Privacy Policy

1. Who we are

Walsh Chiropractic is the trading name of Holly Walsh, Doctor of Chiropractic, registered with the General Chiropractic Council (registration number GCC no. 05189). The clinic operates from a treatment room at Hackney Downs Studios, 17 Amhurst Terrace, London E8 2BT.

Holly Walsh is the data controller for the information described in this policy, and is registered with the Information Commissioner's Office (ICO) under registration number [ICO reg. no.].

Data controller: Holly Walsh, Walsh Chiropractic Hackney Downs Studios, 17 Amhurst Terrace, London E8 2BT holly@walshchiropractic.co.uk · 07442439858

2. What this policy covers

This policy applies to information we collect when you visit our website, make an enquiry, book an appointment, attend the clinic for assessment or treatment, or contact us in any other way. Please read it alongside any consent form you sign at your first appointment.

3. The information we collect

Identity and contact details. Your name, date of birth, home address, email address, telephone number, occupation, emergency contact, and your GP's name and practice.

Health information. Your reason for attending, symptoms, medical and family history, medications, lifestyle information relevant to your care, examination and assessment findings, diagnoses, treatment plans, clinical notes for every visit, exercise programmes, outcome measures, any imaging or reports you share with us, and the consent you give to examination and treatment. Under data protection law this is special category data and is given extra protection.

Appointment and payment information. Your bookings, attendance and cancellation history, the treatments you have received, and the amounts you have paid. Card payments are processed by Square/ Jane Payments — we never see or store your full card number.

Insurance information. Where your care is funded by a health insurer: your insurer, policy or membership number, and authorisation code.

Correspondence. Emails, text messages, WhatsApp messages, voicemails, online enquiry forms and reviews or feedback you send us.

Website and technical information. When you visit our website we may collect your IP address, browser and device type, and the pages you view, through cookies and similar technologies. See section 11.

4. Where we get your information

From you — directly, through enquiries, intake forms, consultations and conversations during your care. This is the great majority of what we hold.
From someone acting for you — for example a parent, carer, partner or colleague who books on your behalf.
From other healthcare professionals — your GP, a consultant, physiotherapist or imaging provider, where you have asked us to obtain a report or they refer you to us.
From your health insurer — where they authorise treatment and confirm cover.

5. Why we use it, and our lawful basis

UK data protection law requires us to have a lawful basis for everything we do with your information, and a second, additional basis for health information. Ours are set out below.

Assessing, diagnosing and treating you
Our lawful basis: performance of our contract with you.
For your health information: provision of health care and treatment (Article 9(2)(h)).

Keeping full, accurate clinical records
Our lawful basis: our legal obligation, and our legitimate interests in running a safe, accountable practice.
For your health information: provision of health care and management of health care services (Article 9(2)(h)).

Booking, confirming, reminding you of and rescheduling appointments
Our lawful basis: performance of our contract, and our legitimate interests in reducing missed appointments.
For your health information: provision of health care (Article 9(2)(h)), where any health detail is involved.

Taking payment, keeping accounts and meeting our tax obligations
Our lawful basis: performance of our contract, and our legal obligations.
For your health information: not applicable — no health information is used for this.

Claiming from your health insurer on your behalf
Our lawful basis: performance of our contract with you.
For your health information: provision of health care (Article 9(2)(h)), and your explicit consent where your insurer requires it.

Referring you to, or sharing information with, your GP or another clinician
Our lawful basis: our legitimate interests in your continuity of care.
For your health information: provision of health care (Article 9(2)(h)), normally with your agreement.

Handling complaints, insurance claims and regulatory matters
Our lawful basis: our legal obligations, and our legitimate interests in defending our position.
For your health information: establishment, exercise or defence of legal claims (Article 9(2)(f)).

Sending you clinic newsletters, offers or health tips
Our lawful basis: your consent, which you can withdraw at any time.
For your health information: not applicable — we never use your health information for marketing.

Measuring how our website is used
Our lawful basis: your consent, given through our cookie banner.
For your health information: not applicable.

Acting where there is a risk of serious harm to you or someone else
Our lawful basis: our legal obligations, and protecting someone's vital interests.
For your health information: vital interests, and substantial public interest including safeguarding (Article 9(2)(b) and (c)).

An important point about consent
We do not rely on your consent as our lawful basis for holding your clinical records. We rely on our contract with you and on our professional and legal duty to keep those records.

This matters to you in two ways. You do not have to give — or keep giving — consent to data processing in order to receive care. And because consent is not the basis we use, withdrawing it does not delete your treatment notes: we are required to retain them for the periods set out in section 9. Consent is the basis for marketing messages and non-essential cookies, and you can withdraw that at any time with no effect on your care.

6. Messages you will and won't receive

Appointment confirmations, reminders, changes, recall for a follow-up your treatment plan calls for, aftercare and exercise instructions, and invoices or receipts are part of providing your care. They are not marketing and we will send them unless you ask us not to.

Newsletters, promotions, offers and general health content are marketing. We will only send these if you have asked us to, and every message carries an unsubscribe link. You can opt out at any time by using that link or by emailing us — it will not affect your treatment in any way.

7. Who we share your information with

We share only what is necessary, and only with:

Our practice management and booking software, Jane — which stores your records, bookings and payments securely on our behalf.
Our website host, Wix — which processes enquiry forms and website analytics.
Our payment provider, Square — which processes card payments.
Our email and exercise-programme providers, e.g. Mailchimp, Simple Set — which receive only your name and contact details, never your clinical notes.
Other clinicians involved in your care — your GP, a consultant, physiotherapist, sports therapist or imaging provider, and any locum or associate chiropractor covering the clinic. All are bound by professional confidentiality. Other than in an emergency or where the law requires it, we will discuss this with you first.
Your health insurer — where you have asked us to bill them for your treatment.
Our professional indemnity insurer, legal advisers and accountant — where a claim, complaint or audit makes it necessary.
Regulators and public authorities — including the General Chiropractic Council, the ICO, the courts, the police, and safeguarding teams, where we are legally required or permitted to disclose.

We never sell your information, and we never share your clinical notes with anyone for marketing or advertising purposes.

If the clinic changes hands

If the practice is sold, merged or transferred, your records may be transferred to the new provider so that your care can continue safely. We would write to you to tell you before this happened, and the new provider would be bound by the same duties of confidentiality.

Transfers outside the UK

Some of our suppliers store data outside the UK. Where that happens we rely on UK adequacy regulations or on approved safeguards such as the International Data Transfer Agreement or UK Addendum, so your information keeps the same level of protection. You can ask us which suppliers are involved and what safeguards apply.

8. How we keep it safe

Clinical records are held in Jane, an encrypted, access-controlled system, reached only through individual password-protected accounts with two-factor authentication.
Access is limited to Holly Walsh and any locum or associate clinician providing your care, each bound by a duty of confidentiality.
Any paper notes or consent forms are stored in a locked cabinet in the treatment room and are never left unattended.
Devices used to access records are encrypted, password-protected and kept up to date.
We review these arrangements periodically, and we will tell you and the ICO without delay if a breach occurs that is likely to put your rights at risk.

9. How long we keep it

Adult clinical records: at least 8 years from the date of your last appointment.
Clinical records for children and young people: until the patient's 25th birthday, or their 26th birthday if the last entry was made when they were 17.
Clinical records for deceased patients: 8 years from the date of death.
Financial and payment records: 6 years from the end of the relevant tax year.
Enquiries that do not lead to an appointment: 12 months.
Marketing contact details: until you unsubscribe, after which we keep a minimal record that you opted out.

The General Chiropractic Council requires chiropractors to keep patient records for eight years from a patient's last visit, and for children until their 25th birthday — or their 26th if they were 17 when treatment ended. This is why we cannot delete your clinical notes on request within that period. When a period ends, records are securely deleted or shredded. Please help us by telling us when your contact details change.

10. Your rights

You have the right to:

Be informed about how we use your information — which is what this policy is for.
Access a copy of the information we hold about you, including your clinical records.
Have inaccurate information corrected. Clinical notes record a professional opinion at a point in time, so rather than overwrite them we will record your disagreement alongside the original entry.
Ask us to delete information we hold about you. We can do this for marketing and enquiry data, but not usually for clinical records within the retention periods above, which we are required to keep.
Ask us to restrict how we use your information while a concern is being resolved.
Object to processing based on our legitimate interests, and to object to direct marketing at any time.
Ask for your data in a portable format, or ask us to send it to another provider.
Withdraw consent where consent is what we rely on — marketing and non-essential cookies.

To exercise any of these, contact us using the details in section 15. We may ask you to confirm your identity. There is no charge for a copy of your own records, and we will respond within one month.

Moving to another practice
If you move to another chiropractor or clinic, you can ask us to transfer your records to them. We will not release or transfer your file to anyone — including another practice or a solicitor acting for you — until you or your legal representative have given us explicit written consent. A reasonable administrative fee may apply to a transfer, though never to a copy of your records for yourself.

11. Cookies and our website

Our website is hosted by Wix. Essential cookies make the site and its booking function work and are always on. Analytics and marketing cookies — which help us understand how the site is used — are only set if you accept them in our cookie banner, and you can change your choice at any time.

Our booking pages are provided by Jane and our website by Wix; both set their own cookies and publish their own privacy notices.

12. Children and young people

We treat children and young people with the consent of a parent or guardian, who must attend the appointment. Their records are handled in exactly the same way as any other patient's, with the retention periods set out in section 9.

13. Automated decisions

We do not make decisions about your care or your data using automated processing or profiling. Every clinical decision is made by a registered chiropractor.

14. Changes to this policy

We may update this policy to reflect changes in how we work or in data protection law. The current version is always on this page, with the date it was last updated at the top. If we make a significant change, we will tell existing patients by email.

15. Contact us, or complain

If you have a question about this policy, want a copy of your records, want to update your details, or are unhappy with how we have handled your information, please contact us first — we would always rather put something right ourselves.

Holly Walsh — Data Controller

Walsh Chiropractic

Hackney Downs Studios, 17 Amhurst Terrace, London E8 2BT

holly@walshchiropractic.co.uk

07442439858

You also have the right to complain to the Information Commissioner's Office at any time. You do not need to come to us first, although it helps if you do.

Information Commissioner's Office

Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

0303 123 1113

ico.org.uk/make-a-complaint