Privacy Policy

This privacy policy informs you about how Marie Ayres (the Data Controller) collects, uses, stores, and protects your personal data, as well as your rights regarding that data. This policy is written in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act.

In legal terms, Marie Ayres is the Data Controller, and you are the Data Subject.

1. Contact Details

If you have any questions about this policy or wish to exercise your data protection rights, please contact me directly via email. As a sole practitioner operating across multiple locations, email is the most secure and reliable way to reach me:

2. What Data I Collect and Why (Lawful Bases)

As a chiropractic patient, you must provide specific personal information so that I can deliver safe, effective healthcare services. I process your data using the following legal frameworks:

    • Contact & Appointment Data: I collect your name, date of birth, and contact details (email and phone number) to manage your appointments, send reminders, and provide relevant administrative update.
    • Lawful Basis: Article 6(1)(b) (Performance of a Contract) – this information is necessary to fulfill my service agreement with you.
    • Health and Medical Data: I collect detailed information regarding your medical history, general health, wellbeing, and lifestyle. This allows me to perform accurate clinical assessments, provide appropriate treatment, and offer safe clinical advice.
    • Lawful Basis: Article 6(1)(f) (Legitimate Interests) to ensure clinical safety, alongside Article 9(2)(h) (Health or Social Care), which legally permits the processing of special category health data for the provision of healthcare and clinical treatment.

    3. How and Where Your Data is Stored

    Your data is handled securely using both digital and physical systems:

    • Electronic Data: Your information is collected and securely stored using Cliniko, a cloud-based patient management system. In legal terms, Cliniko acts as the Data Processor. Access to this platform is strictly restricted via secure, password-protected authentication.
    • Paper Records: Any data previously collected on physical paper is stored securely within a locked filing box located in a secure, private environment.

    4. Data Retention (How Long I Keep Your Data)

    As a registered chiropractor, I am legally required by professional and statutory regulations to retain patient records for specific periods:

    • Adults: Records are retained for eight years following the date of your last clinical visit.
    • Children: Records are retained until the patient’s 25th birthday (or their 26th birthday if they were 17 years old when their treatment concluded).

    Once these mandatory retention periods have expired, your data will be securely and permanently destroyed.

    5. Third-Party Data Sharing

    I am the only individual who has direct access to your data. To fulfill my clinical obligations, I may occasionally need to share your data with third parties (for example, referring you to another healthcare professional, your GP, or an imaging facility). I will never share your medical data with external parties without obtaining your explicit consent first, unless required to do so by law.

    6. Your Data Protection Rights

    Under UK data protection law, you hold several key rights regarding your personal information:

    • Right to be Informed: You have the right to know how your data is collected and used, which is the purpose of this policy.
    • Right of Access (Subject Access Request):** You can request a copy of the data I hold about you at any time. You may make this request verbally or in writing. I will perform a reasonable, proportionate search and provide this information in an accessible format within one calendar month, free of charge.
    • Right to Rectification: You have the right to request that I update or correct any of your personal information if it is inaccurate or incomplete.
    • Right to Erasure (“Right to be Forgotten”): You can request the erasure of your data only after the statutory medical retention periods (outlined in Section 4) have fully elapsed.
    • Right to Portability: You have the right to receive the data you provided to me in an easy-to-read, structured, and machine-readable format to transfer to another provider.
    • Right to Restrict or Object to Processing: You have the right to ask me to limit or stop processing your data, though this may restrict my ability to safely continue your clinical treatment.

    7. Internal Complaints Procedure

    If you have any questions, concerns, or complaints regarding how I handle your personal data, please contact me directly at mariejayres@gmail.com.

    In accordance with UK regulations, I will formally acknowledge your complaint within 30 days of receipt and work to resolve the matter directly with you without undue delay. Please note that under the law, you must attempt to resolve data disputes through this internal complaints procedure before escalating the matter externally.

    8. External Escalation

    If we cannot resolve the issue through my internal complaints process, or if you believe your data is being handled unlawfully, you have the right to lodge a formal complaint with the UK’s supervisory authority, the Information Commissioner’s Office (ICO). You can find more information or contact them via their official website at https://ico.org.uk.