bearstedosteo@gmail.com / https://bearstedosteopathicclinic.co.uk/

ICO – Wycliffe House, Water Lane, Wilmslow, SK9 5AF Telephone +44 (0) 303 123 1113 or email: Contact us | ICO

Bearsted Osteopathic Clinic reserves the right to change this Policy as we may deem necessary from time to time or as may be required by law. Any changes will be immediately posted on the Website and we encourage all of our visitors to regularly keep up to date with our current privacy policy and security measures.